从PEB遍历进程所有模块

最新推荐文章于 2023-12-29 18:32:49 发布

原创

最新推荐文章于 2023-12-29 18:32:49 发布 · 4.6k 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#integer #struct #module #byte #list #parameters

本文介绍如何通过遍历PEB（Process Environment Block）结构来获取进程加载的所有模块信息，包括模块的基地址、入口点、大小等关键数据。

int main(int argc, char* argv[]) { BYTE *pbytePEB = NULL; _asm { mov eax, dword ptr fs:[0x30] mov pbytePEB, eax } printf("PEB Addr: %x/n", pbytePEB); BYTE *pLdrData = pbytePEB + 0x0C; pLdrData = (BYTE *)*(DWORD *)pLdrData; printf("PEB_LDR_DATA Addr: %x/n", pLdrData); BYTE *pListEntry = pLdrData + 0x0C; // 改变此处的偏移量 BYTE *pFlink, *pBlink; pFlink = (BYTE *)*(DWORD *)pListEntry; printf("Flink: %x/n", pFlink); pBlink = (BYTE *)*(DWORD *)(pLdrData + 0x10); printf("Blink: %x/n/n", pBlink); DWORD *pdwFirstLdrMouduleAddr = (DWORD *)pFlink; for( ; ; ) { if(pdwFirstLdrMouduleAddr == (DWORD *)*(DWORD *)(pFlink)) break; printf("LDR_MODULE Addr: %x/n", (DWORD *)(pFlink)); printf("Flink: %x/n", *(DWORD *)(pFlink)); printf("Blink: %x/n", *(DWORD *)(pFlink + 0x4)); printf("BaseAddress: %x/n", *(DWORD *)(pFlink + 0x18)); printf("EntryPoint: %x/n", *(DWORD *)(pFlink + 0x1C))