Skip to content

Instantly share code, notes, and snippets.

@BlackOfWorld
Created March 30, 2019 21:32
Show Gist options
  • Save BlackOfWorld/db84fbbc5c3135ae483139252f779d10 to your computer and use it in GitHub Desktop.
Save BlackOfWorld/db84fbbc5c3135ae483139252f779d10 to your computer and use it in GitHub Desktop.
C# Program that get's it's PEB (Process Environment Table).
public static class PebWalker
{
public static IntPtr GetPeb()
{
IntPtr handle = OpenProcess(0x1040, false, Process.GetCurrentProcess().Id);
if (handle == IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error());
int hr;
if (IntPtr.Size != 8)
{
IntPtr peb32 = new IntPtr();
hr = NtQueryInformationProcess(handle, 26, ref peb32, IntPtr.Size, IntPtr.Zero);
CloseHandle(handle);
if (hr != 0) throw new Win32Exception(hr);
return peb32;
}
PROCESS_BASIC_INFORMATION pbi = new PROCESS_BASIC_INFORMATION();
hr = NtQueryInformationProcess(handle, 0, ref pbi, 48, IntPtr.Zero);
CloseHandle(handle);
if (hr != 0) throw new Win32Exception(hr);
return pbi.PebBaseAddress;
}
[StructLayout(LayoutKind.Sequential)]
private struct PROCESS_BASIC_INFORMATION
{
private readonly IntPtr Reserved1;
public readonly IntPtr PebBaseAddress;
}
[DllImport("ntdll.dll", SetLastError = true)]
private static extern int NtQueryInformationProcess(IntPtr ProcessHandle, int ProcessInformationClass, ref PROCESS_BASIC_INFORMATION ProcessInformation, int ProcessInformationLength, IntPtr ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
private static extern int NtQueryInformationProcess(IntPtr ProcessHandle, int ProcessInformationClass, ref IntPtr ProcessInformation, int ProcessInformationLength, IntPtr ReturnLength);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hObject);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment