外部exe/dll或WTF的圖像基地址？

Question

我有一個外部進程（exe文件DllProj.exe正在運行），它有SampleDll.dll鏈接到它（隱式鏈接）。我可以在我的函數imageBase（）的幫助下找到鏈接的dll的基地址，但不是進程本身的基地址！有什麼區別，爲什麼它不能按原樣工作？

我的意思是，這個代碼返回PBASE與正確的DOS/NT-頭：

LPVOID pBase = imageBase("DllProj.exe", "SampleDll.dll"); 
if (!pBase) 
    return false; 
PIMAGE_DOS_HEADER pDosHeader = PIMAGE_DOS_HEADER((HMODULE)pBase); 
if (::IsBadReadPtr(pDosHeader, sizeof(IMAGE_DOS_HEADER)) || 
    IMAGE_DOS_SIGNATURE != pDosHeader->e_magic) 
    return false; 

但是這個代碼回報是FALSE：

LPVOID pBase = imageBase("DllProj.exe", "DllProj.exe"); 
//and so on... 

這裏是我的方法：

LPVOID imageBase(LPSTR szVictimProcess, LPSTR szVictim) 
{ 
    //находим процесс szVictimProcess 
    DWORD aProcesses[1024], cbNeeded, nProcesses; 
    unsigned int i; 

    if (!EnumProcesses(aProcesses, sizeof(aProcesses), &cbNeeded)) 
     return NULL; 
    nProcesses = cbNeeded/sizeof(DWORD); 

    HANDLE ProcHandle = 0; 
    TCHAR szProcessName[MAX_PATH] = TEXT("<unknown>"); 
    for (i = 0; i < nProcesses; i++) 
    { 
     ProcHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, aProcesses[i]); 

     if (NULL != ProcHandle) 
     { 
      HMODULE hMod[1024]; 
      if (EnumProcessModules(ProcHandle, hMod, sizeof(hMod), &cbNeeded)) 
      { 
       GetModuleBaseName(ProcHandle, hMod[0], szProcessName, sizeof(szProcessName)/sizeof(TCHAR)); // Get the process name 
       if (0 == lstrcmpiA(szVictimProcess, szProcessName)) 
       { 
        //находим модуль szVictim 
        DWORD nModules = cbNeeded/sizeof(HMODULE); 
        char szModName[MAX_PATH]; 
        for (unsigned int j = 0; j < nModules; j++) 
        { 
         if (GetModuleFileNameEx(ProcHandle, hMod[j], szModName, sizeof(szModName))) // Get the module name 
         { 
          shortName(szModName); 
          if (0 == lstrcmpiA(szModName, szVictim)) 
          { 
           MODULEINFO info; 
           GetModuleInformation(ProcHandle, hMod[j], &info, sizeof(info)); 
           return info.lpBaseOfDll; 

           //Equal To: 
           //return hMod[j]; 

           //Debug: 
           //LPSTR string = new char[256]; 
           //wsprintf(string,"\t%s (0x%08X)\n", szModName, hMod[j]); 
          } 
         } 
        } 
        break; 
       } 
      } 
     } 

     CloseHandle(ProcHandle); 
    } 

    return NULL; 
} 

PS：我的下一個目標是獲得DllProj.exe（其中Sample.dll是）的導入表以及hiijack dll的函數調用

Answer 1

怎麼樣使用這個：

#pragma comment(lib, "psapi") 

DWORD GetModuleBase(HANDLE hProc, string &sModuleName) 
{ 
    HMODULE *hModules; 
    char szBuf[50]; 
    DWORD cModules; 
    DWORD dwBase = -1; 
    //------ 

    EnumProcessModules(hProc, hModules, 0, &cModules); 
    hModules = new HMODULE[cModules/sizeof(HMODULE)]; 

    if(EnumProcessModules(hProc, hModules, cModules/sizeof(HMODULE), &cModules)) { 
     for(int i = 0; i < cModules/sizeof(HMODULE); i++) { 
     if(GetModuleBaseName(hProc, hModules[i], szBuf, sizeof(szBuf))) { 
      if(sModuleName.compare(szBuf) == 0) { 
       dwBase = (DWORD)hModules[i]; 
       break; 
      } 
     } 
     } 
    } 

    delete[] hModules; 

    return dwBase; 
} 

感謝answer here