Query the child process and find its image base address from its Process Environment Block (PEB) https://github.com/winlabs/gowin32/blob/0b6f3bef0b7501b26caaecab8d52b09813224373/wrappers/winternl.go#L37 http://bytepointer.com/resources/tebpeb32.htm https://www.nirsoft.net/kernel_struct/vista/PEB.htm
| 134 | // http://bytepointer.com/resources/tebpeb32.htm |
| 135 | // https://www.nirsoft.net/kernel_struct/vista/PEB.html |
| 136 | type PEB struct { |
| 137 | //reserved1 [2]byte // BYTE 0-1 |
| 138 | InheritedAddressSpace byte // BYTE 0 |
| 139 | ReadImageFileExecOptions byte // BYTE 1 |
| 140 | BeingDebugged byte // BYTE 2 |
| 141 | reserved2 [1]byte // BYTE 3 |
| 142 | // ImageUsesLargePages : 1; //0x0003:0 (WS03_SP1+) |
| 143 | // IsProtectedProcess : 1; //0x0003:1 (Vista+) |
| 144 | // IsLegacyProcess : 1; //0x0003:2 (Vista+) |
| 145 | // IsImageDynamicallyRelocated : 1; //0x0003:3 (Vista+) |
| 146 | // SkipPatchingUser32Forwarders : 1; //0x0003:4 (Vista_SP1+) |
| 147 | // IsPackagedProcess : 1; //0x0003:5 (Win8_BETA+) |
| 148 | // IsAppContainer : 1; //0x0003:6 (Win8_RTM+) |
| 149 | // SpareBit : 1; //0x0003:7 |
| 150 | //reserved3 [2]uintptr // PVOID BYTE 4-8 |
| 151 | Mutant uintptr // BYTE 4 |
| 152 | ImageBaseAddress uintptr // BYTE 8 |
| 153 | Ldr uintptr // PPEB_LDR_DATA |
| 154 | ProcessParameters uintptr // PRTL_USER_PROCESS_PARAMETERS |
| 155 | reserved4 [3]uintptr // PVOID |
| 156 | AtlThunkSListPtr uintptr // PVOID |
| 157 | reserved5 uintptr // PVOID |
| 158 | reserved6 uint32 // ULONG |
| 159 | reserved7 uintptr // PVOID |
| 160 | reserved8 uint32 // ULONG |
| 161 | AtlThunkSListPtr32 uint32 // ULONG |
| 162 | reserved9 [45]uintptr // PVOID |
| 163 | reserved10 [96]byte // BYTE |
| 164 | PostProcessInitRoutine uintptr // PPS_POST_PROCESS_INIT_ROUTINE |
| 165 | reserved11 [128]byte // BYTE |
| 166 | reserved12 [1]uintptr // PVOID |
| 167 | SessionId uint32 // ULONG |
| 168 | } |
| 169 | |
| 170 | // https://github.com/elastic/go-windows/blob/master/ntdll.go#L77 |
| 171 | type PROCESS_BASIC_INFORMATION struct { |
nothing calls this directly
no outgoing calls
no test coverage detected