Advertisement
NoamCohen123

PEB parser

Jul 17th, 2019
89
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 0.90 KB | None | 0 0
  1. #include <stdio.h>
  2. #include <tchar.h>
  3. #include <stdlib.h>
  4. #include <Windows.h>
  5. #include <winternl.h>
  6.  
  7. #define UNICODE
  8. #define _UNICODE
  9.  
  10. PEB func() {
  11.  
  12.     _asm
  13.     {
  14.         mov eax, fs:0x30
  15.     }
  16. }
  17. int _tmain()
  18. {
  19.     PEB fuck = func();
  20.     PPEB_LDR_DATA peb_ldr_data = (PPEB_LDR_DATA)fuck.Ldr;
  21.     //peb_ldr_data->InMemoryOrderModuleList.Flink;
  22.     LIST_ENTRY *a = &(peb_ldr_data->InMemoryOrderModuleList);
  23.    
  24.    
  25.     a = a->Flink;
  26.     PLDR_DATA_TABLE_ENTRY le = (LDR_DATA_TABLE_ENTRY*)((PBYTE)(a) - 8);
  27.  
  28.     UNICODE_STRING dll_name = (UNICODE_STRING)(le->FullDllName);
  29.  
  30.     while (le->DllBase != NULL)
  31.     {
  32.         dll_name = (UNICODE_STRING)(le->FullDllName);
  33.         wprintf(TEXT("The loade dll name is %s\n"),dll_name.Buffer);
  34.         a = a->Flink;
  35.         le = (LDR_DATA_TABLE_ENTRY*)((PBYTE)(a) - 8);
  36.     }
  37.    
  38.    
  39.     //{
  40.     //_tprintf(("%s", le->FullDllName.Buffer));
  41.  
  42.     //  le = (LDR_DATA_TABLE_ENTRY*)(PBYTE)(a.Flink - 8);
  43.     //}
  44.    
  45.  
  46.    
  47.     return 0;
  48. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement