3

Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual codeEntry.

Both the application and the notepad.exe process is 64-bit.

What am I doing wrong?

Here is the commented code-snippet:

#include <iostream>
#include <windows.h>
#include <winternl.h>

#pragma comment(lib, "ntdll")

using namespace std;

int main() {    
    STARTUPINFOA si;
    si = {};
    PROCESS_INFORMATION pi = {};
    PROCESS_BASIC_INFORMATION pbi = {};
    DWORD returnLength = 0;
    CreateProcessA(0, (LPSTR)"c:\\windows\\system32\\notepad.exe", 0, 0, 0, CREATE_SUSPENDED, 0, 0, &si, &pi);

    // get target image PEB address and pointer to image base
    NtQueryInformationProcess(pi.hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), &returnLength);
    DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;

    // get target process image base address
    LPVOID imageBase = 0;
    ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &imageBase, 16, NULL);

    // read target process image headers
    BYTE headersBuffer[4096] = {};
    ReadProcessMemory(pi.hProcess, (LPCVOID)imageBase, headersBuffer, 4096, NULL);

    // get AddressOfEntryPoint
    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)headersBuffer;
    PIMAGE_NT_HEADERS64 ntHeader = (PIMAGE_NT_HEADERS64)((DWORD_PTR)headersBuffer + dosHeader->e_lfanew);
    LPVOID codeEntry = (LPVOID)(ntHeader->OptionalHeader.AddressOfEntryPoint + (DWORD_PTR)imageBase);

    // Do something with the AddressOfEntryPoint(print to console in this case)
    cout << codeEntry << endl;

    return 0;
}
7

Generally you are doing almost all correct, there are however two simple mistakes.

First and probably most important is here

DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;

The offset to ImageBaseAddress is not 10, it's 0x10 (16 in DEC). So you need to do it like this

DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 0x10;

Secondly, are you sure that sizeof LPVOID is 16? At least on my compiler it is 8, not 16, so you are mostly like overwriting data on the stack. That's why I propose this approach

ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &imageBase, sizeof(LPVOID), NULL);

instead of

ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &imageBase, 16, NULL);
| improve this answer | |
  • Worked perfectly after making the changes you suggested. Such a silly error on my part. Anyhoo thank you so much for pointing it out mate! – upayansaha May 23 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.