获取挂起进程的 lpbaseaddress

Question

您好，我有一个来源可以执行以下操作。

int[] context = new int[179];
context[0] = 65538; //context integer
GetThreadContext(PI.hThread, context); //from kernel32

ReadProcessMemory(PI.hProcess, context[41]+ 8, ref BaseAddress, 4, ref ReadWrite)

经过多次谷歌搜索，context[41] 指的是 EBX。知道为什么吗？ PInvokes.net 显示如下。

[StructLayout(LayoutKind.Sequential)]
public struct CONTEXT
{
     public uint ContextFlags; //set this to an appropriate value 
     // Retrieved by CONTEXT_DEBUG_REGISTERS 
     public uint Dr0;  
     public uint Dr1; 
     public uint Dr2; 
     public uint Dr3; 
     public uint Dr6; 
     public uint Dr7; 
     // Retrieved by CONTEXT_FLOATING_POINT 
     public FLOATING_SAVE_AREA FloatSave; 
     // Retrieved by CONTEXT_SEGMENTS 
     public uint SegGs; 
     public uint SegFs; 
     public uint SegEs; 
     public uint SegDs; 
     // Retrieved by CONTEXT_INTEGER 
     public uint Edi; 
     public uint Esi; 
     public uint Ebx; 
     public uint Edx; 
     public uint Ecx; 
     public uint Eax; 
     // Retrieved by CONTEXT_CONTROL 
     public uint Ebp; 
     public uint Eip; 
     public uint SegCs; 
     public uint EFlags; 
     public uint Esp; 
     public uint SegSs;
     // Retrieved by CONTEXT_EXTENDED_REGISTERS 
     [MarshalAs(UnmanagedType.ByValArray, SizeConst = 512)] 
     public byte[] ExtendedRegisters;
}

还有为什么我们必须 ebx+8 才能得到 lpbaseaddress？

Answer 1

CONTEXT 结构在 winnt.h 中定义。请注意，它根据处理器架构有不同的定义。使用此结构定义来访问 ebx 寄存器而不是特定的起始偏移量。 EBX寄存器在另一个进程的上下文中指向进程的PEB (Process Environment Block) where the Ldr pointer contains the base address. All of this is used for a technique called 'Dynamic Forking'到运行一个进程。例如用于恶意软件应用程序。

获取挂起进程的 lpbaseaddress

Get lpbaseaddress of a suspended process

winapi

portable-executable

kernel32