FS寄存器指向当前活动线程的TEB结构,
TEB包含了若干指针,各偏移说明如下:
FS:[000] 指向SEH链指针
FS:[004] 线程堆栈顶部
FS:[008] 线程堆栈底部
FS:[00C] SubSystemTib
FS:[010] FiberData
FS:[014] ArbitraryUserPointer
FS:[018] 指向TEB自身
FS:[020] 进程PID
FS:[024] 线程ID
FS:[02C] 指向线程局部存储指针
FS:[030] PEB结构地址(进程结构)
FS:[034] 上个错误号
得到KERNEL32.DLL基址的方法(Vista系统及以下)
assume fs:nothing ;打开FS寄存器
mov eax,fs:[30h] ;得到PEB结构地址
mov eax,[eax + 0ch] ;得到PEB_LDR_DATA结构地址
mov esi,[eax + 1ch] ;InInitializationOrderModuleList,esi指向了第一个module,可参看LDR_MODULE结构
lodsd ;得到KERNEL32.DLL所在LDR_MODULE结构的InInitializationOrderModuleList地址
mov edx,[eax + 8h] ;得到BaseAddress,即Kernel32.dll基址
typedef struct _PEB_LDR_DATA
{
ULONG Length; // +0x00
BOOLEAN Initialized; // +0x04
PVOID SsHandle; // +0x08
LIST_ENTRY InLoadOrderModuleList; // +0x0c
LIST_ENTRY InMemoryOrderModuleList; // +0x14
LIST_ENTRY InInitializationOrderModuleList;// +0x1c
} PEB_LDR_DATA,*PPEB_LDR_DATA; // +0x24
附录:typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList; //这里估计是个联合,实际情况下是其中的一种,这里是第三种
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;
注:该结构不完全正确,在偏移为0x18h处存放的的DllFullName指针,而0x20偏移处存放的的DllBaseName指针。
下面我贴上用windbg在xp下面的跟踪:
0:010> !teb
TEB at 7ffd4000
0:010>dd 7ffd4000
7ffd4000 0177ffe4 01780000 0177f000 00000000
7ffd4010 00001e00 00000000 7ffd4000 00000000
7ffd4020 00000d00 00000d2c 00000000 00000000
7ffd4030 7ffda00000000000 00000000 00000000
7ffd4040 00000000 00000000 00000000 00000000
7ffd4050 00000000 00000000 00000000 00000000
7ffd4060 00000000 00000000 00000000 00000000
7ffd4070 00000000 00000000 00000000 00000000
0:010>dd 7ffda000
7ffda000 00010000 ffffffff 0040000000251e90
7ffda010 00020000 00000000 00150000 7c99e4c0
7ffda020 7c921005 7c9210ed 00000001 77d12970
7ffda030 00000000 00000000 00000000 00000000
7ffda040 7c99e480 ffffffff 00000003 7f6f0000
7ffda050 7f6f0000 7f6f0688 7ffa0000 7ffa0000
7ffda060 7ffd1000 00000002 00000000 00000000
7ffda070 079b8000 ffffe86d 00100000 00002000
0:010>dd 00251e90
00251e90 00000028 00250101 00000000 00251ec0
00251ea0 002558a8 00251ec8 002558b000251f28
00251eb0 002558b8 00000000 0006000b 00080180
00251ec0 00251f18 00251e9c 00251f20 00251ea4
00251ed0 00000000 00000000 00400000 00401245
00251ee0 00043000 008c008a 000206b4 00140012
00251ef0 0002072c 00005000 0000ffff 0025209c
00251f00 7c99c220 3588a2f7 00000000 00000000
0:010>dd 00251f28 (LDR_MODULE of ntdll.dll)
00251f28 00251fd0 00251eac 7c920000 7c933156
00251f38 00094000 0208003a7c99dee8 00140012
00251f48 7c9426a4 80084004 0000ffff 0025533c
00251f58 7c99c228 4121457c 00000000 00000000
00251f68 000b000a 000e01ba 003a0043 0057005c
00251f78 004e0049 004f0044 00530057 0073005c
00251f88 00730079 00650074 0033006d 005c0032
00251f98 0065006b 006e0072 006c0065 00320033
0:010>du 208003a
0208003a "????????????????????????????????"
0208007a "????????????????????????????????"
020800ba "????????????????????????????????"
020800fa "????????????????????????????????"
0208013a "????????????????????????????????"
0208017a "????????????????????????????????"
020801ba "????????????????????????????????"
020801fa "????????????????????????????????"
0208023a "????????????????????????????????"
0208027a "????????????????????????????????"
020802ba "????????????????????????????????"
020802fa "????????????????????????????????"
0:010>du 7c99dee8
7c99dee8 "C:\WINDOWS\system32\ntdll.dll"
0:010>dd 251fd0
00251fd0 00252110 00251f28 7c800000 7c80b436
00251fe0 0011c000 0042004000251f70 001a0018
00251ff0 00251f98 80084004 0000ffff 7c99c210
00252000 7c99c210 4121457c 00000000 00000000
00252010 000b0009 000c0155 003a0043 0057005c
00252020 004e0049 004f0044 00530057 0073005c
00252030 00730079 00650074 0033006d 005c0032
00252040 0046004d 00340043 002e0032 004c0044
0:010>du 420040
00420040 "āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā"
00420080 "āāāāāāāāāāāā.Ȩ..팳퀤.....㔡ℳ....Ȃ.Ȩ"
004200c0 "ℂ.㳘㰳..㰼䥉Ȱ䤰䤂Ȃ.ȂȂ.。ぉ.ȂȂ.䔂䔼㬂....ȨȂ."
00420100 "....䔸䔰㬻.㰂㰂㱉㱉㰼㱉䤻에āāāāāāāāāāāāāāāā"
00420140 "āāāāāāāāāāāāāāāāāā度"
0:010>du 251f70
00251f70 "C:\WINDOWS\system32\kernel32.dll"
00251fb0 ""