TEB和PEB
TEB
TEB, Thread Environment Block, 线程环境块,描述了线程的状态
typedef struct _TEB {
PVOID Reserved1[12];
PPEB ProcessEnvironmentBlock;
PVOID Reserved2[399];
BYTE Reserved3[1952];
PVOID TlsSlots[64];
BYTE Reserved4[8];
PVOID Reserved5[26];
PVOID ReservedForOle;
PVOID Reserved6[4];
PVOID TlsExpansionSlots;
} TEB, *PTEB;
PEB
PEB, Process Enviroment Block, 进程环境块,包含系统与当前进程关联的用户模式下的所有参数
typedef struct _PEB {
BOOLEAN InheritedAddressSpace;
BOOLEAN ReadImageFileExecOptions;
BOOLEAN BeingDebugged;
BOOLEAN Spare;
HANDLE Mutant;
PVOID ImageBaseAddress;
PPEB_LDR_DATA LoaderData;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
PVOID SubSystemData;
PVOID ProcessHeap;
PVOID FastPebLock;
PPEBLOCKROUTINE FastPebLockRoutine;
PPEBLOCKROUTINE FastPebUnlockRoutine;
ULONG EnvironmentUpdateCount;
PPVOID KernelCallbackTable;
PVOID EventLogSection;
PVOID EventLog;
PPEB_FREE_BLOCK FreeList;
ULONG TlsExpansionCounter;
PVOID TlsBitmap;
ULONG TlsBitmapBits[0x2];
PVOID ReadOnlySharedMemoryBase;
PVOID ReadOnlySharedMemoryHeap;
PPVOID ReadOnlyStaticServerData;
PVOID AnsiCodePageData;
PVOID OemCodePageData;
PVOID UnicodeCaseTableData;
ULONG NumberOfProcessors;
ULONG NtGlobalFlag;
BYTE Spare2[0x4];
LARGE_INTEGER CriticalSectionTimeout;
ULONG HeapSegmentReserve;
ULONG HeapSegmentCommit;
ULONG HeapDeCommitTotalFreeThreshold;
ULONG HeapDeCommitFreeBlockThreshold;
ULONG NumberOfHeaps;
ULONG MaximumNumberOfHeaps;
PPVOID *ProcessHeaps;
PVOID GdiSharedHandleTable;
PVOID ProcessStarterHelper;
PVOID GdiDCAttributeList;
PVOID LoaderLock;
ULONG OSMajorVersion;
ULONG OSMinorVersion;
ULONG OSBuildNumber;
ULONG OSPlatformId;
ULONG ImageSubSystem;
ULONG ImageSubSystemMajorVersion;
ULONG ImageSubSystemMinorVersion;
ULONG GdiHandleBuffer[0x22];
ULONG PostProcessInitRoutine;
ULONG TlsExpansionBitmap;
BYTE TlsExpansionBitmapBits[0x80];
ULONG SessionId;
} PEB, *PPEB;
比较关心这个:
typedef struct _PEB_LDR_DATA {
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
三个list都是双链表,区别是模块的排列顺序不同
typedef struct _LIST_ENTRY {
struct _LIST_ENTRY *Flink;
struct _LIST_ENTRY *Blink;
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
每个模块记录的信息
typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;
FullDllName是dll的名称
windbg获取相关信息
# 展示teb信息
!teb
# 展示peb信息
!peb
# 展示teb结构
dt _teb
# 展示peb结构
dt _peb
# 查看peb地址,输出的第一行就有peb地址
!peb
# 假设peb地址为000007fffffd9000,映射地址到结构体并显示
dt _peb 000007fffffd9000
# 以_PEB_LDR_DATA结构体形式显示0x77432e40地址处的数据,深度为1
dx -r1 ((ntdll!_PEB_LDR_DATA *)0x77432e40)
# 以_LIST_ENTRY结构体形式显示0x77432e50地址处的数据
dx -r1 (*((ntdll!_LIST_ENTRY *)0x77432e50))
# 以_LDR_DATA_TABLE_ENTRY结构体形式显示0x77432e50地址处的数据
dx -r1 (*((ntdll!_LDR_DATA_TABLE_ENTRY *)0x77432e50))
_LDR_DATA_TABLE_ENTRY 是 _LIST_ENTRY 的延展
参考链接:
- https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
- https://docs.microsoft.com/zh-cn/windows-hardware/drivers/debugger/-peb
- http://undocumented.ntinternals.net/index.html?page=UserMode/Undocumented Functions/NT Objects/Process/PEB.html
- http://undocumented.ntinternals.net/index.html?page=UserMode/Structures/LDR_MODULE.html
2021/6/20