I'm currently trying to retrieve the Image Base Address of a suspended 32-bits process.
I successfully retrieved the
PEB VA by using
(*CTX).Ebx - 0x1000 (where CTX is the CONTEXT structure retrieved with
GetThreadContext()), it's in correlation with the data I got from some process analysis tools.
The problem is that the field
ImageBaseAddress at offset 0x08 is equal to
I verified and all the other fields are okay, if for example I create the process in debug mode the
BeingDebugged byte is set to 1 etc...
And if I look with some tools where the Image of the PE is loaded I see that it's at
0x880000, unfortunately that data isn't present in the PEB.
So I basically tried to create a "normal" process that isn't suspended but I have the same problem.
All the fiels of the PEB are fine, the process too, there's just that 32-bits integer at offset 0x08 that is equal to
0xffffffff for some mysterious reasons.
(P.S.: I know that the PEB isn't documented and that it is not a great idea to depend of it as it's fields might change in the future but I really need to get the Image Base Address of a suspended process from it's PEB).
User contributions licensed under CC BY-SA 3.0