windows


Access x64 TEB C++ & Assembly


In 32-bit assembly, I can access the ProcessEnvironmentBlock of the TEB structure. From there I access Ldr of the TEB structure.
This technique is described here: http://en.wikipedia.org/wiki/Win32_Thread_Information_Block
The code to do this in 32-bit assembly is:
void* ptr = NULL;
__asm
{
mov eax, FS:[0x18]
mov eax, [eax + 0x30] //Offset of PEB
mov eax, [eax + 0x0C] //Offset of LDR in PEB structure
mov eax, _ptr
};
std::cout<<ptr<<"\n";
The TEB structure can be seen here: http://msdn.moonsols.com/win7rtm_x64/TEB.html
and the PEB structure can be seen here: http://msdn.moonsols.com/win7rtm_x64/PEB.html
The above works for 32-bit code.
However, I want to also write code to work on x64 machines. I viewed the x64 version of the structures and wrote:
__asm
{
mov rax, GS:[0x30]
mov rax, [rax + 0x60]
mov rax, [rax + 0x18]
mov rax, _ptr
};
This can be done using Winnt.h NtCurrentTeb() but I want to use assembly.
However, it fails to work at all. Any ideas why?
Visual studio doesn't allow inline assembler for X64 C++. The __asm keyword isn't supported. You can write your assembler in a separate file and link it in or you can use intrinsics do what you need to do.
If you using visual studio, you can use Intrinsics!
[x86]
__readfsbyte
__readfsdword
__readfsqword
__readfsword
[x64]
__readgsbyte
__readgsdword
__readgsqword
__readgsword
Good luck~

Related Links

Theano Import Error-Windows 7-64b
Is Cmd Prompt the same as Ubuntu Terminal?
Git clone for Windows working with Direct Access
Command Prompt Search for files in a directory take the name of one random
Py2Exe: avoid windows to request permission to execute .exe file
Windows environment OpenACC
Is it possible to drag-and-drop files between File Explorer and Windows Store apps in Windows 10?
How To Change a Internal ip address to host name
Weird output with variables in FOR loops
How to install Haskell LDAP on Windows?
Assign expression value in windows script
using assist on Git Bash
How do I reduce the size of the app in windows phone 8.1 app?
Import-Module : The specified module 'msonline' was not loaded because no valid module file was found in any module directory
An unknown error occured. the program will be terminated
Get a substring from a Windows batch variable

Categories

HOME
webdriver
gpu
mjml
fftw
saml-2.0
jsf-2.2
telegram-bot
google-admin-sdk
webix
categorical-data
dynamic-sql
dreamweaver
fileserver
production
apache2.4
undertow
gulp-watch
postscript
easeljs
comparator
pic32
interbase
stackexchange
appirater
ms-access-2003
entity-relationship-model
handler
livelink
python-2.6
database-comparison
installshield-le
joomla2.5
getlasterror
reason
playframework-2.1
dm-script
nohup
protein-database
bc
comparison-operators
naming
contract
apache-spark-dataset
cnc
wcftestclient
fclose
identification
tf
insight
wpas
bootstrap-tags-input
restore
choice
grails-plugin
model-associations
cifilter
stream-processing
fink
opl
rewrite
nutiteq
snackbar
matlab-deployment
fits
delayed-execution
mruby
rmysql
fpdi
twitter-bootstrap-rails
syndicationfeed
gwt-openlayers
visual-studio-express
workitem
node-blade
wp7test
dopostback
curb
rmiregistry
apache-commons-dbutils
jqote
rowlex
scrollbars
blender-2.49
django-piston
application-planning
technical-debt

Resources

Encrypt Message



code
soft
python
ios
c
html
jquery
cloud
mobile