started writing PEB compatible code

example/DllLoader/DllLoader.cpp

@@ -4,22 +4,92 @@
 #include <stdio.h>
 #include <malloc.h>
 
+#include "../../ntinternals.h"
 #include "../../MemoryModule.h"
 
 typedef int (*addNumberProc)(int, int);
 
 #define DLL_FILE "..\\..\\SampleDLL\\Debug\\SampleDLL.dll"
 
+PPEB GetPEB(void)
+{
+	// XXX: is there a better or even documented way to do this?
+	__asm {
+		// get PEB
+		mov eax, dword ptr fs:[30h]
+	}
+}
+
+void DumpPEB(void)
+{
+	PPEB peb = GetPEB();
+	PPEB_LDR_DATA loaderData = peb->LoaderData;
+	PLDR_MODULE loaderModule;
+
+	printf("-------------------------------------\n");
+	printf("PEB at 0x%x\n", (DWORD)peb);
+	printf("Modules (Load Order)\n");
+	loaderModule = (PLDR_MODULE)(loaderData->InLoadOrderModuleList.Flink);
+	printf("Last: %x\n", (DWORD)loaderData->InLoadOrderModuleList.Blink);
+	while (1)
+	{
+		printf("Info: %x\n", (DWORD)loaderModule);
+		if (!IsBadReadPtr(loaderModule->BaseDllName.Buffer, loaderModule->BaseDllName.Length))
+		{
+			wprintf(L"Library: %s\n", loaderModule->BaseDllName.Buffer);
+			wprintf(L"Fullname: %s\n", loaderModule->FullDllName.Buffer);
+		} else
+			printf("Unknown module\n");
+		printf("Address: %x\n", (DWORD)loaderModule->BaseAddress);
+		printf("Load count: %d\n", loaderModule->LoadCount);
+		printf("Flags: %d\n", loaderModule->Flags);
+		printf("Size: %d\n", loaderModule->SizeOfImage);
+		printf("Entry: %x\n", (DWORD)loaderModule->EntryPoint);
+		printf("Hash: %x %x\n", (DWORD)loaderModule->HashTableEntry.Flink, (DWORD)loaderModule->HashTableEntry.Blink);
+
+		// advance to next module
+		loaderModule = (PLDR_MODULE)(loaderModule->InLoadOrderModuleList.Flink);
+		if (loaderModule == (PLDR_MODULE)(loaderData->InLoadOrderModuleList.Flink))
+			// we traversed through the complete list
+			// and didn't find the library
+			goto exit;
+
+		printf("\n");
+	}
+
+exit:
+	printf("=====================================\n");
+	printf("\n");
+}
+
+static void
+OutputLastError(const char *msg)
+{
+	LPVOID tmp;
+	char *tmpmsg;
+	FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+		NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&tmp, 0, NULL);
+	tmpmsg = (char *)malloc(strlen(msg) + strlen((const char *)tmp) + 3);
+	sprintf(tmpmsg, "%s: %s", msg, tmp);
+	OutputDebugString(tmpmsg);
+	free(tmpmsg);
+	LocalFree(tmp);
+}
+
 void LoadFromFile(void)
 {
 	addNumberProc addNumber;
-	HINSTANCE handle = LoadLibrary(DLL_FILE);
+	HINSTANCE handle;
+	DumpPEB();
+	handle = LoadLibrary(DLL_FILE);
 	if (handle == INVALID_HANDLE_VALUE)
 		return;
 
+	DumpPEB();
 	addNumber = (addNumberProc)GetProcAddress(handle, "addNumbers");
 	printf("From file: %d\n", addNumber(1, 2));
 	FreeLibrary(handle);
+	DumpPEB();
 }
 
 void LoadFromMemory(void)
@@ -44,15 +114,20 @@ void LoadFromMemory(void)
 	fread(data, 1, size, fp);
 	fclose(fp);
 
-	module = MemoryLoadLibrary(data);
+	DumpPEB();
+	module = MemoryLoadLibrary(data, (unsigned char *)DLL_FILE);
 	if (module == NULL)
 	{
 		printf("Can't load library from memory.\n");
 		goto exit;
 	}
 
+	DumpPEB();
 	addNumber = (addNumberProc)MemoryGetProcAddress(module, "addNumbers");
-	printf("From memory: %d\n", addNumber(1, 2));
+	if (addNumber)
+		printf("From memory: %d\n", addNumber(1, 2));
+	else
+		printf("Not found\n");
 	MemoryFreeLibrary(module);
 
 exit:

example/DllLoader/DllLoader.vcproj

@@ -19,7 +19,7 @@
 			<Tool
 				Name="VCCLCompilerTool"
 				Optimization="0"
-				PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE"
+				PreprocessorDefinitions="PEB_SUPPORT"
 				MinimalRebuild="TRUE"
 				BasicRuntimeChecks="3"
 				RuntimeLibrary="5"
@@ -66,7 +66,7 @@
 			CharacterSet="2">
 			<Tool
 				Name="VCCLCompilerTool"
-				PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE"
+				PreprocessorDefinitions="PEB_SUPPORT"
 				RuntimeLibrary="4"
 				UsePrecompiledHeader="0"
 				WarningLevel="3"
@@ -126,6 +126,9 @@
 			<File
 				RelativePath="..\..\MemoryModule.h">
 			</File>
+			<File
+				RelativePath="..\..\ntinternals.h">
+			</File>
 		</Filter>
 		<Filter
 			Name="Ressourcendateien"

example/DllMemory.sln

@@ -8,6 +8,10 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DllLoader", "DllLoader\DllL
 	ProjectSection(ProjectDependencies) = postProject
 	EndProjectSection
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestLoader", "TestLoader\TestLoader.vcproj", "{C6F657CD-28A7-4E5E-8D4E-3E3B3B14A7F6}"
+	ProjectSection(ProjectDependencies) = postProject
+	EndProjectSection
+EndProject
 Global
 	GlobalSection(SolutionConfiguration) = preSolution
 		Debug = Debug
@@ -22,6 +26,10 @@ Global
 		{D0226BB5-3A02-4C91-893A-F36567AED5C5}.Debug.Build.0 = Debug|Win32
 		{D0226BB5-3A02-4C91-893A-F36567AED5C5}.Release.ActiveCfg = Release|Win32
 		{D0226BB5-3A02-4C91-893A-F36567AED5C5}.Release.Build.0 = Release|Win32
+		{C6F657CD-28A7-4E5E-8D4E-3E3B3B14A7F6}.Debug.ActiveCfg = Debug|Win32
+		{C6F657CD-28A7-4E5E-8D4E-3E3B3B14A7F6}.Debug.Build.0 = Debug|Win32
+		{C6F657CD-28A7-4E5E-8D4E-3E3B3B14A7F6}.Release.ActiveCfg = Release|Win32
+		{C6F657CD-28A7-4E5E-8D4E-3E3B3B14A7F6}.Release.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
 	EndGlobalSection

example/SampleDLL/SampleDLL.cpp

@@ -1,7 +1,19 @@
+#include <windows.h>
+#include <stdio.h>
+
 #include "SampleDLL.h"
 
 extern "C" {
 
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
+{
+	printf("DllMain called:\n");
+	printf("Instance: %x\n", (DWORD)hinstDLL);
+	printf("Reason:   %d\n", fdwReason);
+	printf("Reserved: %x\n", (DWORD)lpvReserved);
+	return 1;
+}
+
 SAMPLEDLL_API int addNumbers(int a, int b)
 {
 	return a + b;