PEB结构
typedef struct _PEB {
UCHAR InheritedAddressSpace;
UCHAR ReadImageFileExecOptions;
UCHAR BeingDebugged;
UCHAR SpareBool;
HANDLE Mutant;
HINSTANCE ImageBaseAddress;
VOID *DllList;
PPROCESS_PARAMETERS *ProcessParameters;
ULONG SubSystemData;
HANDLE DefaultHeap;
KSPIN_LOCK FastPebLock;
ULONG FastPebLockRoutine;
ULONG FastPebUnlockRoutine;
ULONG EnvironmentUpdateCount;
ULONG KernelCallbackTable;
LARGE_INTEGER SystemReserved;
ULONG FreeList;
ULONG TlsExpansionCounter;
ULONG TlsBitmap;
LARGE_INTEGER TlsBitmapBits;
ULONG ReadOnlySharedMemoryBase;
ULONG ReadOnlySharedMemoryHeap;
ULONG ReadOnlyStaticServerData;
ULONG AnsiCodePageData;
ULONG OemCodePageData;
ULONG UnicodeCaseTableData;
ULONG NumberOfProcessors;
LARGE_INTEGER NtGlobalFlag;
LARGE_INTEGER CriticalSectionTimeout;
ULONG HeapSegmentReserve;
ULONG HeapSegmentCommit;
ULONG HeapDeCommitTotalFreeThreshold;
ULONG HeapDeCommitFreeBlockThreshold;
ULONG NumberOfHeaps;
ULONG MaximumNumberOfHeaps;
ULONG ProcessHeaps;
ULONG GdiSharedHandleTable;
ULONG ProcessStarterHelper;
ULONG GdiDCAttributeList;
KSPIN_LOCK LoaderLock;
ULONG OSMajorVersion;
ULONG OSMinorVersion;
USHORT OSBuildNumber;
USHORT OSCSDVersion;
ULONG OSPlatformId;
ULONG ImageSubsystem;
ULONG ImageSubsystemMajorVersion;
ULONG ImageSubsystemMinorVersion;
ULONG ImageProcessAffinityMask;
ULONG GdiHandleBuffer[0x22];
ULONG PostProcessInitRoutine;
ULONG TlsExpansionBitmap;
UCHAR TlsExpansionBitmapBits[0x80];
ULONG SessionId;
} PEB, *PPEB;
PEB_LDR_DATA结构
typedef struct _PEB_LDR_DATA
{
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA,*PPEB_LDR_DATA;
LDR_DATA_TABLE_ENTRY 结构
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks
LIST_ENTRY InMemoryOrderLinks
LIST_ENTRY InInitializationOrderLinks
PVOID DllBase
PVOID EntryPoint
DWORD SizeOfImage
UNICODE_STRING FullDllName
UNICODE_STRING BaseDllName
DWORD Flags
WORD LoadCount
WORD TlsIndex
LIST_ENTRY HashLinks
PVOID SectionPointer
DWORD CheckSum
DWORD TimeDateStamp
PVOID LoadedImports
PVOID EntryPointActivationContext
PVOID PatchInformation
}LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENTRY
获取模块的基址代码
void _getModuleBaseAddr()
{
void *PEB = NULL,
*Ldr = NULL,
*Flink = NULL,
*p = NULL,
*BaseAddress = NULL,
*FullDllName = NULL;
__asm
{
mov eax, fs:[0x30]
mov PEB, eax
}
Ldr = (PVOID)*((PDWORD)((DWORD)PEB + 0x0c));
Flink = (PVOID)*((PDWORD)((DWORD)Ldr + 0x14));
p = Flink;
do
{
BaseAddress = (PVOID)*((PDWORD)((DWORD)p + 0x10));
FullDllName = (PVOID)*((PDWORD)((DWORD)p + 0x20));
wprintf(L"FullDllName is %s\n", FullDllName);
printf("BaseAddress is %x\n", BaseAddress);
p = (PVOID)*((PDWORD)p);
} while (Flink != p);
}