| 82 | ); |
| 83 | |
| 84 | BOOL ReadRemoteProcessPEB(IN HANDLE hProcess, OUT PEB* peb) { |
| 85 | HMODULE hNtDll = LoadLibrary(TEXT("ntdll.dll")); |
| 86 | if (hNtDll == NULL || hNtDll == INVALID_HANDLE_VALUE) { |
| 87 | PRINT("LoadLibrary could not load ntdll\n"); |
| 88 | return FALSE; |
| 89 | } |
| 90 | NtQueryInformationProcess pNtQueryInformationProcess = (NtQueryInformationProcess)GetProcAddress(hNtDll, "NtQueryInformationProcess"); |
| 91 | PROCESS_BASIC_INFORMATION processInfo{ 0 }; |
| 92 | ULONG szInfo = 0; |
| 93 | |
| 94 | if (SUCCEEDED(pNtQueryInformationProcess(hProcess, ProcessBasicInformation, &processInfo, sizeof(PROCESS_BASIC_INFORMATION), &szInfo)) && szInfo == sizeof(PROCESS_BASIC_INFORMATION) && processInfo.PebBaseAddress) { |
| 95 | size_t szPEB = 0; |
| 96 | if (!ReadProcessMemory(hProcess, processInfo.PebBaseAddress, peb, sizeof(PEB), &szPEB) || szPEB < sizeof(PEB)) { |
| 97 | PRINT("Failed to read Browser PEB\n"); |
| 98 | return FALSE; |
| 99 | } |
| 100 | else { |
| 101 | return TRUE; |
| 102 | } |
| 103 | } |
| 104 | else { |
| 105 | PRINT("ProcessBasicInfomation failed\n"); |
| 106 | return FALSE; |
| 107 | } |
| 108 | return FALSE; |
| 109 | } |
| 110 | |
| 111 | BOOL ReadPEBProcessParameters(HANDLE hProcess, PEB* peb, WCHAR** args) { |
| 112 | UNICODE_STRING commandLine; |