Cheat Engine

Stylo · Last edited by Stylo on Thu Nov 29, 2012 7:48 am; edited 1 time in total

Does any of you know an alternative way to get the PEB address for a remote process than NtQueryInformationProcess?

for some reason it's not reliable way it's give me a different address every time i call it for the same process :S
and i don't want to get too lower (i also created a driver to get the PEB from the EPROCESS Structure, which is more reliable way)
I want to use it in user mode.

Dark Byte · Posted: Wed Nov 28, 2012 1:13 am Post subject:

Get the segment base address of FS of any thread ( GetThreadSelectorEntry or Wow64GetThreadSelectorEntry if you're in 64-bit) and go to offset 0x30 to get the address of the PEB
Another method i noticed is finding the first entry in the stack of the main thread.. So far all programs i've seen have as first entry the peb pointer

Stylo · Posted: Wed Nov 28, 2012 1:26 pm Post subject:

yea i'v noticed too that the first entry on every process has PEB pointer in ebx register.
but how would i get there through other process?

and for GetThreadSelectorEntry, how'd i get the thread handle for a remote thread?

Dark Byte · Posted: Wed Nov 28, 2012 1:51 pm Post subject:

Enumerate the threads, then OpenThread with at least query access

Stylo · Posted: Sat Dec 01, 2012 9:21 am Post subject:

So it's basically possible from any thread that i choose... !?

Dark Byte · Posted: Sat Dec 01, 2012 9:43 am Post subject:

As long as it is a thread that belongs to to game, yes. Even your own created threads using createremotethread

atom0s · Posted: Sat Dec 01, 2012 8:39 pm Post subject:

Here's an example using CE:

n0 m3rcY · Cheater Reputation: 0 Joined: 18 Jun 2012 Posts: 42

NtQueryInformationProcess will provide you with the PROCESS_BASIC_INFORMATION struct of an external process, then just access the *PebBaseAddress member to get the PEB.

A Wow64 process will have two PEBs though, a 32 bit and a 64 bit one. The 32 bit one mirrors the 64 bit one on creation however the system uses the 64 bit one.