Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- bool set_image_base()
- {
- PEB* peb = reinterpret_cast<TEB*>(__readfsdword(PcTeb))->ProcessEnvironmentBlock;
- /* Set PEB->ImageBaseAddress to the image_copy */
- peb->Reserved3[1] = image_copy;
- /* Set the module's DllBase to image_copy */
- PEB_LDR_DATA* loader_data = reinterpret_cast<PEB_LDR_DATA*>(peb->Ldr);
- if (loader_data->InLoadOrderModuleList.Flink == &loader_data->InLoadOrderModuleList)
- return false;
- LDR_DATA_TABLE_ENTRY* first = reinterpret_cast<LDR_DATA_TABLE_ENTRY*>(&loader_data->InLoadOrderModuleList);
- for (LDR_DATA_TABLE_ENTRY* current = reinterpret_cast<LDR_DATA_TABLE_ENTRY*>(first->InLoadOrderLinks.Flink);
- current != first; current = reinterpret_cast<LDR_DATA_TABLE_ENTRY*>(current->InLoadOrderLinks.Flink))
- {
- try
- {
- if (current->DllBase == image_base)
- {
- unsigned long protection;
- VirtualProtect(current, sizeof(LDR_DATA_TABLE_ENTRY), PAGE_EXECUTE_READWRITE, &protection);
- current->DllBase = image_copy;
- }
- }
- catch (...)
- {
- continue;
- }
- }
- return true;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement