PEB structure

kd> !strct _PEB
struct _PEB (sizeof=488)
+000 byte InheritedAddressSpace
+001 byte ReadImageFileExecOptions
+002 byte BeingDebugged
+003 byte SpareBool
+004 void *Mutant
+008 void *ImageBaseAddress
+00c struct _PEB_LDR_DATA *Ldr
+010 struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters
+014 void *SubSystemData
+018 void *ProcessHeap
+01c void *FastPebLock
+020 void *FastPebLockRoutine
+024 void *FastPebUnlockRoutine
+028 uint32 EnvironmentUpdateCount
+02c void *KernelCallbackTable
+030 uint32 SystemReserved[2]
+038 struct _PEB_FREE_BLOCK *FreeList
+03c uint32 TlsExpansionCounter
+040 void *TlsBitmap
+044 uint32 TlsBitmapBits[2]
+04c void *ReadOnlySharedMemoryBase
+050 void *ReadOnlySharedMemoryHeap
+054 void **ReadOnlyStaticServerData
+058 void *AnsiCodePageData
+05c void *OemCodePageData
+060 void *UnicodeCaseTableData
+064 uint32 NumberOfProcessors
+068 uint32 NtGlobalFlag
+070 union _LARGE_INTEGER CriticalSectionTimeout
+070 uint32 LowPart
+074 int32 HighPart
+070 struct __unnamed3 u
+070 uint32 LowPart
+074 int32 HighPart
+070 int64 QuadPart
+078 uint32 HeapSegmentReserve
+07c uint32 HeapSegmentCommit
+080 uint32 HeapDeCommitTotalFreeThreshold
+084 uint32 HeapDeCommitFreeBlockThreshold
+088 uint32 NumberOfHeaps
+08c uint32 MaximumNumberOfHeaps
+090 void **ProcessHeaps
+094 void *GdiSharedHandleTable
+098 void *ProcessStarterHelper
+09c uint32 GdiDCAttributeList
+0a0 void *LoaderLock
+0a4 uint32 OSMajorVersion
+0a8 uint32 OSMinorVersion
+0ac uint16 OSBuildNumber
+0ae uint16 OSCSDVersion
+0b0 uint32 OSPlatformId
+0b4 uint32 ImageSubsystem
+0b8 uint32 ImageSubsystemMajorVersion
+0bc uint32 ImageSubsystemMinorVersion
+0c0 uint32 ImageProcessAffinityMask
+0c4 uint32 GdiHandleBuffer[34]
+14c function *PostProcessInitRoutine
+150 void *TlsExpansionBitmap
+154 uint32 TlsExpansionBitmapBits[32]
+1d4 uint32 SessionId
+1d8 void *AppCompatInfo
+1dc struct _UNICODE_STRING CSDVersion
+1dc uint16 Length
+1de uint16 MaximumLength
+1e0 uint16 *Buffer





========kernel32.dll???================

1. fs레지스터 => teb 를 가르키고 있다.

2. teb+0x30 위치에 peb 구조체를 가르키는 offset이 위치해 있다.

3. peb+0x0c의 위치에 PEB_LDR_DATA 구조체를 가르키는 포인터가 있다.

4. PEB_LDR_DATA+0x1c에 InInitializationOnderModuleList에 있고,
그 곳의 1번째가 ntdll.dll 2번째가 kernel32.dll 주소이다. **

InInitializationOnderModuleList 구조체 정보

0x000 Flink : LIST_ENTRY
0x004 Blink : LIST_ENTRY
0x008 DllBase : Ptr32
0x00C EntryPoint : Ptr32
0x010 SizeOfImage : Uint4B
0x014 FullDllName : UNICODE_STRING
0x014 (0x000) Length : Uint2B
0x016 (0x002) MaximumLength : Uint2B
0x018 (0x004) Buffer : Ptr32
0x01C BaseDllName : UNICODE_STRING
0x01C (0x000) Length : Uint2B
0x01E (0x002) MaximumLength : Uint2B
0x020 (0x004) Buffer : Ptr32


============find function=====================

5. kernel32.dll base address + 0x3c

6. exports directory offset =kernel32.dll base address+PE header offset+120(0x78)

7. exports directory table=kernel32.dll base address+exports directory offset

8. name pointers table =exports directory table+32

9. name pointers table (함수 이름이나 hash사용)

10. exports directory table+36
ordinals table 함수의 주소를 가르킨다. ordinals table의 서수의 순서에 근거하여 함수의 주소를 찾아낸다.


============heap overflow 에서 peb 이용방법================

FastPebLockRoutine 이 함수를 덮어쓴다 (undocumented 오프셋 위치는 PEB + 0x20
메모리:0x7ffdf020 0x7ffdf024)

(정의)Address of fast-locking routine for PEB. Definition of routine is:

typedef void (*PPEBLOCKROUTINE)(

PVOID PebLock

);

Peb->FastPebLockRoutine =>&RtlEnterCriticalSection (0xC0000005) overwrite
잘못된 메모리참조

=====================================================================================
undocumented peb source code

#define LDRP_STATIC_LINK 0x00000002 // dll은 과정까지 정적 링크한다
#define LDRP_IMAGE_DLL 0x00000004
#define LDRP_LOAD_IN_PROGRESS 0x00001000 //모듈 로드
#define LDRP_UNLOAD_IN_PROGRESS 0x00002000 //모듈 언로드
#define LDRP_ENTRY_PROCESSED 0x00004000 //
#define LDRP_ENTRY_INSERTED 0x00008000
#define LDRP_CURRENT_LOAD 0x00010000
#define LDRP_FAILED_BUILTIN_LOAD 0x00020000
#define LDRP_DONT_CALL_FOR_THREAD 0x00040000
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000 // (DllMain)
#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000
#define LDRP_WX86_IGNORE_MACHINETYPE 0x00400000 // 사용한다! kdex2x86.strct _PEB_LDR_DATA

다음은 peb를 이용해 현재의 디렉토리 정보 얻을때 사용할 수 있는 peb에 속해있는 구조체------------
_RTL_USER_PROCESS_PARAMETERS (peb + 0x10)

typedef struct _RTL_USER_PROCESS_PARAMETERS
{
ULONG MaximumLength; // 00h
ULONG Length; // 04h
ULONG Flags; // 08h
ULONG DebugFlags; // 0Ch
PVOID ConsoleHandle; // 10h
ULONG ConsoleFlags; // 14h
HANDLE InputHandle; // 18h
HANDLE OutputHandle; // 1Ch
HANDLE ErrorHandle; // 20h
CURDIR CurrentDirectory; // 24h ********현재의 디렉토리 정보 ************
UNICODE_STRING DllPath; // 30h
UNICODE_STRING ImagePathName; // 38h
UNICODE_STRING CommandLine; // 40h
PWSTR Environment; // 48h
ULONG StartingX; // 4Ch
ULONG StartingY; // 50h
ULONG CountX; // 54h
ULONG CountY; // 58h
ULONG CountCharsX; // 5Ch
ULONG CountCharsY; // 60h
ULONG FillAttribute; // 64h
ULONG WindowFlags; // 68h
ULONG ShowWindowFlags; // 6Ch
UNICODE_STRING WindowTitle; // 70h
UNICODE_STRING DesktopInfo; // 78h
UNICODE_STRING ShellInfo; // 80h
UNICODE_STRING RuntimeInfo; // 88h
RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20]; // 90h
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

vxmag-ex)
mov eax, dword ptr fs:[30h] ; goto PEB
mov eax, dword ptr [eax+10h] ; goto RTL_USER_PROCESS_PARAMETERS
add eax, 24h ; goto CurrentDirectory
mov eax, dword ptr [eax+4] ; gimme unicode_buffer


typedef struct _PEB_LDR_DATA {

unsigned int Length ; // 0x00
int Initialized ; // 0x04
PVOID SsHandle ; // 0x08
LIST_ENTRY InLoadOrderModuleList ; // 0x0c
LIST_ENTRY InMemoryOrderModuleList ; // 0x14
LIST_ENTRY InInitializationOrderModuleList ;// 0x1c

} PEB_LDR_DATA, *PPEB_LDR_DATA ; // Windows 2000 SourceCode의 속에 LDR DATA TABLE ENTRY의 정의가 없다, 그러나 그것은 가장 중요한 구조이다.

typedef struct _LDR_DATA_TABLE_ENTRY // offset
{

LIST_ENTRY InLoadOrderLinks; // 0x00
LIST_ENTRY InMemoryOrderLinks; // 0x08
LIST_ENTRY InInitializationOrderLinks; // 0x10
ULONG DllBase; // 0x18
ULONG EntryPoint; // 0x1C
ULONG SizeOfImage; // 0x20
UNICODE_STRING FullDllName; // 0x24
UNICODE_STRING BaseDllName; // 0x2C
ULONG Flags; // 0x34
SHORT LoadCount; // 0x38
WORD Fill; // 0x3A
LIST_ENTRY HashLinks ; // 0x3C
ULONG TimeDateStamp; // 0x44
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; // 0x48 bytes


#define LDRP_HASH_TABLE_SIZE 32
#define LDRP_HASH_MASK (LDRP_HASH_TABLE_SIZE-1)
#define LDRP_COMPUTE_HASH_INDEX(ch) (((ch) - 'a') & LDRP_HASH_MASK) // 사용한다! kdex2x86.strct PEB

PEB2를 바꾼다
typedef struct _PEB2 { BYTE Reserved[12] ; PPEB_LDR_DATA Ldr ; // 0x0C
} PEB2, *PPEB2 ;

** PEB의 필드 debug **

kd> !strct _PEB

--------------------------------------------------

 

http://leony.egloos.com/369899