waliedassar

Extract EntryPoint, ImageBase, And SizeOfImage

Oct 18th, 2012
252
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. //http://waleedassar.blogspot.com (@waleedassar)
  2. //Code to show how to extract EntryPoint, ImageBase, and SizeOfImage from the newly-created suspended process.
  3. #include "stdafx.h"
  4. #include "windows.h"
  5. #include "stdio.h"
  6.  
  7.  
  8. #define MemoryBasicVlmInformation 0x3
  9.  
  10. struct MEMORY_BASIC_VLM_INFORMATION
  11. {
  12.         unsigned long ImageBase;
  13.         unsigned long blah[0x2];
  14.         unsigned long SizeOfImage;
  15. };
  16.  
  17.  
  18. //nt!_SECTION_IMAGE_INFORMATION
  19. struct PROCESS_IMAGE_INFORMATION
  20. {
  21.    unsigned long EntryPoint; //after relocation
  22.    unsigned long unk1;
  23.    unsigned long SizeOfStackReserve;
  24.    unsigned long SizeOfStackCommit;
  25.    unsigned short subsystem;
  26.    unsigned short unk2;
  27.    unsigned short MinorSubSystemVersion;
  28.    unsigned short MajorSubsystemVersion;
  29.    unsigned long unk3;
  30.    unsigned short characteristics;
  31.    unsigned short dll_characteristics;
  32.    unsigned short machine;
  33.    unsigned short flags;  //0x0400--->FLAG_IMAGE_RELOCATED 0x1---->???
  34.    unsigned long LoaderFlags;
  35.    unsigned long FileSize;  //on disk
  36.    unsigned long Checksum;
  37. };
  38.  
  39. extern "C"
  40. {
  41.         int __stdcall ZwQueryVirtualMemory(HANDLE,void*,int,void*,int,unsigned long*);
  42.         int __stdcall ZwQueryInformationProcess(HANDLE,int,PROCESS_IMAGE_INFORMATION*,unsigned long,int*);
  43. }
  44.  
  45. int main(void)
  46. {
  47.     STARTUPINFO SI={sizeof(SI)};
  48.     PROCESS_INFORMATION PI;
  49.     if(CreateProcess(0,"calc.exe",0,0,0,CREATE_SUSPENDED,0,0,&SI,&PI))  //CreateProcess in suspended state
  50.     {
  51.         PROCESS_IMAGE_INFORMATION Q={0};
  52.         ZwQueryInformationProcess(PI.hProcess,0x25,&Q,sizeof(Q),0);
  53.         printf("My Entrypoint is %X\r\n",Q.EntryPoint);
  54.         unsigned long out=0;
  55.         MEMORY_BASIC_VLM_INFORMATION MBVI={0};
  56.         ZwQueryVirtualMemory(PI.hProcess,(void*)(Q.EntryPoint) /*anywhere withing the PE range*/,MemoryBasicVlmInformation,&MBVI,sizeof(MBVI),&out);
  57.         printf("Image Base: %X SizeOfImage: %X\r\n",MBVI.ImageBase,MBVI.SizeOfImage);
  58.  
  59.         //You can now resume
  60.         ResumeThread(PI.hThread);
  61.     }
  62.     return 0;
  63. }
RAW Paste Data