Snippets/Malware Gallery/enumerate-local-process-modules-via-peb.pas at main · PhrozenIO/Snippets · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
uses
 System.SysUtils, Winapi.Windows, Generics.Collections;

// ...

type
  _LDR_DATA_TABLE_ENTRY = record
    InLoadOrderLinks            : TListEntry;
    InMemoryOrderLinks          : TListEntry;
    InInitializationOrderLinkes : TListEntry;

    DllBase                     : PVOID;
    EntryPoint                  : PVOID;
    SizeOfImage                 : ULONG;
    FullDllName                 : TUnicodeString;
    BaseDllName                 : TUnicodeString;
  end;
  TLdrDataTableEntry = _LDR_DATA_TABLE_ENTRY;
  PLdrDataTableEntry = ^TLdrDataTableEntry;

// ...

(* TModuleInformation *)

type
  TModuleInformation = class
  private
    FImagePath   : String;
    FBaseAddress : NativeUInt;
    FEntryPoint  : NativeUInt;
    FSizeOfImage : Cardinal;
  public
    {@C}
    constructor Create(const AImagePath : String; const ABaseAddress, AEntryPoint: NativeUInt; const ASizeOfImage : Cardinal);

    {@G}
    property ImagePath   : String     read FImagePath;
    property BaseAddress : NativeUInt read FBaseAddress;
    property EntryPoint  : NativeUInt read FEntryPoint;
    property SizeOfImage : Cardinal   read FSizeOfImage;
  end;

// ...

constructor TModuleInformation.Create(const AImagePath : String; const ABaseAddress, AEntryPoint: NativeUInt; const ASizeOfImage : Cardinal);
begin
  inherited Create();
  ///

  FImagePath   := AImagePath;
  FBaseAddress := ABaseAddress;
  FEntryPoint  := AEntryPoint;
  FSizeOfImage := ASizeOfImage;
end;

(* Local *)

function GetCurrentProcessPEB() : NativeUInt;
asm
  {$IFDEF WIN64}
    mov rax, gs:[$60];
    mov result, rax;
  {$ELSE}
    mov eax, fs:[$30];
    mov result, eax;
  {$ENDIF}
end;

function EnumerateCurrentProcessModules(var AList : TObjectList<TModuleInformation>) : Cardinal;
begin
  if not Assigned(AList) then
    AList := TObjectList<TModuleInformation>.Create(True)
  else begin
    AList.Clear();

    ///
    if not AList.OwnsObjects then
      AList.OwnsObjects := True;
  end;
  ///

  var pPEBLdrData := PPointer(GetCurrentProcessPEB() + {$IFDEF WIN64}$00000018{$ELSE}$0000000c{$ENDIF});
  var pFirstEntry := PListEntry(NativeUInt(pPEBLdrData^) + {$IFDEF WIN64}$00000010{$ELSE}$0000000c{$ENDIF});

  var pDataTableEntry := PLdrDataTableEntry(pFirstEntry^.Flink);

  repeat
    AList.Add(TModuleInformation.Create(
      string(pDataTableEntry^.FullDllName.Buffer),
      NativeUInt(pDataTableEntry^.DllBase),
      NativeUInt(pDataTableEntry^.EntryPoint),
      pDataTableEntry^.SizeOfImage
    ));

    ///
    pDataTableEntry := PLdrDataTableEntry(pDataTableEntry^.InLoadOrderLinks.Flink);
  until pFirstEntry = pDataTableEntry^.InLoadOrderLinks.Flink;

  ///
  result := AList.Count;
end;

// ...

begin
try
  var AList := TObjectList<TModuleInformation>.Create(True);
  try
    EnumerateCurrentProcessModules(AList);
    ///

    for var AModuleEntry in AList do
      WriteLn(Format('Base:[0x%p], EP:[0x%p], Size:[0x%p] -> %s', [
        Pointer(AModuleEntry.BaseAddress),
        Pointer(AModuleEntry.EntryPoint),
        Pointer(AModuleEntry.SizeOfImage),
        AModuleEntry.ImagePath
      ]));
  finally
    FreeAndNil(AList);
  end;

// ...