He conseguido que me funcione en x32 con esto:
Código PHP:
DWORD GetBaseAddressFromProcessHandle(HANDLE process_handle)
{
PROCESS_BASIC_INFORMATION pbi = {};
ULONG ulSize;
DWORD dwReturn=0;
SIZE_T nRead;
LONG (WINAPI *NtQueryInformationProcess)(HANDLE ProcessHandle,
ULONG ProcessInformationClass, PVOID ProcessInformation,
ULONG ProcessInformationLength, PULONG ReturnLength);
*(FARPROC *) &NtQueryInformationProcess = GetProcAddress(
LoadLibrary(L"ntdll"), "NtQueryInformationProcess");
if (NtQueryInformationProcess == NULL) {
return 0;
}
if( NtQueryInformationProcess != NULL &&
NtQueryInformationProcess(process_handle, 0, &pbi, sizeof(pbi), &ulSize) >= 0 &&
ulSize == sizeof(pbi)) {
ReadProcessMemory(process_handle, ((PVOID)((DWORD)pbi.PebBaseAddress + 0x8)), &dwReturn, sizeof(dwReturn), &nRead);
return dwReturn;
}
return 0;
}
El caso que cogiendo el mismo codigo y usandolo para x64 con los minimos cambios no me funciona en x64:
Código PHP:
DWORD64 GetBaseAddressFromProcessHandle(HANDLE process_handle)
{
PROCESS_BASIC_INFORMATION pbi = {};
ULONG ulSize;
DWORD64 dwReturn=0;
SIZE_T nRead;
LONG (WINAPI *NtQueryInformationProcess)(HANDLE ProcessHandle,
ULONG ProcessInformationClass, PVOID ProcessInformation,
ULONG ProcessInformationLength, PULONG ReturnLength);
*(FARPROC *) &NtQueryInformationProcess = GetProcAddress(
LoadLibrary(L"ntdll"), "NtQueryInformationProcess");
if (NtQueryInformationProcess == NULL) {
return 0;
}
if( NtQueryInformationProcess != NULL &&
NtQueryInformationProcess(process_handle, 0, &pbi, sizeof(pbi), &ulSize) >= 0 &&
ulSize == sizeof(pbi)) {
ReadProcessMemory(process_handle, ((PVOID)(pbi.PebBaseAddress + 0x10)), &dwReturn, sizeof(dwReturn), &nRead);
return dwReturn;
}
return 0;
}
Todo parece ir bien pero el valor que obtiene en dwReturn es 0.
¿Alguien me puede ayudar con esto?