disavowed
December 30th, 2009, 22:52
EAX = 0x10
Code:
MOV EAX,DWORD PTR FS:[EAX+EAX*2]
EAX = FS:[0x10 + 0x10*2] = FS:[0x30]
From http://en.wikipedia.org/wiki/Win32_Thread_Information_Block:
Quote:
FS:[0x30] - Linear address of Process Environment Block (PEB)
|
In other words, EAX now points to the PEB.
Code:
MOV EAX,DWORD PTR DS:[EAX+C]
From http://msdn.microsoft.com/en-us/library/aa813706(VS.85).aspx:
Code:
typedef struct _PEB {
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[1];
PVOID Reserved3[2];
PPEB_LDR_DATA Ldr;
...
So EAX now points to PEB_LDR_DATA Ldr.
Code:
MOV EAX,DWORD PTR DS:[EAX+C]
From http://native-nt-toolkit.googlecode.com/svn/trunk/ndk/ldrtypes.h:
Code:
typedef struct _PEB_LDR_DATA
{
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
...
So EAX now points to the first LDR_DATA_TABLE_ENTRY in the InLoadOrderModuleList.
Code:
MOV DWORD PTR DS:[EAX+20],3000
From http://native-nt-toolkit.googlecode.com/svn/trunk/ndk/ldrtypes.h:
Code:
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
...
Each LIST_ENTRY is 8 bytes, so 0x20 in points to SizeOfImage, which is overwritten with 0x3000.
So to answer your question, yeah, there's no single good source for all the info, but you can piece it together with Wikipedia, MSDN, and the NDK
