admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Get PEB of other process without injection

Browse Source
This commit is contained in:
Clement Rouault
2015-12-11 09:53:13 +01:00
parent 419e65324f
commit 46d0a45e17
9 changed files with 880 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pe_parse.py
+3 -3
View File
@@ -225,10 +225,10 @@ def PEFile(baseaddr, target=None):
else:
import_by_name = create_structure_at(IMPORT_BY_NAME, baseaddr + int_entry.AddressOfData)
name_address = baseaddr + int_entry.AddressOfData + type(import_by_name).Name.offset
if proc_bitness == 32 and targetedbitness == 64:
name = rctypes.Remote_c_char_p64(name_address, target=target).value
else:
if target is None:
name = ctypes.c_char_p(name_address).value
else:
name = create_structure_at(ctypes.c_char_p, name_address).value.decode()
res.append((import_by_name.Hint, name))
int_addr += ctypes.sizeof(type(int_entry))
int_entry = create_structure_at(THUNK_DATA, int_addr)