add walk peb x86 and x86-64

7etsuo · Aug 31, 2024 · cec3bfb · cec3bfb
1 parent c6743e4
commit cec3bfb
Showing 1 changed file with 75 additions and 0 deletions.
diff --git a/walk_peb.s b/walk_peb.s
@@ -0,0 +1,75 @@
+; █                         █                                                                                                                                                                                                                          
+;  █                       █                                                                                                                                                                                                                           
+;   █                     █                                                                                                                                                                                                                            
+;    █                   █                                                                                                                                                                                                                             
+;     █                 █                                                                                                                                                                                                                              
+;      █               █                                                                                                                                                                                                                               
+;       █ ▄▄▄▄▄▄▄▄▄▄  █                                                                                                                                                                                                                                
+;       ▄██▓▓▓▓▓▓▓▓▒██                                                                                                                                                                                                                                 
+;      ██▓▓▓▓▓▓▓▓▓▓▓▓▒█                                                                                                                                                                                                                                
+;     ██▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒█                                                                                                                                                                                                                               
+;  ▄▄▄█████▓▓█████▄▄▄█████▓  ██████  █    ██  ▒█████                                                                                                                                                                                                   
+;  ▓  ██▒ ▓▒▓█   ▀▓  ██▒ ▓▒▒██    ▒  ██  ▓██▒▒██▒  ██                                                                                                                                                                                                  
+;  ▒ ▓██░ ▒░▒███  ▒ ▓██░ ▒░░ ▓██▄   ▓██  ▒██░▒██░  ██                                                                                                                                                                                                  
+;  ░ ▓██▓ ░ ▒▓█  ▄░ ▓██▓ ░   ▒   ██▒▓▓█  ░██░▒██   ██                                                                                                                                                                                                  
+;    ▒██▒ ░ ░▒████▒ ▒██▒ ░ ▒██████▒▒▒▒█████▓ ░ ████▓▒░                                                                                                                                                                                                 
+;    ▒█░░▀▀▀░░▀▒░▀░▀▒▀░░▀▀▀▒▀▒▓▒▀▒▀░░▒▓▒▀▒▀▒▀░▀▒░▒░▒░                                                                                                                                                                                                  
+;    ██░ ████░█░██░███░████░█░▒██░█░░░▒░█░█░███░█▒█▒░                                                                                                                                                                                                  
+;    ░█  █     ░    ░  ┌───░──░──░┐  ░░░ ░ ░ ░ ░█░█                                                                                                                                                                                                    
+;        █     ░  ░    │Access PEB│    ░        █░█                                                                                                                                                                                                    
+;        █             └─────┬────┘             █                                                                                                                                                                                                      
+;        █            ┌──────▼─────┐            █                                                                                                                                                                                                      
+;        █            │Get PEB->Ldr│            █                                                                                                                                                                                                      
+;        █            └──────┬─────┘            █                                                                                                                                                                                                      
+;        █┌──────────────────▼─────────────────┐█                                                                                                                                                                                                      
+;        █│ Access Ldr->InMemoryOrderModuleList│█                                                                                                                                                                                                      
+;        █└──────────────────┬─────────────────┘█                                                                                                                                                                                                      
+;        █     ┌─────────────▼───────────┐      █                                                                                                                                                                                                      
+;        █     │Get LDR_DATA_TABLE_ENTRY │      █                                                                                                                                                                                                      
+;        █     └─────┬───────────────▲───┘      █                                                                                                                                                                                                      
+;        █           │               no         █                                                                                                                                                                                                      
+;        █ ┌─────────▼───────────────┴──────┐   █                                                                                                                                                                                                      
+;        █ │ Is BaseDllName "kernel32.dll" ?│   █                                                                                                                                                                                                      
+;        █ └─────────────────┬──────────────┘   █                                                                                                                                                                                                      
+;        █                  yes                 █                                                                                                                                                                                                      
+;        █           ┌───────▼───────┐          █                                                                                                                                                                                                      
+;        █           │Extract DllBase│          █                                                                                                                                                                                                      
+;        █           └───────────────┘          █                                                                                                                                                                                                      
+;        ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀                                                                                                                                                                                                      
+; x86                                                                                                                                                                                                                                                     
+mov   ebp, esp                    ; Set up stack frame                                                                                                                                                                                                    
+add   esp, 0xfffff9f0             ; Adjust stack to avoid NULL bytes                                                                                                                                                                                      
+
+find_kernel32:                                                                                                                                                                                                                                            
+xor   ecx, ecx                    ; ECX = 0                                                                                                                                                                                                               
+mov   esi, fs:[ecx+30h]           ; ESI = &(PEB) ([FS:0x30])                                                                                                                                                                                              
+mov   esi, [esi+0Ch]              ; ESI = PEB->Ldr                                                                                                                                                                                                        
+mov   esi, [esi+1Ch]              ; ESI = PEB->Ldr.InMemoryOrderModuleList                                                                                                                                                                                
+
+next_module:                                                                                                                                                                                                                                              
+mov   ebx, [esi+10h]              ; EBX = InMemoryOrderModuleList[X].BaseAddress                                                                                                                                                                          
+mov   edi, [esi+20h]              ; EDI = InMemoryOrderModuleList[X].BaseDllName.Buffer                                                                                                                                                                   
+mov   esi, [esi]                  ; ESI = InMemoryOrderModuleList[X].InMemoryOrderLinks.Flink                                                                                                                                                             
+
+ ; Check if 13th Unicode character is NULL (kernel32.dll)                                                                                                                                                                                                 
+cmp   word ptr [edi+12*2], 0      ; Check if 13th Unicode char is NULL (kernel32.dll)                                                                                                                                                                     
+jne   next_module                 ; If not NULL, continue to the next module                                                                                                                                                                              
+
+; x86-64                                                                                                                                                                                                                                                  
+mov   rbp, rsp                    ; Set up stack frame                                                                                                                                                                                                    
+add   rsp, 0xfffffffffffff9f0     ; Adjust stack to avoid NULL bytes                                                                                                                                                                                      
+
+find_kernel32:                                                                                                                                                                                                                                            
+xor   rcx, rcx                    ; RCX = 0                                                                                                                                                                                                               
+mov   rsi, gs:[rcx+60h]           ; RSI = &(PEB) ([GS:0x60])                                                                                                                                                                                              
+mov   rsi, [rsi+18h]              ; RSI = PEB->Ldr                                                                                                                                                                                                        
+mov   rsi, [rsi+10h]              ; RSI = PEB->Ldr.InMemoryOrderModuleList                                                                                                                                                                                
+
+next_module:                                                                                                                                                                                                                                              
+mov   rbx, [rsi+10h]              ; RBX = InMemoryOrderModuleList[X].BaseAddress                                                                                                                                                                          
+mov   rdi, [rsi+30h]              ; RDI = InMemoryOrderModuleList[X].BaseDllName.Buffer                                                                                                                                                                   
+mov   rsi, [rsi]                  ; RSI = InMemoryOrderModuleList[X].Flink                                                                                                                                                                                
+
+; Check if 13th Unicode character is NULL (kernel32.dll)                                                                                                                                                                                                  
+cmp   word ptr [rdi+12*2], 0      ; Check if the 13th Unicode char (index 12) is NULL                                                                                                                                                                     
+jne   next_module                 ; If not NULL, continue to the next module