I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of loaded modules.

seg000:00000006 60                                      pusha
seg000:00000007 89 E5                                   mov     ebp, esp
seg000:00000009 31 D2                                   xor     edx, edx
seg000:0000000B 64 8B 52 30                             mov     edx, fs:[edx+30h] ; Accessing PEB
seg000:0000000F 8B 52 0C                                mov     edx, [edx+0Ch]  ; Access 0x0C PEB offset which is _PEB_LDR_DATA
seg000:00000012 8B 52 14                                mov     edx, [edx+14h]  ; Accesses _PEB_LDR_DATA->InMemoryOrderModuleList
seg000:00000015                         loc_15:                                 ; CODE XREF: sub_6+87j
seg000:00000015 8B 72 28                                mov     esi, [edx+28h]
seg000:00000018 0F B7 4A 26                             movzx   ecx, word ptr [edx+26h]
seg000:0000001C 31 FF                                   xor     edi, edi

I'm having some trouble understanding the instructions below. I understand that edx will point to _PEB_LDR_DATA->InMemoryOrderModuleList but why reference edx+28h and then a word of edx+26h? esi and ecx are overwritten in subsequent assembly instructions so I'm not sure what the point is of populating them here.

seg000:00000015 8B 72 28                                mov     esi, [edx+28h]
seg000:00000018 0F B7 4A 26                             movzx   ecx, word ptr [edx+26h]

1 Answer 1


In WinDbg:

0:000> dt ntdll!_TEB -y ProcessEnvironmentBlock->Ldr->InM
   +0x030 ProcessEnvironmentBlock           : 
      +0x00c Ldr                               : 
         +0x014 InMemoryOrderModuleList           : _LIST_ENTRY

the list entry->Flink is a pointer to _LDR_DATA_TABLE_ENTRY-> InMemoryOrderLinks

so if you take the Flink subtract -8 and display the structure you can see it is accessing BaseDllName->Buffer (unicode string buffer ) and it MaxCount

probably uses it for parsing copying a counted widechar

0:000> ?? (ntdll!_ldr_data_table_entry *) @@masm(@@c++(@$teb->ProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList.Flink)-8)
struct _LDR_DATA_TABLE_ENTRY * 0x002421b0
   +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x242240 - 0x771c788c ]
   +0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x242248 - 0x771c7894 ]
   +0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x018 DllBase          : 0x00ef0000 Void
   +0x01c EntryPoint       : 0x00f02d6c Void
   +0x020 SizeOfImage      : 0xc0000
   +0x024 FullDllName      : _UNICODE_STRING "C:\Windows\system32\calc.exe"
   +0x02c BaseDllName      : _UNICODE_STRING "calc.exe"
   +0x034 Flags            : 0x4000
   +0x038 LoadCount        : 0xffff
   +0x03a TlsIndex         : 0
   +0x03c HashLinks        : _LIST_ENTRY [ 0x243604 - 0x771ca6a8 ]
   +0x03c SectionPointer   : 0x00243604 Void
   +0x040 CheckSum         : 0x771ca6a8
   +0x044 TimeDateStamp    : 0x4ce7979d
   +0x044 LoadedImports    : 0x4ce7979d Void
   +0x048 EntryPointActivationContext : (null) 
   +0x04c PatchInformation : (null) 
   +0x050 ForwarderLinks   : _LIST_ENTRY [ 0x242200 - 0x242200 ]
   +0x058 ServiceTagLinks  : _LIST_ENTRY [ 0x242208 - 0x242208 ]
   +0x060 StaticLinks      : _LIST_ENTRY [ 0x2454c8 - 0x243d40 ]
   +0x068 ContextInformation : 0x77160594 Void
   +0x06c OriginalBase     : 0
   +0x070 LoadTime         : _LARGE_INTEGER 0x0
0:000> dx -r1 (*((ntdll!_UNICODE_STRING *)0x2421d4))
(*((ntdll!_UNICODE_STRING *)0x2421d4))                 : "C:\Windows\system32\calc.exe" [Type: _UNICODE_STRING]
    [<Raw View>]     [Type: _UNICODE_STRING]
0:000> dx -r1 -n (*((ntdll!_UNICODE_STRING *)0x2421d4))
(*((ntdll!_UNICODE_STRING *)0x2421d4))                 : "C:\Windows\system32\calc.exe" [Type: _UNICODE_STRING]
    [+0x000] Length           : 0x38 [Type: unsigned short]
    [+0x002] MaximumLength    : 0x3a [Type: unsigned short]
    [+0x004] Buffer           : 0x242052 : 0x43 [Type: unsigned short *]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.