手工获取kernel基地址

首先回顾一下几个结构:

typedef struct _RTL_USER_PROCESS_PARAMETERS
{
ULONG MaximumLength; // 00h
ULONG Length; // 04h
ULONG Flags; // 08h
ULONG DebugFlags; // 0Ch
PVOID ConsoleHandle; // 10h
ULONG ConsoleFlags; // 14h
HANDLE InputHandle; // 18h
HANDLE OutputHandle; // 1Ch
HANDLE ErrorHandle; // 20h
CURDIR CurrentDirectory; // 24h
UNICODE_STRING DllPath; // 30h
UNICODE_STRING ImagePathName; // 38h
UNICODE_STRING CommandLine; // 40h
PWSTR Environment; // 48h
ULONG StartingX; // 4Ch
ULONG StartingY; // 50h
ULONG CountX; // 54h
ULONG CountY; // 58h
ULONG CountCharsX; // 5Ch
ULONG CountCharsY; // 60h
ULONG FillAttribute; // 64h
ULONG WindowFlags; // 68h
ULONG ShowWindowFlags; // 6Ch
UNICODE_STRING WindowTitle; // 70h
UNICODE_STRING DesktopInfo; // 78h
UNICODE_STRING ShellInfo; // 80h
UNICODE_STRING RuntimeInfo; // 88h
RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20]; // 90h
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

#define PEB_BASE (0x7FFDF000)

typedef struct _PEB_LDR_DATA
{
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef VOID STDCALL (*PPEBLOCKROUTINE)(PVOID);

typedef struct _PEB
{
UCHAR InheritedAddressSpace; // 00h
UCHAR ReadImageFileExecOptions; // 01h
UCHAR BeingDebugged; // 02h
UCHAR Spare; // 03h
PVOID Mutant; // 04h
PVOID ImageBaseAddress; // 08h
PPEB_LDR_DATA Ldr; // 0Ch
PRTL_USER_PROCESS_PARAMETERS ProcessParameters; // 10h
PVOID SubSystemData; // 14h
PVOID ProcessHeap; // 18h
PVOID FastPebLock; // 1Ch
PPEBLOCKROUTINE FastPebLockRoutine; // 20h
PPEBLOCKROUTINE FastPebUnlockRoutine; // 24h
ULONG EnvironmentUpdateCount; // 28h
PVOID* KernelCallbackTable; // 2Ch
PVOID EventLogSection; // 30h
PVOID EventLog; // 34h
PPEB_FREE_BLOCK FreeList; // 38h
ULONG TlsExpansionCounter; // 3Ch
PVOID TlsBitmap; // 40h
ULONG TlsBitmapBits[0x2]; // 44h
PVOID ReadOnlySharedMemoryBase; // 4Ch
PVOID ReadOnlySharedMemoryHeap; // 50h
PVOID* ReadOnlyStaticServerData; // 54h
PVOID AnsiCodePageData; // 58h
PVOID OemCodePageData; // 5Ch
PVOID UnicodeCaseTableData; // 60h
ULONG NumberOfProcessors; // 64h
ULONG NtGlobalFlag; // 68h
UCHAR Spare2[0x4]; // 6Ch
LARGE_INTEGER CriticalSectionTimeout; // 70h
ULONG HeapSegmentReserve; // 78h
ULONG HeapSegmentCommit; // 7Ch
ULONG HeapDeCommitTotalFreeThreshold; // 80h
ULONG HeapDeCommitFreeBlockThreshold; // 84h
ULONG NumberOfHeaps; // 88h
ULONG MaximumNumberOfHeaps; // 8Ch
PVOID** ProcessHeaps; // 90h
PVOID GdiSharedHandleTable; // 94h
PVOID ProcessStarterHelper; // 98h
PVOID GdiDCAttributeList; // 9Ch
PVOID LoaderLock; // A0h
ULONG OSMajorVersion; // A4h
ULONG OSMinorVersion; // A8h
ULONG OSBuildNumber; // ACh
ULONG OSPlatformId; // B0h
ULONG ImageSubSystem; // B4h
ULONG ImageSubSystemMajorVersion; // B8h
ULONG ImageSubSystemMinorVersion; // C0h
ULONG GdiHandleBuffer[0x22]; // C4h

PVOID ProcessWindowStation; // ???
} PEB, *PPEB;

 __asm
 {
  mov eax,fs:30h//指向PEB
  mov eax,[eax+0x0c]//指向PEB 的 _PEB_LDR_DATA结构
  mov esi,[eax+0x1c]
  lodsd//是以si位首地址，每次拷贝4个字节，把这4个字节放到eax中，然后si自动+4.
   //得到KERNEL32.DLL所在LDR_MODULE结构的InInitializationOrderModuleList地址
  mov eax,[eax+0x08]//得到BaseAddress，既Kernel32.dll基址
  mov base,eax
 }