bool GetPEBOffset(ULONG* PEBOffset) EJCKVT
{ BSO6Z("a7
ULONG n,*Buffer,PID,Count=0,i=0; ${iMlcd/,
UCHAR* SearchBuffer; Je%)/U
PEPROCESS Pr = NULL; ,p:crJ9
bool bOK; |bsJ1=U
ULONG Array[3]={0,0,0}; n]3|Ca*
if(PEBOffset) uGVn}+
*PEBOffset=0; > >u R L
ZwQuerySystemInformation(SystemModuleInformation,&n,0,&n); 9<-0B%8
Buffer = (ULONG*)ExAllocatePool(NonPagedPool,n*sizeof(ULONG)); %sKb
ZwQuerySystemInformation(SystemProcessInformation,Buffer,n*sizeof(ULONG),0); G]b})kb
ULONG Offset = 0; ~$ ]<?5
SYSTEM_PROCESS_INFORMATION*P=(SYSTEM_PROCESS_INFORMATION*)Buffer; wZ~{@tIw
do LE JKY< H
{ ~~~)+y
P=(SYSTEM_PROCESS_INFORMATION*)((BYTE*)P+Offset); ^8H+P4
Offset = P->NextEntryOffset; s$BpH5[=h=
PID = PTR_TO_NUM(P->UniqueProcessId); M' ([~
if(PID<8)continue; _lA+8%?e
Pr = NULL; gf n>~(
PsLookupProcessByProcessId(NUM_TO_PTR(PID),&Pr); &n,1JS5}
if(Pr) Z #-0(@
{ IMR1R#u
SearchBuffer=(UCHAR*)Pr; C[Xn"o+h
if(MmIsAddressValid((VOID*)&SearchBuffer[0x150])==false) jxN:
continue; a@D>rT*G
if(MmIsAddressValid((VOID*)&SearchBuffer[0x304])==false) K{)h!h4v5
continue; ;LW;HKq<
for(n = 0x150; n < 0x300;n++) n`,'&C$
{ a- xa/i(e
if((*(DWORD*)&SearchBuffer[n] & 0x7FFD0FFF)==0x7ffd0000) /=Q N1m
{ (1 n_aIz
Array=n; 'qyx"t
i++; U<~WMl8
break; hk.hA
} DJzMwe
} #j_3DT`jb
if(i>=3) FWal&plg
break; ^o-uOOw [
} [ i r^&4c
}while(Offset); &56@(2S
ExFreePool(Buffer); X(zYGWn j
bOK=true; | hDYe?gI
for(i = 0; i < 3;i++) dM*gm=
{ ocMktwm~
if(Array!=Array[0]) -f~5#6Q]
{ m G-4F/
bOK=false; wo!rp|>*
break; 9jWO#8&[1
} w=4RBNe
} f<JD JTe%{
if(bOK) ~CSi@]49
{ dwR. 4KY
if(PEBOffset) 9bSVKv]
*PEBOffset=Array[0]; ai Uk:e
DbgPrint("Syser : Find PEB at %x of EPROCESS/n",Array[0]); h[B#cF.3'
} j`2zNEO9]
return bOK; o 2~bU/
}
动态定位 PEB 在 EPROCESS 中的便移量
最新推荐文章于 2019-12-26 21:33:05 发布