Add Comment

Add Comment

GetKernel32Addressx64/GetKernel32Addressx64/GetKernel32Addressx64.cpp

@@ -20,29 +20,40 @@ extern "C" PVOID64 _cdecl GetPeb();
 
 
 typedef struct _UNICODE_STRING {
-	USHORT Length;
-	USHORT MaximumLength;
-	PWSTR  Buffer;
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
 }UNICODE_STRING, *PUNICODE_STRING;
+
 int _tmain(int argc, TCHAR* argv[], TCHAR* envp[])
 {
-	PVOID64 Peb = GetPeb();
-	PVOID64 LDR_DATA_Addr = *(PVOID64**)((BYTE*)Peb+0x018);
-	UNICODE_STRING* FullName; 
-	HMODULE hKernel32 = NULL;
-	LIST_ENTRY* pNode = NULL;
-	pNode =(LIST_ENTRY*)(*(PVOID64**)((BYTE*)LDR_DATA_Addr+0x30));
-	while(true)
-	{
-		FullName = (UNICODE_STRING*)((BYTE*)pNode+0x38);
-		if(*(FullName->Buffer+12)=='\0')
-		{
-			hKernel32 = (HMODULE)(*((ULONG64*)((BYTE*)pNode+0x10)));
-			break;
-		}
-		pNode = pNode->Flink;
-	}
-	printf("%S : %p",FullName->Buffer,hKernel32);
-	
-	return 0;
+    PVOID64 Peb = NULL;
+    PVOID64 LDR_DATA_Addr = NULL;
+    UNICODE_STRING* FullName; 
+    HMODULE hKernel32 = NULL;
+    LIST_ENTRY* pNode = NULL;
+
+    // For win7 x64 TEST
+    Peb = GetPeb();
+    if(Peb == NULL)
+        return 0;
+
+    LDR_DATA_Addr = *(PVOID64**)((BYTE*)Peb+0x018);
+    if(LDR_DATA_Addr == NULL)
+        return 0;
+
+    pNode =(LIST_ENTRY*)(*(PVOID64**)((BYTE*)LDR_DATA_Addr+0x30));
+    while(true)
+    {
+        FullName = (UNICODE_STRING*)((BYTE*)pNode+0x38);
+        if(*(FullName->Buffer + 12) == '\0')
+        {
+            hKernel32 = (HMODULE)(*((ULONG64*)((BYTE*)pNode+0x10)));
+            break;
+        }
+        pNode = pNode->Flink;
+    }
+    printf("%S : %p",FullName->Buffer,hKernel32);
+    
+    return 0;
 }

GetKernel32Addressx64/GetKernel32Addressx64/GetKernel32Addressx64.vcxproj.user

@@ -1,3 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-</Project>

GetKernel32Addressx64/GetKernel32Addressx64/ReadMe.txt

@@ -1 +0,0 @@
-

GetKernel32Addressx64/GetKernel32Addressx64/Resource.h

@@ -3,15 +3,15 @@
 // Used by GetKernel32Addressx64.rc
 //
 
-#define IDS_APP_TITLE			103
+#define IDS_APP_TITLE            103
 
 // 新对象的下一组默认值
 //
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE	101
-#define _APS_NEXT_COMMAND_VALUE		40001
-#define _APS_NEXT_CONTROL_VALUE		1000
-#define _APS_NEXT_SYMED_VALUE		101
+#define _APS_NEXT_RESOURCE_VALUE    101
+#define _APS_NEXT_COMMAND_VALUE        40001
+#define _APS_NEXT_CONTROL_VALUE        1000
+#define _APS_NEXT_SYMED_VALUE        101
 #endif
 #endif

GetKernel32Addressx64/ReadMe.txt

@@ -11,3 +11,4 @@ in x86
 ntdll->kernel32
 
 the offset in the PEB is different from x64 and x86
+This demo is only Test on Win7 x64