admin/fancycode-MemoryModule
1
0
Fork 0
mirror of https://github.com/fancycode/MemoryModule synced 2026-06-06 15:44:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

started writing PEB compatible code

Browse Source
This commit is contained in:
Joachim Bauch
2005-02-01 23:09:49 +00:00
parent e952dd3cfa
commit 9399210d23
6 changed files with 353 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
example/DllLoader/DllLoader.cpp
+78 -3
View File
@@ -4,22 +4,92 @@
#include <stdio.h>
#include <malloc.h>
#include "../../ntinternals.h"
#include "../../MemoryModule.h"
typedef int (*addNumberProc)(int, int);
#define DLL_FILE "..\\..\\SampleDLL\\Debug\\SampleDLL.dll"
PPEB GetPEB(void)
{
// XXX: is there a better or even documented way to do this?
__asm {
// get PEB
mov eax, dword ptr fs:[30h]
}
}
void DumpPEB(void)
{
PPEB peb = GetPEB();
PPEB_LDR_DATA loaderData = peb->LoaderData;
PLDR_MODULE loaderModule;
printf("-------------------------------------\n");
printf("PEB at 0x%x\n", (DWORD)peb);
printf("Modules (Load Order)\n");
loaderModule = (PLDR_MODULE)(loaderData->InLoadOrderModuleList.Flink);
printf("Last: %x\n", (DWORD)loaderData->InLoadOrderModuleList.Blink);
while (1)
{
printf("Info: %x\n", (DWORD)loaderModule);
if (!IsBadReadPtr(loaderModule->BaseDllName.Buffer, loaderModule->BaseDllName.Length))
{
wprintf(L"Library: %s\n", loaderModule->BaseDllName.Buffer);
wprintf(L"Fullname: %s\n", loaderModule->FullDllName.Buffer);
} else
printf("Unknown module\n");
printf("Address: %x\n", (DWORD)loaderModule->BaseAddress);
printf("Load count: %d\n", loaderModule->LoadCount);
printf("Flags: %d\n", loaderModule->Flags);
printf("Size: %d\n", loaderModule->SizeOfImage);
printf("Entry: %x\n", (DWORD)loaderModule->EntryPoint);
printf("Hash: %x %x\n", (DWORD)loaderModule->HashTableEntry.Flink, (DWORD)loaderModule->HashTableEntry.Blink);
// advance to next module
loaderModule = (PLDR_MODULE)(loaderModule->InLoadOrderModuleList.Flink);
if (loaderModule == (PLDR_MODULE)(loaderData->InLoadOrderModuleList.Flink))
// we traversed through the complete list
// and didn't find the library
goto exit;
printf("\n");
}
exit:
printf("=====================================\n");
printf("\n");
}
static void
OutputLastError(const char *msg)
{
LPVOID tmp;
char *tmpmsg;
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&tmp, 0, NULL);
tmpmsg = (char *)malloc(strlen(msg) + strlen((const char *)tmp) + 3);
sprintf(tmpmsg, "%s: %s", msg, tmp);
OutputDebugString(tmpmsg);
free(tmpmsg);
LocalFree(tmp);
}
void LoadFromFile(void)
{
addNumberProc addNumber;
HINSTANCE handle = LoadLibrary(DLL_FILE);
HINSTANCE handle;
DumpPEB();
handle = LoadLibrary(DLL_FILE);
if (handle == INVALID_HANDLE_VALUE)
return;
DumpPEB();
addNumber = (addNumberProc)GetProcAddress(handle, "addNumbers");
printf("From file: %d\n", addNumber(1, 2));
FreeLibrary(handle);
DumpPEB();
}
void LoadFromMemory(void)
@@ -44,15 +114,20 @@ void LoadFromMemory(void)
fread(data, 1, size, fp);
fclose(fp);
module = MemoryLoadLibrary(data);
DumpPEB();
module = MemoryLoadLibrary(data, (unsigned char *)DLL_FILE);
if (module == NULL)
{
printf("Can't load library from memory.\n");
goto exit;
}
DumpPEB();
addNumber = (addNumberProc)MemoryGetProcAddress(module, "addNumbers");
printf("From memory: %d\n", addNumber(1, 2));
if (addNumber)
printf("From memory: %d\n", addNumber(1, 2));
else
printf("Not found\n");
MemoryFreeLibrary(module);
exit: