Advertisement
Guest User

test

a guest
Jan 27th, 2015
175
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.01 KB | None | 0 0
  1. void* AddModuleToPEB()
  2. {
  3. LPVOID lpEntry = 0;
  4. PLDR_DATA_TABLE_ENTRY NewEntry = 0;
  5. PPEB32 Peb = GetPEB();
  6. PPEB_LDR_DATA Ldr = Peb->Ldr;
  7. PLDR_DATA_TABLE_ENTRY DataEntryStart = (PLDR_DATA_TABLE_ENTRY)Ldr->InLoadOrderModuleList.Flink;
  8. PLDR_DATA_TABLE_ENTRY DataCurrent = DataEntryStart;
  9. PLDR_DATA_TABLE_ENTRY LastEntry = (PLDR_DATA_TABLE_ENTRY)(DataCurrent->InLoadOrderLinks.Blink);
  10.  
  11. unsigned long ulLastAddress = (unsigned long)(DataCurrent->InLoadOrderLinks.Blink); //Address to the last entry
  12. unsigned long ulFirstEntry = (unsigned long)((PLDR_DATA_TABLE_ENTRY)(DataCurrent->InLoadOrderLinks.Blink))->InLoadOrderLinks.Flink; //Address to the first entry
  13.  
  14. lpEntry = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(LDR_DATA_TABLE_ENTRY));
  15. NewEntry = (PLDR_DATA_TABLE_ENTRY)lpEntry;
  16.  
  17. printf("%2X\n", lpEntry);
  18.  
  19. *(unsigned long*)(&NewEntry->InLoadOrderLinks.Flink) = ulFirstEntry;
  20. *(unsigned long*)(&DataCurrent->InLoadOrderLinks.Blink) = (unsigned long)lpEntry;
  21. *(unsigned long*)(&NewEntry->InLoadOrderLinks.Blink) = ulLastAddress;
  22. *(unsigned long*)(&LastEntry->InLoadOrderLinks.Flink) = (unsigned long)lpEntry;
  23.  
  24. *(unsigned long*)(&DataCurrent->DllBase) = (unsigned long)0xFFFFFFF;
  25.  
  26. NewEntry->DllBase = (void*)0x64500000;
  27. NewEntry->BaseDllName.Buffer = L"Test.dll";
  28. NewEntry->BaseDllName.Length = wcslen(L"Test.dll");
  29. NewEntry ->BaseDllName.MaximumLength = wcslen(L"Test.dll");
  30.  
  31. do
  32. {
  33.  
  34.  
  35.  
  36. wprintf(L"%2X\n", DataCurrent->InInitializationOrderModuleList.Blink);
  37. wprintf(L"%2X\n", DataCurrent->InInitializationOrderModuleList.Flink);
  38. wprintf(L"%s\n", DataCurrent->BaseDllName.Buffer);
  39. wprintf(L"%2X\n", DataCurrent->EntryPoint);
  40. wprintf(L"%2X\n", DataCurrent->DllBase);
  41. wprintf(L"%2X\n", DataCurrent->InLoadOrderLinks.Blink);
  42. wprintf(L"%2X\n\n", DataCurrent->InLoadOrderLinks.Flink);
  43.  
  44. DataCurrent = (PLDR_DATA_TABLE_ENTRY)DataCurrent->InLoadOrderLinks.Flink;
  45. }while(DataEntryStart != DataCurrent && DataCurrent /*&& DataCurrent->BaseDllName.Buffer*/);
  46.  
  47.  
  48.  
  49. return NULL;
  50. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement