Advertisement
GK-Chubbz

Set Image Base

May 16th, 2016
321
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.03 KB | None | 0 0
  1. bool set_image_base()
  2. {
  3.     PEB* peb = reinterpret_cast<TEB*>(__readfsdword(PcTeb))->ProcessEnvironmentBlock;
  4.  
  5.     /* Set PEB->ImageBaseAddress to the image_copy */
  6.     peb->Reserved3[1] = image_copy;
  7.  
  8.     /* Set the module's DllBase to image_copy */
  9.     PEB_LDR_DATA* loader_data = reinterpret_cast<PEB_LDR_DATA*>(peb->Ldr);
  10.  
  11.     if (loader_data->InLoadOrderModuleList.Flink == &loader_data->InLoadOrderModuleList)
  12.         return false;
  13.    
  14.     LDR_DATA_TABLE_ENTRY* first = reinterpret_cast<LDR_DATA_TABLE_ENTRY*>(&loader_data->InLoadOrderModuleList);
  15.  
  16.     for (LDR_DATA_TABLE_ENTRY* current = reinterpret_cast<LDR_DATA_TABLE_ENTRY*>(first->InLoadOrderLinks.Flink);
  17.         current != first; current = reinterpret_cast<LDR_DATA_TABLE_ENTRY*>(current->InLoadOrderLinks.Flink))
  18.     {
  19.         try
  20.         {
  21.             if (current->DllBase == image_base)
  22.             {
  23.                 unsigned long protection;
  24.                 VirtualProtect(current, sizeof(LDR_DATA_TABLE_ENTRY), PAGE_EXECUTE_READWRITE, &protection);
  25.  
  26.                 current->DllBase = image_copy;
  27.             }
  28.         }
  29.         catch (...)
  30.         {
  31.             continue;
  32.         }
  33.     }
  34.     return true;
  35. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement