Exploring Process Environment Block
Exploring a couple of interesting members of the PEB memory structure fields
A very brief look into the PEB memory structure found, aiming to get a bit more comfortable with WinDBG and walking memory structures.
Basics
First of, checking what members the _PEB structure actually entails:
dt _pebThere are many fields in the structure among which there are ImageBaseAddresss and ProcessParameters which are interesting to us for this lab:
Getting the PEB address of the process:
The _PEB structure can now be overlaid on the memory pointed to by the $peb to see what values the structure members are holding/pointing to:
_PEB structure is now populated with the actual data pulled from the process memory:
Let's check what's in memory at address 0000000049d40000 - pointed to by the ImageBaseAddress member of the _peb structure:
Exactly! This is the actual binary image of the running process:
Another way of finding the ImageBaseAddress is:
Convenience
We can forget about all of the above and just use:
This gets us a nicely formatted PEB information of some of the key members of the structure:
Finding Commandline Arguments
One of the interesting fields the PEB holds is the process commandline arguments. Let's find them:
We can be more direct and ask the same question like so:
or even this:
Since we now know where the commandline arguments are stored - can we modify them? Of course.
Forging Commandline Arguments
_PEB_LDR_DATA
Getting a list of loaded modules (exe/dll) by the process:
If we check the loaded modules with !peb, it shows we were walking the list correctly:
Here is another way to find the first _LDR_DATA_TABLE_ENTRY:
A nice way of getting a list of linked-list structure addresses is by providing address of the first list_entry structure to the command dl and specifying how many list items it should print out:
Another way of achieving the same would be to use the !list command to list through the list items and dump the info:
Continuing further:
Abusing PEB
It is possible to abuse the PEB structure and masquerade one windows processes with another process. See this lab for more:
Masquerading Processes in Userland via _PEBReferences
Last updated