Get Current NT Header Data of running Process with C/C++

我是研究僧i 提交于 2020-01-04 07:47:05

问题


this is my first post and I am stuck here. I am currently working on my project and I have a problem, I am getting the baseaddress of my own module and read the process memory to get the IMAGE_DOS_HEADER in runtime then I continue adding e_lanew from the IMAGE_DOS_HEADER struct on the BaseAddress to get the IMAGE_NT_HEADER. Finally, I check the NT Signature if it's valid, and it seems to be. So reading the PE of my own process worked I guess ... I am trying to read TimeDateStamp and this returns me 0 always and I don't know why.. here is my code

IMAGE_DOS_HEADER pDos = {0};
IMAGE_NT_HEADERS pNT  = {0};    
void *BaseAddress;

// create module snapshot
MODULEENTRY32 ME32;
    HANDLE hModule  = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, GetCurrentProcessId() );
    ME32.dwSize = sizeof( ME32 );

    if( Module32First( hModule, &ME32 ) )
    {
        // get base address of my module
        BaseAddress = ME32.modBaseAddr;
    }

    CloseHandle(hModule);

// read BaseAddress and set the IMAGE_DOS_HEADER struct
if( !ReadProcessMemory( GetCurrentProcess(), BaseAddress, &pDos, sizeof( IMAGE_DOS_HEADER ), 0 ) )
        return false;

// e_magic is correct here, I skipped this

// BaseAddress + e_lfanew points to the NT Header struct, I read it here
    if( !ReadProcessMemory( GetCurrentProcess(), (void*)((unsigned long)BaseAddress + pDos.e_lfanew), &pNT, sizeof(PIMAGE_NT_HEADERS), 0) )
        return false;

    if( pNT.Signature == IMAGE_NT_SIGNATURE ) // this condition returns TRUE
    {
        printf("NT Header Signature is valid\n");
        printf("Timestamp: %d\n", pNT.FileHeader.TimeDateStamp); 
        // TimeDateStamp returns me 0 - why ?
    }

I am not sure If I forgot something - would be nice if someone could give me a hint

Thanks in advance

PS: I am sorry for the bad formatting, this is my first post :P


回答1:


There is a bug not sure how you missed it,

sizeof(PIMAGE_NT_HEADERS)

should be

sizeof(IMAGE_NT_HEADERS). 


来源:https://stackoverflow.com/questions/35540446/get-current-nt-header-data-of-running-process-with-c-c

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!