通过堆栈获取进程自身加载模块

最新推荐文章于 2021-04-09 20:23:34 发布

yunshouhu

最新推荐文章于 2021-04-09 20:23:34 发布

阅读量1.1k

点赞数

分类专栏： VC++

本文链接：https://blog.csdn.net/earbao/article/details/23186595

版权

VC++ 专栏收录该内容

45 篇文章 1 订阅

订阅专栏

// EnumModule.cpp : Defines the entry point for the console application.
#include "stdafx.h"
#include <Windows.h>
#include <stdio.h>
//通过堆栈获取进程自身模块
void EnumModule()
{
    DWORD *PEB         = NULL,         
        *Ldr         = NULL,        
        *Flink       = NULL,         
        *p           = NULL,         
        *BaseAddress = NULL,         
        *FullDllName = NULL;
    
    // 定位PEB
    __asm    
    {        
        // fs位置保存着teb
        // fs:[0x30]位置保存着peb
        mov     eax,fs:[0x30]        
        mov     PEB,eax    
    }    
    
    // 得到LDR
    Ldr   = *( ( DWORD ** )( ( unsigned char * )PEB + 0x0c ) );
    
    // 第二条链表
    Flink = *( ( DWORD ** )( ( unsigned char * )Ldr + 0x14 ) ); 
    p     = Flink;   
    
    p = *( ( DWORD ** )p );  
    
    while ( Flink != p )
    {   
        BaseAddress = *( ( DWORD ** )( ( unsigned char * )p + 0x10 ) );        
        FullDllName = *( ( DWORD ** )( ( unsigned char * )p + 0x20 ) );   
        
        if ( BaseAddress == 0 )
        {
            break;
        }
        
        printf("ImageBase = %08x \r\n ModuleFullName = %S \r\n",
                BaseAddress, (unsigned char *)FullDllName);
        
        p = *( ( DWORD ** )p );
    }
}

int main(int argc, char* argv[])
{
    EnumModule();
	getchar();
	return 0;
}