MCPcopy Create free account
hub / github.com/SickleSec/GhostWolf / ReadRemoteProcessPEB

Function ReadRemoteProcessPEB

Ghostwolf/Process.cpp:84–109  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

82 );
83
84BOOL ReadRemoteProcessPEB(IN HANDLE hProcess, OUT PEB* peb) {
85 HMODULE hNtDll = LoadLibrary(TEXT("ntdll.dll"));
86 if (hNtDll == NULL || hNtDll == INVALID_HANDLE_VALUE) {
87 PRINT("LoadLibrary could not load ntdll\n");
88 return FALSE;
89 }
90 NtQueryInformationProcess pNtQueryInformationProcess = (NtQueryInformationProcess)GetProcAddress(hNtDll, "NtQueryInformationProcess");
91 PROCESS_BASIC_INFORMATION processInfo{ 0 };
92 ULONG szInfo = 0;
93
94 if (SUCCEEDED(pNtQueryInformationProcess(hProcess, ProcessBasicInformation, &processInfo, sizeof(PROCESS_BASIC_INFORMATION), &szInfo)) && szInfo == sizeof(PROCESS_BASIC_INFORMATION) && processInfo.PebBaseAddress) {
95 size_t szPEB = 0;
96 if (!ReadProcessMemory(hProcess, processInfo.PebBaseAddress, peb, sizeof(PEB), &szPEB) || szPEB < sizeof(PEB)) {
97 PRINT("Failed to read Browser PEB\n");
98 return FALSE;
99 }
100 else {
101 return TRUE;
102 }
103 }
104 else {
105 PRINT("ProcessBasicInfomation failed\n");
106 return FALSE;
107 }
108 return FALSE;
109}
110
111BOOL ReadPEBProcessParameters(HANDLE hProcess, PEB* peb, WCHAR** args) {
112 UNICODE_STRING commandLine;

Callers 1

FindProcessPIDFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected