linux模块句柄和基址,获取内存加载的dll的句柄或基址

通过TEB遍历dllnt!_TEB

+0x000 NtTib : _NT_TIB

+0x01c EnvironmentPointer : Ptr32 Void

+0x020 ClientId : _CLIENT_ID

+0x028 ActiveRpcHandle : Ptr32 Void

+0x02c ThreadLocalStoragePointer : Ptr32 Void

+0x030 ProcessEnvironmentBlock : Ptr32 _PEB //找到PEB地址

+0x034 LastErrorValue : Uint4B

+0x038 CountOfOwnedCriticalSections : Uint4B

+0x03c CsrClientThread : Ptr32 Void

+0x040 Win32ThreadInfo : Ptr32 Void

+0x044 User32Reserved : [26] Uint4B

+0x0ac UserReserved : [5] Uint4B

+0x0c0 WOW32Reserved : Ptr32 Void

+0x0c4 CurrentLocale : Uint4B

+0x0c8 FpSoftwareStatusRegister : Uint4B

+0x0cc SystemReserved1 : [54] Ptr32 Void

+0x1a4 ExceptionCode : Int4B

+0x1a8 ActivationContextStack : _ACTIVATION_CONTEXT_STACK

+0x1bc SpareBytes1 : [24] UChar

+0x1d4 GdiTebBatch : _GDI_TEB_BATCH

+0x6b4 RealClientId : _CLIENT_ID

+0x6bc GdiCachedProcessHandle : Ptr32 Void

+0x6c0 GdiClientPID : Uint4B

+0x6c4 GdiClientTID : Uint4B

+0x6c8 GdiThreadLocalInfo : Ptr32 Void

+0x6cc Win32ClientInfo : [62] Uint4B

+0x7c4 glDispatchTable : [233] Ptr32 Void

+0xb68 glReserved1 : [29] Uint4B

+0xbdc glReserved2 : Ptr32 Void

+0xbe0 glSectionInfo : Ptr32 Void

+0xbe4 glSection : Ptr32 Void

+0xbe8 glTable : Ptr32 Void

+0xbec glCurrentRC : Ptr32 Void

+0xbf0 glContext : Ptr32 Void

+0xbf4 LastStatusValue : Uint4B

+0xbf8 StaticUnicodeString : _UNICODE_STRING

+0xc00 StaticUnicodeBuffer : [261] Uint2B

+0xe0c DeallocationStack : Ptr32 Void

+0xe10 TlsSlots : [64] Ptr32 Void

+0xf10 TlsLinks : _LIST_ENTRY

+0xf18 Vdm : Ptr32 Void

+0xf1c ReservedForNtRpc : Ptr32 Void

+0xf20 DbgSsReserved : [2] Ptr32 Void

+0xf28 HardErrorsAreDisabled : Uint4B

+0xf2c Instrumentation : [16] Ptr32 Void

+0xf6c WinSockData : Ptr32 Void

+0xf70 GdiBatchCount : Uint4B

+0xf74 InDbgPrint : UChar

+0xf75 FreeStackOnTermination : UChar

+0xf76 HasFiberData : UChar

+0xf77 IdealProcessor : UChar

+0xf78 Spare3 : Uint4B

+0xf7c ReservedForPerf : Ptr32 Void

+0xf80 ReservedForOle : Ptr32 Void

+0xf84 WaitingOnLoaderLock : Uint4B

+0xf88 Wx86Thread : _Wx86ThreadState

+0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void

+0xf98 ImpersonationLocale : Uint4B

+0xf9c IsImpersonating : Uint4B

+0xfa0 NlsCache : Ptr32 Void

+0xfa4 pShimData : Ptr32 Void

+0xfa8 HeapVirtualAffinity : Uint4B

+0xfac CurrentTransactionHandle : Ptr32 Void

+0xfb0 ActiveFrame : Ptr32 _TEB_ACTIVE_FRAME

+0xfb4 SafeThunkCall : UChar

+0xfb5 BooleanSpare : [3] UChar

PEB

nt!_PEB

+0x000 InheritedAddressSpace : UChar

+0x001 ReadImageFileExecOptions : UChar

+0x002 BeingDebugged : UChar

+0x003 SpareBool : UChar

+0x004 Mutant : Ptr32 Void

+0x008 ImageBaseAddress : Ptr32 Void

+0x00c Ldr : Ptr32 _PEB_LDR_DATA //找到LDR地址

+0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS

+0x014 SubSystemData : Ptr32 Void

+0x018 ProcessHeap : Ptr32 Void

+0x01c FastPebLock : Ptr32 _RTL_CRITICAL_SECTION

+0x020 FastPebLockRoutine : Ptr32 Void

+0x024 FastPebUnlockRoutine : Ptr32 Void

+0x028 EnvironmentUpdateCount : Uint4B

+0x02c KernelCallbackTable : Ptr32 Void

+0x030 SystemReserved : [1] Uint4B

+0x034 AtlThunkSListPtr32 : Uint4B

+0x038 FreeList : Ptr32 _PEB_FREE_BLOCK

+0x03c TlsExpansionCounter : Uint4B

+0x040 TlsBitmap : Ptr32 Void

+0x044 TlsBitmapBits : [2] Uint4B

+0x04c ReadOnlySharedMemoryBase : Ptr32 Void

+0x050 ReadOnlySharedMemoryHeap : Ptr32 Void

+0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void

+0x058 AnsiCodePageData : Ptr32 Void

+0x05c OemCodePageData : Ptr32 Void

+0x060 UnicodeCaseTableData : Ptr32 Void

+0x064 NumberOfProcessors : Uint4B

+0x068 NtGlobalFlag : Uint4B

+0x070 CriticalSectionTimeout : _LARGE_INTEGER

+0x078 HeapSegmentReserve : Uint4B

+0x07c HeapSegmentCommit : Uint4B

+0x080 HeapDeCommitTotalFreeThreshold : Uint4B

+0x084 HeapDeCommitFreeBlockThreshold : Uint4B

+0x088 NumberOfHeaps : Uint4B

+0x08c MaximumNumberOfHeaps : Uint4B

+0x090 ProcessHeaps : Ptr32 Ptr32 Void

+0x094 GdiSharedHandleTable : Ptr32 Void

+0x098 ProcessStarterHelper : Ptr32 Void

+0x09c GdiDCAttributeList : Uint4B

+0x0a0 LoaderLock : Ptr32 Void

+0x0a4 OSMajorVersion : Uint4B

+0x0a8 OSMinorVersion : Uint4B

+0x0ac OSBuildNumber : Uint2B

+0x0ae OSCSDVersion : Uint2B

+0x0b0 OSPlatformId : Uint4B

+0x0b4 ImageSubsystem : Uint4B

+0x0b8 ImageSubsystemMajorVersion : Uint4B

+0x0bc ImageSubsystemMinorVersion : Uint4B

+0x0c0 ImageProcessAffinityMask : Uint4B

+0x0c4 GdiHandleBuffer : [34] Uint4B

+0x14c PostProcessInitRoutine : Ptr32 void

+0x150 TlsExpansionBitmap : Ptr32 Void

+0x154 TlsExpansionBitmapBits : [32] Uint4B

+0x1d4 SessionId : Uint4B

+0x1d8 AppCompatFlags : _ULARGE_INTEGER

+0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER

+0x1e8 pShimData : Ptr32 Void

+0x1ec AppCompatInfo : Ptr32 Void

+0x1f0 CSDVersion : _UNICODE_STRING

+0x1f8 ActivationContextData : Ptr32 Void

+0x1fc ProcessAssemblyStorageMap : Ptr32 Void

+0x200 SystemDefaultActivationContextData : Ptr32 Void

+0x204 SystemAssemblyStorageMap : Ptr32 Void

+0x208 MinimumStackCommit : Uint4B

typedef struct _PEB_LDR_DATA {

BYTE Reserved1[8];

PVOID Reserved2[3];

LIST_ENTRY InMemoryOrderModuleList;

} PEB_LDR_DATA, *PPEB_LDR_DATA;

/*

InMemoryOrderModuleList

双向链表的头部，包含进程的已加载模块。列表中的每个项目都是指向LDR_DATA_TABLE_ENTRY结构的指针

*/

typedef struct _LIST_ENTRY {

struct _LIST_ENTRY *Flink;//前一个

struct _LIST_ENTRY *Blink;//后一个 根据这个一直遍历下去,最后会回到第一个

} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;

typedef struct _LDR_DATA_TABLE_ENTRY {

PVOID Reserved1[2];

LIST_ENTRY InMemoryOrderLinks;

PVOID Reserved2[2];

PVOID DllBase;//dll基地址

PVOID EntryPoint;

PVOID Reserved3;

UNICODE_STRING FullDllName;//dll名称

BYTE Reserved4[8];

PVOID Reserved5[3];

union {

ULONG CheckSum;

PVOID Reserved6;

};

ULONG TimeDateStamp;

} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;