//PEB.h
#pragma once
#include <windows.h>
#include <iostream>
using namespace std;
//宏,结构体定义,函数声明;
//#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
//要自己定义PEB结构:
//PEB结构中的查找进程完整路径的结构体
typedef struct _UNICODE_STRING
{
UINT16 Length;//short型
UINT16 MaximumLength;
PWCHAR Buffer;//WCHAR*型(四字节大小的指针)
}UNICODE_STRING,PUNICODE_STRING;
//UNICODE_STRING在Ring3层不公开,(在驱动层才公开)
typedef struct _RTL_USER_PROCESS_PARAMETERS_X86
{
UINT32 MaximumLength;
UINT32 Length;
UINT32 Flags;
UINT32 DebugFlags;
PVOID ConsoleHandle;
UINT32 ConsoleFlags;//UINT 4B
PVOID StandardInput;
PVOID StandardOutput;
PVOID StandardError;
ULONG32 CurrentDirectory[3];//原来是十二字节的结构体CURDIR
UNICODE_STRING DllPath;
UNICODE_STRING ImagePathName;//完整路径
UNICODE_STRING CommandLine;
} RTL_USER_PROCESS_PARAMETERS_X86, *PRTL_USER_PROCESS_PARAMETERS_X86;
typedef struct _PEB_X86
{
UINT8 InheritedAddressSpace;
UINT8 ReadImageFileExecOptions;
UINT8 BeingDebugged;
UINT8 BitField;//联合体(位域第一位的成员)
PVOID Mutant;//互斥体
PVOID ImageBaseAddress;//模块加载基地址
PVOID Ldr;//结构体(Ldr实际上为结构体类型指针)
PRTL_USER_PROCESS_PARAMETERS_X86 ProcessParameters;
}PEB_X86,*PPEB_X86;
#ifdef _WIN32
#define RTL_USER_PROCESS_PARAMETERS RTL_USER_PROCESS_PARAMETERS_X86
#define PPEB PPEB_X86
#define PEB PEB_X86
#else
#define PPEB PPEB_X64
#define PEB PEB_X64
#endif
//有关查找PEB地址的属于进程内存的结构体
typedef struct _PROCESS_BASIC_INFORMATION
{
NTSTATUS ExitStatus;
PPEB PebBaseAddress; //地址
ULONG AffinityMask;
LONG BasePriority;
ULONG UniqueProcessId;
//PEB.h
#pragma once
#include <windows.h>
#include <iostream>
using namespace std;
//宏,结构体定义,函数声明;
//#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
//要自己定义PEB结构:
//PEB结构中的查找进程完整路径的结构体
typedef struct _UNICODE_STRING
{
UINT16 Length;//short型
UINT16 MaximumLength;
PWCHAR Buffer;//WCHAR*型(四字节大小的指针)
}UNICODE_STRING,PUNICODE_STRING;
//UNICODE_STRING在Ring3层不公开,(在驱动层才公开)
typedef struct _RTL_USER_PROCESS_PARAMETERS_X86
{
UINT32 MaximumLength;
UINT32 Length;
UINT32 Flags;
UINT32 DebugFlags;
PVOID ConsoleHandle;
UINT32 ConsoleFlags;//UINT 4B
PVOID StandardInput;
PVOID StandardOutput;
PVOID StandardError;
ULONG32 CurrentDirectory[3];//原来是十二字节的结构体CURDIR
UNICODE_STRING DllPath;
UNICODE_STRING ImagePathName;//完整路径
UNICODE_STRING CommandLine;
} RTL_USER_PROCESS_PARAMETERS_X86, *PRTL_USER_PROCESS_PARAMETERS_X86;
typedef struct _PEB_X86
{
UINT8 InheritedAddressSpace;
UINT8 ReadImageFileExecOptions;
UINT8 BeingDebugged;
UINT8 BitField;//联合体(位域第一位的成员)
PVOID Mutant;//互斥体
PVOID ImageBaseAddress;//模块加载基地址
PVOID Ldr;//结构体(Ldr实际上为结构体类型指针)
PRTL_USER_PROCESS_PARAMETERS_X86 ProcessParameters;
}PEB_X86,*PPEB_X86;
#ifdef _WIN32
#define RTL_USER_PROCESS_PARAMETERS RTL_USER_PROCESS_PARAMETERS_X86
#define PPEB PPEB_X86
#define PEB PEB_X86
#else
#define PPEB PPEB_X64
#define PEB PEB_X64
#endif
//有关查找PEB地址的属于进程内存的结构体
typedef struct _PROCESS_BASIC_INFORMATION
{
NTSTATUS ExitStatus;
PPEB PebBaseAddress; //地址
ULONG AffinityMask;
LONG BasePriority;
ULONG UniqueProcessId;