I am trying to implement basic process hollowing in a 32 bit process, in C.
#include <Windows.h>
#include <stdio.h>
#include <winternl.h>
int main(int argc, char* argv[])
{
STARTUPINFOW si = { 0 };
PROCESS_INFORMATION pi = { 0 };
// Create the process to be hollowed
BOOL processCreationSuccess =
CreateProcessW
(
L"C:\\Windows\\system32\\notepad.exe",
NULL,
NULL,
NULL,
FALSE,
CREATE_SUSPENDED,
NULL,
NULL,
&si,
&pi
);
if (!processCreationSuccess)
{
printf("Process creation failed with error: %d\n", GetLastError());
return 1;
}
printf("Process created at suspended state successfully\n");
PROCESS_BASIC_INFORMATION pbi;
UINT retLen = 0;
NTSTATUS pebGotten =
NtQueryInformationProcess
(
pi.hProcess,
ProcessBasicInformation,
&pbi,
sizeof(pbi),
retLen
);
if (pebGotten != 0)
{
printf("Problem with getting PEB structure (NtQueryInformationProcess, %d", GetLastError());
return 1;
}
printf("PEB is at address %p\n", pbi.PebBaseAddress);
BYTE imageBase[0x8];
UINT bytesRead = 0;
BOOL readSuccess = ReadProcessMemory
(
pi.hProcess,
pbi.PebBaseAddress + 0x10,
&imageBase,
0x8,
&bytesRead
);
if (!readSuccess)
{
printf("Problem with getting PEB address, %d", GetLastError());
return 1;
}
printf("Image base address: %p\n", imageBase);
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)imageBase;
if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
printf("Invalid DOS signature\n");
return 1;
}
PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)dosHeader + dosHeader->e_lfanew);
if (ntHeaders->Signature != IMAGE_NT_SIGNATURE) {
printf("Invalid NT signature\n");
return 1;
}
PIMAGE_OPTIONAL_HEADER optionalHeader = &ntHeaders->OptionalHeader;
if (optionalHeader->Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC) {
printf("Invalid optional header magic\n");
return 1;
}
DWORD entryPoint = optionalHeader->AddressOfEntryPoint;
printf("Entry point: %p", entryPoint);
return 0;
}
Here, I create the process in suspended mode, and use NtQueryInformationProcess to get the pointer to the process's PEB. Then, i go to the peb's base address + 0x10 (i also tried 0x8 because im on 32 bit. But every time, my program prints the "Invalid DOS signature" message, which i set up. This means that the image base is wrong. I also tried to debug it using IDA, and found out that pebBaseAddress points to somewhere weird...
I really don't know what to do, im struggling to find the issue.
Can someone help me with that?