1

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos header by converting the handle of the DLL to the PIMAGE_DOS_HEADER and continue from there. How can I get the dos header by the dllbase address? I tried to convert the DLL base address to the PIMAGE_DOS_HEADER but in the debugger, I get an error of unable to read memory.

1

The DLL base address is the address of the IMAGE_DOS_HEADER struct. If you don't find 'MZ' at the DLL base address, you probably have the wrong address.

| improve this answer | |
  • I tried PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(inMemoryOrderModuleListItem.DllBase); the inMemoryOrderModuleListItem data type is LDR_DATA_TABLE_ENTRY. In the visual studio debugger is saying unable to read memory. – Gilad Di Castro Apr 15 at 19:02
0

I'm not quite sure what you're asking, but I'll take a stab at it either way. You can use the following apis: CreateFile, CreateFileMapping, and MapViewOfFile to be able to get what you're looking for. Something like this will work for you:

HANDLE hFile = CreateFile(dll, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
HANDLE hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
LPVOID lpFileBase = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
PIMAGE_DOS_HEADER DosHeader = static_cast<PIMAGE_DOS_HEADER>(lpFileBase);

There is no error checking in this code block so make sure to implement it, but lpFileBase will give you the base address of the dll you are looking for and then you can start parsing the DosHeader. Keep in mind you will only be able to read only. Change the flags if you need more than that.

Hope this helps!

| improve this answer | |
  • my question is how can I get the dos header from the dllbase address that I got in the PEB? – Gilad Di Castro Apr 15 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.