SHARE
TWEET

PEB parser

NoamCohen123 Jul 17th, 2019 56 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include <stdio.h>
  2. #include <tchar.h>
  3. #include <stdlib.h>
  4. #include <Windows.h>
  5. #include <winternl.h>
  6.  
  7. #define UNICODE
  8. #define _UNICODE
  9.  
  10. PEB func() {
  11.  
  12.     _asm
  13.     {
  14.         mov eax, fs:0x30
  15.     }
  16. }
  17. int _tmain()
  18. {
  19.     PEB fuck = func();
  20.     PPEB_LDR_DATA peb_ldr_data = (PPEB_LDR_DATA)fuck.Ldr;
  21.     //peb_ldr_data->InMemoryOrderModuleList.Flink;
  22.     LIST_ENTRY *a = &(peb_ldr_data->InMemoryOrderModuleList);
  23.    
  24.    
  25.     a = a->Flink;
  26.     PLDR_DATA_TABLE_ENTRY le = (LDR_DATA_TABLE_ENTRY*)((PBYTE)(a) - 8);
  27.  
  28.     UNICODE_STRING dll_name = (UNICODE_STRING)(le->FullDllName);
  29.  
  30.     while (le->DllBase != NULL)
  31.     {
  32.         dll_name = (UNICODE_STRING)(le->FullDllName);
  33.         wprintf(TEXT("The loade dll name is %s\n"),dll_name.Buffer);
  34.         a = a->Flink;
  35.         le = (LDR_DATA_TABLE_ENTRY*)((PBYTE)(a) - 8);
  36.     }
  37.    
  38.    
  39.     //{
  40.     //_tprintf(("%s", le->FullDllName.Buffer));
  41.  
  42.     //  le = (LDR_DATA_TABLE_ENTRY*)(PBYTE)(a.Flink - 8);
  43.     //}
  44.    
  45.  
  46.    
  47.     return 0;
  48. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top