From a0419eec11fd3657e3ffad79facd6b01c3d87918 Mon Sep 17 00:00:00 2001 From: Kawe Mazidjatari <48657826+Mauler125@users.noreply.github.com> Date: Sun, 2 Jul 2023 22:02:31 +0200 Subject: [PATCH] Add method for obtaining PEB Inline method for obtaining process environment block. --- r5dev/loader/loader.cpp | 2 +- r5dev/public/tier0/module.h | 4 ++++ r5dev/tier0/memstd.cpp | 5 +---- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/r5dev/loader/loader.cpp b/r5dev/loader/loader.cpp index 0f6a0ead..cabbf008 100644 --- a/r5dev/loader/loader.cpp +++ b/r5dev/loader/loader.cpp @@ -112,7 +112,7 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved) { case DLL_PROCESS_ATTACH: { - s_ProcessEnvironmentBlock = (PEB64*)__readgsqword(0x60); + s_ProcessEnvironmentBlock = CModule::GetProcessEnvironmentBlock(); s_DosHeader = (IMAGE_DOS_HEADER*)s_ProcessEnvironmentBlock->ImageBaseAddress; s_NtHeaders = (IMAGE_NT_HEADERS64*)((uintptr_t)s_DosHeader + (uintptr_t)s_DosHeader->e_lfanew); diff --git a/r5dev/public/tier0/module.h b/r5dev/public/tier0/module.h index a4b65f06..084b1e9f 100644 --- a/r5dev/public/tier0/module.h +++ b/r5dev/public/tier0/module.h @@ -58,6 +58,10 @@ public: inline static IMAGE_NT_HEADERS64* GetNTHeaders(QWORD pModuleBase) { return reinterpret_cast(pModuleBase + GetDOSHeader(pModuleBase)->e_lfanew); } + // https://en.wikipedia.org/wiki/Win32_Thread_Information_Block + inline static PEB64* GetProcessEnvironmentBlock() + { return reinterpret_cast(__readgsqword(0x60)); } + void UnlinkFromPEB(void) const; private: diff --git a/r5dev/tier0/memstd.cpp b/r5dev/tier0/memstd.cpp index 02692776..31d9b77c 100644 --- a/r5dev/tier0/memstd.cpp +++ b/r5dev/tier0/memstd.cpp @@ -18,10 +18,7 @@ static void InitAllocator() if (!s_bAllocatorInitialized) { s_bAllocatorInitialized = true; - - // https://en.wikipedia.org/wiki/Win32_Thread_Information_Block - const PEB64* processEnvBlock = reinterpret_cast(__readgsqword(0x60)); - const QWORD imageBase = processEnvBlock->ImageBaseAddress; + const QWORD imageBase = CModule::GetProcessEnvironmentBlock()->ImageBaseAddress; CreateGlobalMemAlloc = CModule::GetExportedSymbol(imageBase, "CreateGlobalMemAlloc").RCast();