;find base addr of kernel32.dll
mov ebx ,fs:[edx+0x3c] ;dkebx=address of peb
mov ecx [ebx+0x3c];ecx=point to loader data
mov ecx,[ecx+0x1c];exc=first entry in initialization order list
mov ecx,[ecx];ecx=second entry in list (kernel32.dll)
mov ebp,[ecx+0x08];ebp=base address of kerenel32.dll
整段代码是这样的 我是在mov ecx,[ecx];ecx=second entry in list (kernel32.dll)这里不理解 我知道mov 寄存器 [寄存器] 是把后面那个寄存器的值赋给前面那个寄存器的意思 非常感谢您的解答~
;find base addr of kernel32.dll
mov ebx ,fs:[edx+0x30]; ebx=address of peb
mov ecx [ebx+0x0c]; ecx=point to loader data
mov ecx,[ecx+0x1c]; exc=first entry in initialization order list
mov ecx,[ecx]; ecx=second entry in list (kernel32.dll)
mov ebp,[ecx+0x08]; ebp=base address of kerenel32.dll
有两个地方我不理解。0x1c和0x08是怎么算出来的?
mov ecx [ebx+0x0c]; ecx=point to loader data 之后我们得到*PPEB_LDR_DATA
8 BYTE + 3 * PVOID = 20 BYTE = 0x14 BYTE
为什么是mov ecx,[ecx+0x1c]; exc=first entry in initialization order list
而不是mov ecx, [ecx+0x14]
还有我用olldbg调试了一下,发现在我机器上windows 7,mov ecx,[ecx+0x1c]; exc=first entry in initialization order list后的第二个dll不是kernel32, 而是kernelba. 所以要两句
mov ecx,[ecx]; ecx=second entry in list (kernelba.dll)
mov ecx,[ecx]; ecx=second entry in list (kernel32.dll)