1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
#include <windows.h>
#include <iostream>
#include <psapi.h>
#include <string>
using namespace std;
#ifdef _UNICODE
#define _tcout std::wcout
#define _tstring std::wstring
#else
#define _tcout std::cout
#define _tstring std::string
#endif
PVOID FindProcessBaseAddress(HANDLE hProcess);
int _tmain(int argc, _TCHAR* argv[])
{
// various structs init
STARTUPINFO startupInfo = {0};
PROCESS_INFORMATION processInformation = {0};
MEMORY_BASIC_INFORMATION meminfo = {0};
// Initialize the STARTUPINFO structure
memset(&startupInfo, 0, sizeof(startupInfo));
startupInfo.cb = sizeof(startupInfo);
// Create the desired process
if(
CreateProcess(_T("C:\\windows\\system32\\calc.exe"),
NULL,
NULL,
NULL,
TRUE,
0,
NULL,
NULL,
&startupInfo,
&processInformation) == 0 )
{
cout << "Unable to create the FT process : " << GetLastError() << endl;
return -1;
}
// Display the process Id
cout << "Process Id : " << processInformation.dwProcessId << endl;
// if it's too quick, our process can't read remote process modules info, so wait a little bit.
Sleep(1000);
// get exe base address (and print some info)
PVOID exeBaseAddress = FindProcessBaseAddress(processInformation.hProcess);
// get page info at exe base address
VirtualQueryEx(processInformation.hProcess, exeBaseAddress, &meminfo, sizeof(MEMORY_BASIC_INFORMATION));
// alloc some room for bytes to read
PVOID pMembytes = VirtualAlloc(NULL, meminfo.RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
//read proc memory at base address
DWORD nobr = 0;
ReadProcessMemory(processInformation.hProcess, exeBaseAddress, pMembytes, meminfo.RegionSize, &nobr);
//release buffer
VirtualFree(pMembytes, 0, MEM_RELEASE);
return 0;
}
PVOID FindProcessBaseAddress(HANDLE hProcess)
{
DWORD cbNeeded = 0;
SIZE_T Number_of_HMODS = 1024 * sizeof(HMODULE);//array can hold 1024 HMODULES
MODULEINFO ModuleInfo = {0};
PVOID exeBase = NULL;
_tstring exeExtension = _T(".exe");
//allocate array for all HMODULEs in the process
HMODULE * pModules = (HMODULE *) VirtualAlloc(NULL, Number_of_HMODS, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
std::wstring module_name(MAX_PATH * sizeof(TCHAR), '\0');
// enum all process modules (.exe + .dll)
if( EnumProcessModulesEx(hProcess, pModules, Number_of_HMODS, &cbNeeded, LIST_MODULES_ALL))
{
for (unsigned int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
{
// get info about module
GetModuleInformation(hProcess, pModules[i], &ModuleInfo, sizeof(MODULEINFO));
// get its name
GetModuleFileNameEx(hProcess, pModules[i], &module_name.at(0), MAX_PATH * sizeof(TCHAR));
// print info and name
_tcout << _T("[+] Found module: ") << module_name.c_str() << endl;
_tcout << _T("\tModule base: 0x") << hex << ModuleInfo.lpBaseOfDll << endl;
//just check if it ends with ".exe" (there's only one '*.exe' by process!)
int pos = module_name.find(exeExtension);
if(pos != _tstring::npos)
{
// found executable base address!
exeBase = ModuleInfo.lpBaseOfDll;
}
}
}
//free buffer
VirtualFree(pModules, 0, MEM_RELEASE);
return exeBase;
} |
