FS寄存器获得kernel32.dll地址

 

From http://hi.baidu.com/raulsyp/blog/item/8fa5e1f98f3d2c1b09244d88.html

 

FS寄存器获得kernel32.dll地址

2010-08-18 21:16

FS寄存器指向当前活动线程的TEB结构（线程结构）
偏移  说明
000  指向SEH链指针
004  线程堆栈顶部
008  线程堆栈底部
00C  SubSystemTib
010  FiberData
014  ArbitraryUserPointer
018  TEB地址
020  进程PID
024  线程ID
02C  指向线程局部存储指针
030  PEB结构地址（进程结构）
034  上个错误号

注意：
1.fs:18h 地址指向线程环境块_TEB
可以使用windbg证明如下（将windbg附加到QQ进程中）：
0:016> dd fs:18h L1
0038:00000018  7ffda000
0:016> !teb
TEB at 7ffda000
2.fs:30h 地址指向进程环境块_PEB
同样可以使用windbg证明如下（将windbg附加到QQ进程中）：
Symbol ntdll!_TEB not found.
0:016> dd fs:30h L1
0038:00000030  7ffde000
0:016> !peb
PEB at 7ffde000
3.fs:00h获得SEH头指针
ShellCode可以利用SEH来实现。

4.得到KTHREAD结构体的指针
在内核模式下，FS指向的是KPCR结构，通过
mov reg， FS：[124h]
这样就能获得当前线程的指针。

得到kernel32.dll地址的方法：
mov eax,fs:30h        //得到PEB结构地址
mov eax,[eax+0ch]    //得到PEB_LDR_DATA结构地址
mov esi,[eax+1ch]    //InMemoryOrderModuleList
lodsd                //得到KERNEL32.DLL所在LDR_MODULE结构的InMemoryOrderModuleList地址
mov eax,[eax+08h]    //得到BaseAddress，既Kernel32.dll基址
mov hRet,eax
得到的结果如下：


PEB结构如下：
typedef struct _PEB {

BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;    //指向PEB_LDR_DATA结构
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  BYTE                          Reserved4[104];
  PVOID                         Reserved5[52];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved6[128];
  PVOID                         Reserved7[1];
  ULONG                         SessionId;
} PEB, *PPEB;

PEB_LDR_DATA结构如下：
typedef struct _PEB_LDR_DATA {

BYTE       Reserved1[8];
  PVOID      Reserved2[3];
  LIST_ENTRY InMemoryOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

InMemoryOrderModuleList：双向链表的头，包含进程的可加载模块。链表中的每一项包含指向LDR_DATA_TABLE_ENTRY结构的指针。

LDR_DATA_TABLE_ENTRY结构如下：
typedef struct _LDR_DATA_TABLE_ENTRY {
    PVOID Reserved1[2];
    LIST_ENTRY InMemoryOrderLinks;
    PVOID Reserved2[2];
    PVOID DllBase; //加载的DLL的基址
    PVOID EntryPoint;
    PVOID Reserved3;
    UNICODE_STRING FullDllName;
    BYTE Reserved4[8];
    PVOID Reserved5[3];
    union {
        ULONG CheckSum;
        PVOID Reserved6;
    };
    ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

在windbg下通过直接查看某个进程的PEB也可以看到kernel32.dll的基址：
!peb 7ffdf000
PEB at 7ffdf000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         01000000
    Ldr                       00191e90
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 00191f28 . 00193990
    Ldr.InLoadOrderModuleList:           00191ec0 . 00193980
    Ldr.InMemoryOrderModuleList:         00191ec8 . 00193988
            Base TimeStamp                     Module
         1000000 49a5f6a7 Feb 26 09:55:51 2009 D:\Program Files\Debugging Tools for Windows\windbg.exe
        7c920000 4c2b5b27 Jun 30 22:56:39 2010 C:\WINDOWS\system32\ntdll.dll
        7c800000 49c4f481 Mar 21 22:06:57 2009 C:\WINDOWS\system32\kernel32.dll
        77da0000 49900afa Feb 09 18:52:42 2009 C:\WINDOWS\system32\ADVAPI32.dll
        77e50000 49e5f493 Apr 15 22:52:03 2009 C:\WINDOWS\system32\RPCRT4.dll
        77fc0000 4a43384a Jun 25 16:41:46 2009 C:\WINDOWS\system32\Secur32.dll
        77ef0000 49007030 Oct 23 20:38:08 2008 C:\WINDOWS\system32\GDI32.dll
        77d10000 4802bdbd Apr 14 10:13:17 2008 C:\WINDOWS\system32\USER32.dll
        77be0000 4802be3f Apr 14 10:15:27 2008 C:\WINDOWS\system32\msvcrt.dll
         2000000 49a5f69f Feb 26 09:55:43 2009 D:\Program Files\Debugging Tools for Windows\dbgeng.dll
         3000000 49a5f692 Feb 26 09:55:30 2009 D:\Program Files\Debugging Tools for Windows\dbghelp.dll
        77bd0000 4802bdbf Apr 14 10:13:19 2008 C:\WINDOWS\system32\VERSION.dll
        76990000 4802bdbc Apr 14 10:13:16 2008 C:\WINDOWS\system32\ole32.dll
        7d590000 4c4e8159 Jul 27 14:48:57 2010 C:\WINDOWS\system32\SHELL32.dll
        77f40000 4b1e1b15 Dec 08 17:23:33 2009 C:\WINDOWS\system32\SHLWAPI.dll
        77180000 4802bd6c Apr 14 10:11:56 2008 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
        71a90000 4802bdbc Apr 14 10:13:16 2008 C:\WINDOWS\system32\MPR.dll
        76300000 4802bdb3 Apr 14 10:13:07 2008 C:\WINDOWS\system32\IMM32.DLL
        62c20000 4802bd9f Apr 14 10:12:47 2008 C:\WINDOWS\system32\LPK.DLL
        73fa0000 4802bdbf Apr 14 10:13:19 2008 C:\WINDOWS\system32\USP10.dll
        5adc0000 4802bdc0 Apr 14 10:13:20 2008 C:\WINDOWS\system32\uxtheme.dll
          8c0000 4c5316df Jul 31 02:15:59 2010 D:\Program Files\360\360Safe\safemon\safemon.dll
        770f0000 4802bdbd Apr 14 10:13:17 2008 C:\WINDOWS\system32\OLEAUT32.dll
        762f0000 4802be16 Apr 14 10:14:46 2008 C:\WINDOWS\system32\MSIMG32.dll
        75ff0000 4802be3e Apr 14 10:15:26 2008 C:\WINDOWS\system32\MSVCP60.dll
        3e410000 4c234cd6 Jun 24 20:17:26 2010 C:\WINDOWS\system32\WININET.dll
          950000 44a3ec46 Jun 29 23:05:42 2006 C:\WINDOWS\system32\Normaliz.dll
        3eab0000 4c234cdc Jun 24 20:17:32 2010 C:\WINDOWS\system32\iertutil.dll
        76bc0000 4802bdab Apr 14 10:12:59 2008 C:\WINDOWS\system32\PSAPI.DLL
        71a20000 4802be08 Apr 14 10:14:32 2008 C:\WINDOWS\system32\WS2_32.dll
        71a10000 4802be09 Apr 14 10:14:33 2008 C:\WINDOWS\system32\WS2HELP.dll
        74680000 4802bde3 Apr 14 10:13:55 2008 C:\WINDOWS\system32\MSCTF.dll
        49010000 4802bdff Apr 14 10:14:23 2008 C:\WINDOWS\system32\MSFTEDIT.DLL
        73640000 49a7726d Feb 27 12:56:13 2009 C:\WINDOWS\system32\msctfime.ime
         1400000 49a5f692 Feb 26 09:55:30 2009 D:\Program Files\Debugging Tools for Windows\winext\ext.dll
         1900000 49a5f68c Feb 26 09:55:24 2009 D:\Program Files\Debugging Tools for Windows\WINXP\exts.dll
         1140000 49a5f68c Feb 26 09:55:24 2009 D:\Program Files\Debugging Tools for Windows\winext\kext.dll
        10000000 49a5f670 Feb 26 09:54:56 2009 D:\Program Files\Debugging Tools for Windows\WINXP\kdexts.dll
         1d00000 49a5f6a6 Feb 26 09:55:50 2009 D:\Program Files\Debugging Tools for Windows\symsrv.dll
         2390000 4802454c Apr 14 01:39:24 2008 C:\WINDOWS\system32\xpsp2res.dll
    SubSystemData:     00000000
    ProcessHeap:       00090000
    ProcessParameters: 00020000
    WindowTitle:  'C:\Documents and Settings\All Users\「开始」菜单\程序\Debugging Tools for Windows (x86)\WinDbg.lnk'
    ImageFile:    'D:\Program Files\Debugging Tools for Windows\windbg.exe'
    CommandLine:  '"D:\Program Files\Debugging Tools for Windows\windbg.exe" '
    DllPath:      'D:\Program Files\Debugging Tools for Windows;C:\WINDOWS\system32;C:\WINDOWS\system;C:\WINDOWS;.;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Thunder Network\KanKan\Codecs;C:\Program Files\Microsoft SQL Server\90\Tools\binn\;d:\Program Files\MATLAB\R2008a\bin;d:\Program Files\MATLAB\R2008a\bin\win32;C:\Program Files\QuickTime\QTSystem\;d:\Program Files\StormII\Codec;d:\Program Files\StormII'
    Environment:  00010000
        =::=::\
        ALLUSERSPROFILE=C:\Documents and Settings\All Users
        APPDATA=C:\Documents and Settings\Administrator\Application Data
        CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
        CLIENTNAME=Console
        CommonProgramFiles=C:\Program Files\Common Files
        COMPUTERNAME=724-FC4FA9F2840
        ComSpec=C:\WINDOWS\system32\cmd.exe
        FP_NO_HOST_CHECK=NO
        HOMEDRIVE=C:
        HOMEPATH=\Documents and Settings\Administrator
        LOGONSERVER=\\724-FC4FA9F2840
        NUMBER_OF_PROCESSORS=2
        OS=Windows_NT
        Path=D:\Program Files\Debugging Tools for Windows\winext\arcade;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Thunder Network\KanKan\Codecs;C:\Program Files\Microsoft SQL Server\90\Tools\binn\;d:\Program Files\MATLAB\R2008a\bin;d:\Program Files\MATLAB\R2008a\bin\win32;C:\Program Files\QuickTime\QTSystem\;d:\Program Files\StormII\Codec;d:\Program Files\StormII
        PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
        PROCESSOR_ARCHITECTURE=x86
        PROCESSOR_IDENTIFIER=x86 Family 6 Model 23 Stepping 10, GenuineIntel
        PROCESSOR_LEVEL=6
        PROCESSOR_REVISION=170a
        ProgramFiles=C:\Program Files
        QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip
        SESSIONNAME=Console
        SystemDrive=C:
        SystemRoot=C:\WINDOWS
        TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
        TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
        USERDOMAIN=724-FC4FA9F2840
        USERNAME=Administrator
        USERPROFILE=C:\Documents and Settings\Administrator
        VS80COMNTOOLS=D:\Program Files\Microsoft Visual Studio 8\Common7\Tools\
        WINDBG_DIR=D:\Program Files\Debugging Tools for Windows
        windir=C:\WINDOWS

由此也可以验证上面得到的地址是对的。