-
-
[已解决]win2003的peb一直都是空吗？
-
发表于:
2011-4-22 13:03
3773
-
http://bbs.pediy.com/showthread.php?t=96427
根据以上文章来修改进程名，其中修改peb的部分
在Win2003的机器上，看到进程的peb是指向一个无效的地址？
lkd> dt _eprocess
nt!_EPROCESS
+0x000 Pcb : _KPROCESS
+0x078 ProcessLock : _EX_PUSH_LOCK
+0x080 CreateTime : _LARGE_INTEGER
+0x088 ExitTime : _LARGE_INTEGER
+0x090 RundownProtect : _EX_RUNDOWN_REF
+0x094 UniqueProcessId : Ptr32 Void
+0x098 ActiveProcessLinks : _LIST_ENTRY
+0x0a0 QuotaUsage : [3] Uint4B
+0x0ac QuotaPeak : [3] Uint4B
+0x0b8 CommitCharge : Uint4B
+0x0bc PeakVirtualSize : Uint4B
+0x0c0 VirtualSize : Uint4B
+0x0c4 SessionProcessLinks : _LIST_ENTRY
+0x0cc DebugPort : Ptr32 Void
+0x0d0 ExceptionPort : Ptr32 Void
+0x0d4 ObjectTable : Ptr32 _HANDLE_TABLE
+0x0d8 Token : _EX_FAST_REF
+0x0dc WorkingSetPage : Uint4B
+0x0e0 AddressCreationLock : _KGUARDED_MUTEX
+0x100 HyperSpaceLock : Uint4B
+0x104 ForkInProgress : Ptr32 _ETHREAD
+0x108 HardwareTrigger : Uint4B
+0x10c PhysicalVadRoot : Ptr32 _MM_AVL_TABLE
+0x110 CloneRoot : Ptr32 Void
+0x114 NumberOfPrivatePages : Uint4B
+0x118 NumberOfLockedPages : Uint4B
+0x11c Win32Process : Ptr32 Void
+0x120 Job : Ptr32 _EJOB
+0x124 SectionObject : Ptr32 Void
+0x128 SectionBaseAddress : Ptr32 Void
+0x12c QuotaBlock : Ptr32 _EPROCESS_QUOTA_BLOCK
+0x130 WorkingSetWatch : Ptr32 _PAGEFAULT_HISTORY
+0x134 Win32WindowStation : Ptr32 Void
+0x138 InheritedFromUniqueProcessId : Ptr32 Void
+0x13c LdtInformation : Ptr32 Void
+0x140 VadFreeHint : Ptr32 Void
+0x144 VdmObjects : Ptr32 Void
+0x148 DeviceMap : Ptr32 Void
+0x14c Spare0 : [3] Ptr32 Void
+0x158 PageDirectoryPte : _HARDWARE_PTE
+0x158 Filler : Uint8B
+0x160 Session : Ptr32 Void
+0x164 ImageFileName : [16] UChar
+0x174 JobLinks : _LIST_ENTRY
+0x17c LockedPagesList : Ptr32 Void
+0x180 ThreadListHead : _LIST_ENTRY
+0x188 SecurityPort : Ptr32 Void
+0x18c PaeTop : Ptr32 Void
+0x190 ActiveThreads : Uint4B
+0x194 GrantedAccess : Uint4B
+0x198 DefaultHardErrorProcessing : Uint4B
+0x19c LastThreadExitStatus : Int4B
+0x1a0 Peb : Ptr32 _PEB /////////////////////////////////////////////Peb
+0x1a4 PrefetchTrace : _EX_FAST_REF
+0x1a8 ReadOperationCount : _LARGE_INTEGER
+0x1b0 WriteOperationCount : _LARGE_INTEGER
+0x1b8 OtherOperationCount : _LARGE_INTEGER
+0x1c0 ReadTransferCount : _LARGE_INTEGER
+0x1c8 WriteTransferCount : _LARGE_INTEGER
+0x1d0 OtherTransferCount : _LARGE_INTEGER
+0x1d8 CommitChargeLimit : Uint4B
+0x1dc CommitChargePeak : Uint4B
+0x1e0 AweInfo : Ptr32 Void
+0x1e4 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x1e8 Vm : _MMSUPPORT
+0x230 MmProcessLinks : _LIST_ENTRY
+0x238 ModifiedPageCount : Uint4B
+0x23c JobStatus : Uint4B
+0x240 Flags : Uint4B
+0x240 CreateReported : Pos 0, 1 Bit
+0x240 NoDebugInherit : Pos 1, 1 Bit
+0x240 ProcessExiting : Pos 2, 1 Bit
+0x240 ProcessDelete : Pos 3, 1 Bit
+0x240 Wow64SplitPages : Pos 4, 1 Bit
+0x240 VmDeleted : Pos 5, 1 Bit
+0x240 OutswapEnabled : Pos 6, 1 Bit
+0x240 Outswapped : Pos 7, 1 Bit
+0x240 ForkFailed : Pos 8, 1 Bit
+0x240 Wow64VaSpace4Gb : Pos 9, 1 Bit
+0x240 AddressSpaceInitialized : Pos 10, 2 Bits
+0x240 SetTimerResolution : Pos 12, 1 Bit
+0x240 BreakOnTermination : Pos 13, 1 Bit
+0x240 SessionCreationUnderway : Pos 14, 1 Bit
+0x240 WriteWatch : Pos 15, 1 Bit
+0x240 ProcessInSession : Pos 16, 1 Bit
+0x240 OverrideAddressSpace : Pos 17, 1 Bit
+0x240 HasAddressSpace : Pos 18, 1 Bit
+0x240 LaunchPrefetched : Pos 19, 1 Bit
+0x240 InjectInpageErrors : Pos 20, 1 Bit
+0x240 VmTopDown : Pos 21, 1 Bit
+0x240 ImageNotifyDone : Pos 22, 1 Bit
+0x240 PdeUpdateNeeded : Pos 23, 1 Bit
+0x240 VdmAllowed : Pos 24, 1 Bit
+0x240 SmapAllowed : Pos 25, 1 Bit
+0x240 CreateFailed : Pos 26, 1 Bit
+0x240 DefaultIoPriority : Pos 27, 3 Bits
+0x240 Spare1 : Pos 30, 1 Bit
+0x240 Spare2 : Pos 31, 1 Bit
+0x244 ExitStatus : Int4B
+0x248 NextPageColor : Uint2B
+0x24a SubSystemMinorVersion : UChar
+0x24b SubSystemMajorVersion : UChar
+0x24a SubSystemVersion : Uint2B
+0x24c PriorityClass : UChar
+0x250 VadRoot : _MM_AVL_TABLE
+0x270 Cookie : Uint4B
//88786648=某进程eprocess
lkd> dd 88786648+1a0
887867e8 7ffd6000 00000000 0000001b 00000000
887867f8 00000016 00000000 000001b9 00000000
88786808 00003f1c 00000000 000009f8 00000000
88786818 00002ab0 00000000 00000000 000002a5
88786828 00000000 883b4700 883b16f0 887918d8
88786838 26819760 01cc00a6 00000000 0000058a
88786848 00000506 0000058a 00000032 00000159
88786858 c0881000 00000000 00000000 00000000
lkd> dd 7ffd6000
7ffd6000 ???????? ???????? ???????? ????????
7ffd6010 ???????? ???????? ???????? ????????
7ffd6020 ???????? ???????? ???????? ????????
7ffd6030 ???????? ???????? ???????? ????????
7ffd6040 ???????? ???????? ???????? ????????
7ffd6050 ???????? ???????? ???????? ????????
7ffd6060 ???????? ???????? ???????? ????????
7ffd6070 ???????? ???????? ???????? ????????
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
