问题
this is my first post and I am stuck here. I am currently working on my project and I have a problem, I am getting the baseaddress of my own module and read the process memory to get the IMAGE_DOS_HEADER in runtime then I continue adding e_lanew from the IMAGE_DOS_HEADER struct on the BaseAddress to get the IMAGE_NT_HEADER. Finally, I check the NT Signature if it's valid, and it seems to be. So reading the PE of my own process worked I guess ... I am trying to read TimeDateStamp and this returns me 0 always and I don't know why.. here is my code
IMAGE_DOS_HEADER pDos = {0};
IMAGE_NT_HEADERS pNT = {0};
void *BaseAddress;
// create module snapshot
MODULEENTRY32 ME32;
HANDLE hModule = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, GetCurrentProcessId() );
ME32.dwSize = sizeof( ME32 );
if( Module32First( hModule, &ME32 ) )
{
// get base address of my module
BaseAddress = ME32.modBaseAddr;
}
CloseHandle(hModule);
// read BaseAddress and set the IMAGE_DOS_HEADER struct
if( !ReadProcessMemory( GetCurrentProcess(), BaseAddress, &pDos, sizeof( IMAGE_DOS_HEADER ), 0 ) )
return false;
// e_magic is correct here, I skipped this
// BaseAddress + e_lfanew points to the NT Header struct, I read it here
if( !ReadProcessMemory( GetCurrentProcess(), (void*)((unsigned long)BaseAddress + pDos.e_lfanew), &pNT, sizeof(PIMAGE_NT_HEADERS), 0) )
return false;
if( pNT.Signature == IMAGE_NT_SIGNATURE ) // this condition returns TRUE
{
printf("NT Header Signature is valid\n");
printf("Timestamp: %d\n", pNT.FileHeader.TimeDateStamp);
// TimeDateStamp returns me 0 - why ?
}
I am not sure If I forgot something - would be nice if someone could give me a hint
Thanks in advance
PS: I am sorry for the bad formatting, this is my first post :P
回答1:
There is a bug not sure how you missed it,
sizeof(PIMAGE_NT_HEADERS)
should be
sizeof(IMAGE_NT_HEADERS).
来源:https://stackoverflow.com/questions/35540446/get-current-nt-header-data-of-running-process-with-c-c