Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- void* AddModuleToPEB()
- {
- LPVOID lpEntry = 0;
- PLDR_DATA_TABLE_ENTRY NewEntry = 0;
- PPEB32 Peb = GetPEB();
- PPEB_LDR_DATA Ldr = Peb->Ldr;
- PLDR_DATA_TABLE_ENTRY DataEntryStart = (PLDR_DATA_TABLE_ENTRY)Ldr->InLoadOrderModuleList.Flink;
- PLDR_DATA_TABLE_ENTRY DataCurrent = DataEntryStart;
- PLDR_DATA_TABLE_ENTRY LastEntry = (PLDR_DATA_TABLE_ENTRY)(DataCurrent->InLoadOrderLinks.Blink);
- unsigned long ulLastAddress = (unsigned long)(DataCurrent->InLoadOrderLinks.Blink); //Address to the last entry
- unsigned long ulFirstEntry = (unsigned long)((PLDR_DATA_TABLE_ENTRY)(DataCurrent->InLoadOrderLinks.Blink))->InLoadOrderLinks.Flink; //Address to the first entry
- lpEntry = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(LDR_DATA_TABLE_ENTRY));
- NewEntry = (PLDR_DATA_TABLE_ENTRY)lpEntry;
- printf("%2X\n", lpEntry);
- *(unsigned long*)(&NewEntry->InLoadOrderLinks.Flink) = ulFirstEntry;
- *(unsigned long*)(&DataCurrent->InLoadOrderLinks.Blink) = (unsigned long)lpEntry;
- *(unsigned long*)(&NewEntry->InLoadOrderLinks.Blink) = ulLastAddress;
- *(unsigned long*)(&LastEntry->InLoadOrderLinks.Flink) = (unsigned long)lpEntry;
- *(unsigned long*)(&DataCurrent->DllBase) = (unsigned long)0xFFFFFFF;
- NewEntry->DllBase = (void*)0x64500000;
- NewEntry->BaseDllName.Buffer = L"Test.dll";
- NewEntry->BaseDllName.Length = wcslen(L"Test.dll");
- NewEntry ->BaseDllName.MaximumLength = wcslen(L"Test.dll");
- do
- {
- wprintf(L"%2X\n", DataCurrent->InInitializationOrderModuleList.Blink);
- wprintf(L"%2X\n", DataCurrent->InInitializationOrderModuleList.Flink);
- wprintf(L"%s\n", DataCurrent->BaseDllName.Buffer);
- wprintf(L"%2X\n", DataCurrent->EntryPoint);
- wprintf(L"%2X\n", DataCurrent->DllBase);
- wprintf(L"%2X\n", DataCurrent->InLoadOrderLinks.Blink);
- wprintf(L"%2X\n\n", DataCurrent->InLoadOrderLinks.Flink);
- DataCurrent = (PLDR_DATA_TABLE_ENTRY)DataCurrent->InLoadOrderLinks.Flink;
- }while(DataEntryStart != DataCurrent && DataCurrent /*&& DataCurrent->BaseDllName.Buffer*/);
- return NULL;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement