![]() |
|
|
|
#1
|
|||
|
|||
|
Try ntoskrnl.pdb.
|
|
#2
|
|||
|
|||
|
Thank volodya !
I have dumped the ntoskrnl.pdb, but I still do not find the PEB struct. Attached file is output of pdbdump on the ntoskrnl.pdb Regards |
|
#3
|
|||
|
|||
|
This is strange, my friend.
Dump from ntoskrnl.exe (Windows 2003): struct _PEB { // static data ------------------------------------ // non-static data -------------------------------- /*<thisrel this+0x0>*/ /*|0x1|*/ unsigned char InheritedAddressSpace; /*<thisrel this+0x1>*/ /*|0x1|*/ unsigned char ReadImageFileExecOptions; /*<thisrel this+0x2>*/ /*|0x1|*/ unsigned char BeingDebugged; /*<thisrel this+0x3>*/ /*|0x1|*/ unsigned char SpareBool; /*<thisrel this+0x4>*/ /*|0x4|*/ void* Mutant; /*<thisrel this+0x8>*/ /*|0x4|*/ void* ImageBaseAddress; /*<thisrel this+0xc>*/ /*|0x4|*/ struct _PEB_LDR_DATA* Ldr; /*<thisrel this+0x10>*/ /*|0x4|*/ struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters; /*<thisrel this+0x14>*/ /*|0x4|*/ void* SubSystemData; /*<thisrel this+0x18>*/ /*|0x4|*/ void* ProcessHeap; /*<thisrel this+0x1c>*/ /*|0x4|*/ struct _RTL_CRITICAL_SECTION* FastPebLock; /*<thisrel this+0x20>*/ /*|0x4|*/ void* SparePtr1; /*<thisrel this+0x24>*/ /*|0x4|*/ void* SparePtr2; /*<thisrel this+0x28>*/ /*|0x4|*/ unsigned long EnvironmentUpdateCount; /*<thisrel this+0x2c>*/ /*|0x4|*/ void* KernelCallbackTable; /*<thisrel this+0x30>*/ /*|0x4|*/ unsigned long SystemReserved[1]; /*<bitfield this+0x34>*/ /*|0x4|*/ unsigned long ExecuteOptions:0:2; /*<bitfield this+0x34>*/ /*|0x4|*/ unsigned long SpareBits:2:1e; /*<thisrel this+0x38>*/ /*|0x4|*/ struct _PEB_FREE_BLOCK* FreeList; /*<thisrel this+0x3c>*/ /*|0x4|*/ unsigned long TlsExpansionCounter; /*<thisrel this+0x40>*/ /*|0x4|*/ void* TlsBitmap; /*<thisrel this+0x44>*/ /*|0x8|*/ unsigned long TlsBitmapBits[2]; /*<thisrel this+0x4c>*/ /*|0x4|*/ void* ReadOnlySharedMemoryBase; /*<thisrel this+0x50>*/ /*|0x4|*/ void* ReadOnlySharedMemoryHeap; /*<thisrel this+0x54>*/ /*|0x4|*/ void** ReadOnlyStaticServerData; /*<thisrel this+0x58>*/ /*|0x4|*/ void* AnsiCodePageData; /*<thisrel this+0x5c>*/ /*|0x4|*/ void* OemCodePageData; /*<thisrel this+0x60>*/ /*|0x4|*/ void* UnicodeCaseTableData; /*<thisrel this+0x64>*/ /*|0x4|*/ unsigned long NumberOfProcessors; /*<thisrel this+0x68>*/ /*|0x4|*/ unsigned long NtGlobalFlag; /*<thisrel this+0x70>*/ /*|0x8|*/ union _LARGE_INTEGER CriticalSectionTimeout; /*<thisrel this+0x78>*/ /*|0x4|*/ unsigned long HeapSegmentReserve; /*<thisrel this+0x7c>*/ /*|0x4|*/ unsigned long HeapSegmentCommit; /*<thisrel this+0x80>*/ /*|0x4|*/ unsigned long HeapDeCommitTotalFreeThreshold; /*<thisrel this+0x84>*/ /*|0x4|*/ unsigned long HeapDeCommitFreeBlockThreshold; /*<thisrel this+0x88>*/ /*|0x4|*/ unsigned long NumberOfHeaps; /*<thisrel this+0x8c>*/ /*|0x4|*/ unsigned long MaximumNumberOfHeaps; /*<thisrel this+0x90>*/ /*|0x4|*/ void** ProcessHeaps; /*<thisrel this+0x94>*/ /*|0x4|*/ void* GdiSharedHandleTable; /*<thisrel this+0x98>*/ /*|0x4|*/ void* ProcessStarterHelper; /*<thisrel this+0x9c>*/ /*|0x4|*/ unsigned long GdiDCAttributeList; /*<thisrel this+0xa0>*/ /*|0x4|*/ struct _RTL_CRITICAL_SECTION* LoaderLock; /*<thisrel this+0xa4>*/ /*|0x4|*/ unsigned long OSMajorVersion; /*<thisrel this+0xa8>*/ /*|0x4|*/ unsigned long OSMinorVersion; /*<thisrel this+0xac>*/ /*|0x2|*/ unsigned short OSBuildNumber; /*<thisrel this+0xae>*/ /*|0x2|*/ unsigned short OSCSDVersion; /*<thisrel this+0xb0>*/ /*|0x4|*/ unsigned long OSPlatformId; /*<thisrel this+0xb4>*/ /*|0x4|*/ unsigned long ImageSubsystem; /*<thisrel this+0xb8>*/ /*|0x4|*/ unsigned long ImageSubsystemMajorVersion; /*<thisrel this+0xbc>*/ /*|0x4|*/ unsigned long ImageSubsystemMinorVersion; /*<thisrel this+0xc0>*/ /*|0x4|*/ unsigned long ImageProcessAffinityMask; /*<thisrel this+0xc4>*/ /*|0x88|*/ unsigned long GdiHandleBuffer[34]; /*<thisrel this+0x14c>*/ /*|0x4|*/ void (PostProcessInitRoutine*)(); /*<thisrel this+0x150>*/ /*|0x4|*/ void* TlsExpansionBitmap; /*<thisrel this+0x154>*/ /*|0x80|*/ unsigned long TlsExpansionBitmapBits[32]; /*<thisrel this+0x1d4>*/ /*|0x4|*/ unsigned long SessionId; /*<thisrel this+0x1d8>*/ /*|0x8|*/ union _ULARGE_INTEGER AppCompatFlags; /*<thisrel this+0x1e0>*/ /*|0x8|*/ union _ULARGE_INTEGER AppCompatFlagsUser; /*<thisrel this+0x1e8>*/ /*|0x4|*/ void* pShimData; /*<thisrel this+0x1ec>*/ /*|0x4|*/ void* AppCompatInfo; /*<thisrel this+0x1f0>*/ /*|0x8|*/ struct _UNICODE_STRING CSDVersion; /*<thisrel this+0x1f8>*/ /*|0x4|*/ struct _ACTIVATION_CONTEXT_DATA* ActivationContextData; /*<thisrel this+0x1fc>*/ /*|0x4|*/ struct _ASSEMBLY_STORAGE_MAP* ProcessAssemblyStorageMap; /*<thisrel this+0x200>*/ /*|0x4|*/ struct _ACTIVATION_CONTEXT_DATA* SystemDefaultActivationContextData; /*<thisrel this+0x204>*/ /*|0x4|*/ struct _ASSEMBLY_STORAGE_MAP* SystemAssemblyStorageMap; /*<thisrel this+0x208>*/ /*|0x4|*/ unsigned long MinimumStackCommit; /*<thisrel this+0x20c>*/ /*|0x4|*/ void** FlsCallback; /*<thisrel this+0x210>*/ /*|0x8|*/ struct _LIST_ENTRY FlsListHead; /*<thisrel this+0x218>*/ /*|0x4|*/ void* FlsBitmap; /*<thisrel this+0x21c>*/ /*|0x10|*/ unsigned long FlsBitmapBits[4]; /*<thisrel this+0x22c>*/ /*|0x4|*/ unsigned long FlsHighIndex; // base classes ----------------------------------- // friends ---------------------------------------- // static functions ------------------------------- // non-virtual functions -------------------------- // virtual functions ------------------------------ }; // <size 0x230> |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| How to Patch (IL Edit) of Assembles loaded from Resource | cracki | General Discussion | 18 | 01-14-2024 00:26 |
| Olly Crash when this simple app loaded... | kunam | General Discussion | 6 | 10-10-2023 21:00 |
| Working with multiple modules when reversing | maktm | General Discussion | 2 | 04-19-2015 06:46 |
| Runtime Error R6002 - Floating point not loaded | MrGneissGuy's | General Discussion | 1 | 09-14-2009 03:08 |
| Detection/Signature for Corba/Com/Dcom/Activex Modules | nulli | General Discussion | 2 | 11-27-2005 18:41 |