3

I am trying to learn actually how to get to the PEB inside of TEB. I have tried this with windbg but could not manage to dump the PEB with stuff like:

!peb

or 

dt nt!_PEB_LDR_DATA

And others. But, I could not manage to get the PEB dumped. So also my favorite debugger is still immunitydbg. So, I was trying to get to the information using immunitydbg CLI. But the nearest thing I have managed to get to PEB is dumping the TEB.

d fs:[0]

So, I there anyhow someway inside of immunity do get the contents of TEB/PEB? I also tried to use the Ollysdbg PE Dump plugin but that only gave me another exe file with different contents. And also i am not sure if the PE Plugin does the right thing for me.

Improve this question

2 Answers 2

Reset to default
3

Open the Memory Map window in OllyDbg/ImmunityDbg, scroll down to the bottom, and double click on the entry that contains Process Environment Block. This will open a dump of the PEB in OllyDbg/ImmunityDbg:

PEB

Improve this answer
4
  • i have tied that but i could not manage to find the Entry which contains "Process Environment Block" there is no such line when i open $application inside of OllyDbg/ImmunityDbg :\ . But i found some plugin called mona which also solves my problem. Being capable But doing this by hand would be much more awesome.
    – Dirk
    May 21, 2014 at 14:48
  • ImmunityDbg is terribly outdated. What version of OllyDbg did you test this on?
    – Jason Geffner
    May 21, 2014 at 16:50
  • The one i used at home was v1.10
    – Dirk
    May 21, 2014 at 16:56
  • OllyDbg v1.10 is 10 years old. Please try with OllyDbg v2.01 - ollydbg.de/version2.html
    – Jason Geffner
    May 21, 2014 at 19:25
3 
alt + f1 d fs:[30] ollydbg 1.10  raw peb

with stolly plugin for 1.10 select the first byte in dump->right click->sructure select _peb from drop down box for decoded peb .

al+g fs:[30] in ollydbg 2.01 fully decoded _peb in dump / disasm window
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.