Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect PEB type for x64 #10

Closed
C0D3-M4513R opened this issue Apr 7, 2022 · 2 comments
Closed

Incorrect PEB type for x64 #10

C0D3-M4513R opened this issue Apr 7, 2022 · 2 comments

Comments

@C0D3-M4513R
Copy link

C0D3-M4513R commented Apr 7, 2022

According to https://docs.microsoft.com/en-us/windows/win32/api/Winternl/ns-winternl-peb the peb for 64bit applications differ, from that of 32-bit applications.
There are 2 peb descriptions on that page. One on the top, and one on the bottom.

This can actually be observed in cmd.exe.
With the current PEB structure I am reading 0 as the LDR address. After (copying and) inserting a dummy u32, to have padding, I read a potentially more correct LDR address.

EDIT: Sorry for the many title changes. I can't think straight rn. apparently.

@C0D3-M4513R C0D3-M4513R changed the title Incorrect PEB64 type Incorrect PEB type for x64 Apr 7, 2022
@C0D3-M4513R C0D3-M4513R changed the title Incorrect PEB type for x64 Incorrect PEB_LDR_DATA type for x64 Apr 7, 2022
@C0D3-M4513R C0D3-M4513R changed the title Incorrect PEB_LDR_DATA type for x64 Incorrect PEB type for x64 Apr 7, 2022
@C0D3-M4513R
Copy link
Author

C0D3-M4513R commented Apr 8, 2022

Mhmm. okay. It seems to make a difference if I create a cmd process from the process I read the peb, or if it gets created by something else.
If I create a cmd.exe and then try to read PEB, the ldr addr is always 0.
If the cmd is launched manually, and I try to read PEB, the ldr addr is set.

@C0D3-M4513R
Copy link
Author

Nvm. I am just reading the peb, before cmd had a chance to init it apparently. A 1ms wait seems to fix this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant