Finding AddressOfEntryPoint for a 64-bit process

Question

Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual codeEntry.

Both the application and the notepad.exe process is 64-bit.

What am I doing wrong?

Here is the commented code-snippet:

#include <iostream>
#include <windows.h>
#include <winternl.h>

#pragma comment(lib, "ntdll")

using namespace std;

int main() {    
    STARTUPINFOA si;
    si = {};
    PROCESS_INFORMATION pi = {};
    PROCESS_BASIC_INFORMATION pbi = {};
    DWORD returnLength = 0;
    CreateProcessA(0, (LPSTR)"c:\\windows\\system32\\notepad.exe", 0, 0, 0, CREATE_SUSPENDED, 0, 0, &si, &pi);

    // get target image PEB address and pointer to image base
    NtQueryInformationProcess(pi.hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), &returnLength);
    DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;

    // get target process image base address
    LPVOID imageBase = 0;
    ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &imageBase, 16, NULL);

    // read target process image headers
    BYTE headersBuffer[4096] = {};
    ReadProcessMemory(pi.hProcess, (LPCVOID)imageBase, headersBuffer, 4096, NULL);

    // get AddressOfEntryPoint
    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)headersBuffer;
    PIMAGE_NT_HEADERS64 ntHeader = (PIMAGE_NT_HEADERS64)((DWORD_PTR)headersBuffer + dosHeader->e_lfanew);
    LPVOID codeEntry = (LPVOID)(ntHeader->OptionalHeader.AddressOfEntryPoint + (DWORD_PTR)imageBase);

    // Do something with the AddressOfEntryPoint(print to console in this case)
    cout << codeEntry << endl;

    return 0;
}

Answer 1

Generally you are doing almost all correct, there are however two simple mistakes.

First and probably most important is here

DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;

The offset to ImageBaseAddress is not 10, it's 0x10 (16 in DEC). So you need to do it like this

DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 0x10;

Secondly, are you sure that sizeof LPVOID is 16? At least on my compiler it is 8, not 16, so you are mostly like overwriting data on the stack. That's why I propose this approach

ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &imageBase, sizeof(LPVOID), NULL);

instead of

ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &imageBase, 16, NULL);