Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Exploring Process Environment Block

Exploring a couple of interesting members of the PEB memory structure fields

A very brief look into the PEB memory structure found, aiming to get a bit more comfortable with WinDBG and walking memory structures.

Basics

First of, checking what members the _PEB structure actually entails:

dt _peb

There are many fields in the structure among which there are ImageBaseAddresss and ProcessParameters which are interesting to us for this lab:

Getting the PEB address of the process:

The _PEB structure can now be overlaid on the memory pointed to by the $peb to see what values the structure members are holding/pointing to:

_PEB structure is now populated with the actual data pulled from the process memory:

Let's check what's in memory at address 0000000049d40000 - pointed to by the ImageBaseAddress member of the _peb structure:

Exactly! This is the actual binary image of the running process:

Another way of finding the ImageBaseAddress is:

Convenience

We can forget about all of the above and just use:

This gets us a nicely formatted PEB information of some of the key members of the structure:

Finding Commandline Arguments

One of the interesting fields the PEB holds is the process commandline arguments. Let's find them:

We can be more direct and ask the same question like so:

or even this:

Since we now know where the commandline arguments are stored - can we modify them? Of course.

Forging Commandline Arguments

_PEB_LDR_DATA

Getting a list of loaded modules (exe/dll) by the process:

If we check the loaded modules with !peb, it shows we were walking the list correctly:

Here is another way to find the first _LDR_DATA_TABLE_ENTRY:

A nice way of getting a list of linked-list structure addresses is by providing address of the first list_entry structure to the command dl and specifying how many list items it should print out:

Another way of achieving the same would be to use the !list command to list through the list items and dump the info:

Continuing further:

Abusing PEB

It is possible to abuse the PEB structure and masquerade one windows processes with another process. See this lab for more:

Masquerading Processes in Userland via _PEB

References

https://docs.microsoft.com/en-us/windows/desktop/api/winternl/ns-winternl-_peb_ldr_datadocs.microsoft.com
Common WinDbg Commands (Thematically Grouped)windbg.info
LogoPEB LDR DATA - aldeidwww.aldeid.com
Logo!list (WinDbg) - Windows driversMicrosoftLearn
https://docs.microsoft.com/en-us/windows/desktop/api/winternl/ns-winternl-_peb_ldr_datadocs.microsoft.com
WinDbg : the !peb Commandjumpdollar.blogspot.com
Jump$jumpdollar.blogspot.com

PreviousInstrumenting Windows APIs with FridaNextWriting a Custom Bootloader

Last updated