Access DLL PE file by PEB dllbase address

Question

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos header by converting the handle of the DLL to the PIMAGE_DOS_HEADER and continue from there. How can I get the dos header by the dllbase address? I tried to convert the DLL base address to the PIMAGE_DOS_HEADER but in the debugger, I get an error of unable to read memory.

Answer 1

The DLL base address is the address of the IMAGE_DOS_HEADER struct. If you don't find 'MZ' at the DLL base address, you probably have the wrong address.

Answer 2

I'm not quite sure what you're asking, but I'll take a stab at it either way. You can use the following apis: CreateFile, CreateFileMapping, and MapViewOfFile to be able to get what you're looking for. Something like this will work for you:

HANDLE hFile = CreateFile(dll, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
HANDLE hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
LPVOID lpFileBase = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
PIMAGE_DOS_HEADER DosHeader = static_cast<PIMAGE_DOS_HEADER>(lpFileBase);

There is no error checking in this code block so make sure to implement it, but lpFileBase will give you the base address of the dll you are looking for and then you can start parsing the DosHeader. Keep in mind you will only be able to read only. Change the flags if you need more than that.

Hope this helps!