admin/2vg-blackcat-rs
1
0
Fork 0
mirror of https://github.com/2vg/blackcat-rs synced 2026-06-08 10:16:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed PEB type in process hollow

Browse Source
This commit is contained in:
uru
2021-03-16 08:53:33 +09:00
parent 5e328f0ca6
commit 32024af2e1
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crate/process-hollow/src/pe.rs
+12 -1
View File
@@ -16,7 +16,8 @@ use ntapi::{
ntpsapi::{
NtQueryInformationProcess, PROCESS_BASIC_INFORMATION,
},
ntpebteb::{ PEB, PPEB }
ntpebteb::{ PEB as PEB64, PPEB as PPEB64 },
ntwow64::{ PEB32, PPEB32 }
};
#[derive(Debug)]
@@ -62,6 +63,16 @@ pub struct LOADED_IMAGE64 {
pub SizeOfImage: ULONG,
}
#[cfg(target_pointer_width = "64")]
type PEB = PEB64;
#[cfg(target_pointer_width = "64")]
type PPEB = PPEB64;
#[cfg(target_pointer_width = "32")]
type PEB = PEB32;
#[cfg(target_pointer_width = "32")]
type PPEB = PPEB32;
pub unsafe fn find_remote_peb(h_process: HANDLE) -> PPEB {
let mut pbi = zeroed::<PROCESS_BASIC_INFORMATION>();