Listen to this Post
Understanding the Process Environment Block (PEB) is crucial for reverse engineering, malware analysis, and shellcode development. The PEB contains vital information about a process, including loaded modules, command-line arguments, and environment variables. This article explores how to locate modules via the PEB, a technique often used in shellcode and reverse engineering labs.
🔗 Reference: Locating Modules Via The PEB – MalwareTech
You Should Know:
1. Accessing the PEB in x86 and x64
The PEB can be accessed via the FS (x86) or GS (x64) segment registers.
x86 Assembly (PEB Access)
mov eax, fs:[bash] ; PEB pointer in x86
x64 Assembly (PEB Access)
mov rax, gs:[bash] ; PEB pointer in x64
2. Extracting Loaded Modules from PEB
The PEB_LDR_DATA structure contains a linked list of loaded modules (DLLs).
C Code Example (Walking the Module List)
include <windows.h>
include <stdio.h>
void ListModules() {
PPEB pPeb = (PPEB)__readgsqword(0x60); // x64 PEB
PLIST_ENTRY pListHead = &pPeb->Ldr->InMemoryOrderModuleList;
PLIST_ENTRY pListEntry = pListHead->Flink;
while (pListEntry != pListHead) {
PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
printf("Module: %ls\n", pEntry->FullDllName.Buffer);
pListEntry = pListEntry->Flink;
}
}
3. Shellcode Implementation (PEB Module Enumeration)
A common shellcode technique involves locating kernel32.dll via PEB to resolve API functions.
NASM Shellcode (x64)
section .text global _start _start: xor rcx, rcx mov rax, [gs:0x60] ; PEB mov rax, [rax + 0x18] ; LDR mov rsi, [rax + 0x20] ; InMemoryOrderModuleList lodsq ; First module (ntdll) xchg rax, rsi lodsq ; Second module (kernel32) mov rbx, [rax + 0x20] ; kernel32 base address
4. Practical Use in Malware Analysis
Malware often manipulates the PEB to hide modules. Detecting such tricks involves:
– Checking PEB->BeingDebugged (anti-debugging).
– Verifying LDR_MODULE integrity.
Windbg Command (Check PEB)
!peb dt _PEB @$peb
5. Python Script for PEB Parsing
import ctypes
def get_peb_address():
kernel32 = ctypes.windll.kernel32
return ctypes.c_void_p.from_buffer(kernel32.GetCurrentProcess()).value + 0x60
peb = get_peb_address()
print(f"PEB Address: 0x{peb:x}")
What Undercode Say
The PEB is a goldmine for reverse engineers and malware analysts. Key takeaways:
– PEB enables module discovery without API calls, useful in shellcode.
– Malware abuses PEB to evade detection (e.g., unlinking modules).
– Debugging tricks (like `!peb` in WinDbg) help analyze runtime behavior.
Expected Output:
Module: C:\Windows\System32\ntdll.dll Module: C:\Windows\System32\kernel32.dll Module: C:\Windows\System32\user32.dll
Prediction
As malware evolves, PEB manipulation techniques will grow more sophisticated, requiring advanced forensic tools to detect hidden modules and API hooks. Future reverse engineering tools may integrate AI-assisted PEB analysis for faster malware detection.
🔗 Further Reading:
IT/Security Reporter URL:
Reported By: Malwaretech Locating – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
