Process hollowing - problem with getting the PEB address, apparently

255 Views Asked by At

I am trying to implement basic process hollowing in a 32 bit process, in C.

#include <Windows.h>
#include <stdio.h>
#include <winternl.h>


int main(int argc, char* argv[])
{
    STARTUPINFOW si = { 0 };
    PROCESS_INFORMATION pi = { 0 };

    // Create the process to be hollowed
    BOOL processCreationSuccess =
        CreateProcessW
        (
            L"C:\\Windows\\system32\\notepad.exe",
            NULL,
            NULL, 
            NULL,
            FALSE,
            CREATE_SUSPENDED,
            NULL,
            NULL,
            &si,
            &pi
        );
       
    if (!processCreationSuccess)
    {
        printf("Process creation failed with error: %d\n", GetLastError());
        return 1;
    }
    
    printf("Process created at suspended state successfully\n");

    PROCESS_BASIC_INFORMATION pbi;
    UINT retLen = 0;
    NTSTATUS pebGotten = 
        NtQueryInformationProcess
        (
            pi.hProcess,
            ProcessBasicInformation,
            &pbi,
            sizeof(pbi),
            retLen
        );

    if (pebGotten != 0)
    {
        printf("Problem with getting PEB structure (NtQueryInformationProcess, %d", GetLastError());
        return 1;
    }

    printf("PEB is at address %p\n", pbi.PebBaseAddress);

    BYTE imageBase[0x8];
    UINT bytesRead = 0;

    BOOL readSuccess = ReadProcessMemory
    (
        pi.hProcess,
        pbi.PebBaseAddress + 0x10,
        &imageBase,
        0x8,
        &bytesRead
    );

    if (!readSuccess)
    {
        printf("Problem with getting PEB address, %d", GetLastError());
        return 1;
    }

    printf("Image base address: %p\n", imageBase);

    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)imageBase;
    if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
        printf("Invalid DOS signature\n");
        return 1;
    }

    PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)dosHeader + dosHeader->e_lfanew);
    if (ntHeaders->Signature != IMAGE_NT_SIGNATURE) {
        printf("Invalid NT signature\n");
        return 1;
    }

    PIMAGE_OPTIONAL_HEADER optionalHeader = &ntHeaders->OptionalHeader;
    if (optionalHeader->Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC) {
        printf("Invalid optional header magic\n");
        return 1;
    }

    DWORD entryPoint = optionalHeader->AddressOfEntryPoint;


    printf("Entry point: %p", entryPoint);
    
    
    return 0;
}

Here, I create the process in suspended mode, and use NtQueryInformationProcess to get the pointer to the process's PEB. Then, i go to the peb's base address + 0x10 (i also tried 0x8 because im on 32 bit. But every time, my program prints the "Invalid DOS signature" message, which i set up. This means that the image base is wrong. I also tried to debug it using IDA, and found out that pebBaseAddress points to somewhere weird...

I really don't know what to do, im struggling to find the issue.

Can someone help me with that?

0

There are 0 best solutions below