Created
May 6, 2024 16:51
-
-
Save WKL-Sec/8965a8584b8e40ede4724000277b11cb to your computer and use it in GitHub Desktop.
Retrieve the current process's image file name using the Process Environment Block (PEB) in C++.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // White Knight Labs | |
| // By Stigs | |
| // Offensive Development Course - Filename Check with PEB | |
| #include <iostream> | |
| #include <Windows.h> | |
| #include <winternl.h> | |
| // Function to get the current process image file name using PEB | |
| std::wstring GetCurrentProcessImageFileName() | |
| { | |
| // Get a handle to the current process | |
| HANDLE hProcess = GetCurrentProcess(); | |
| // Get PEB address using GS segment register | |
| PPEB pebAddress = nullptr; | |
| __asm { | |
| mov rax, qword ptr gs:[0x60] // Offset 0x60 is the PEB address for x64 processes | |
| mov pebAddress, rax | |
| } | |
| // Check if PEB address is valid | |
| if (pebAddress != nullptr) | |
| { | |
| // Read the ProcessParameters field from the PEB | |
| RTL_USER_PROCESS_PARAMETERS* params = nullptr; | |
| if (ReadProcessMemory(hProcess, &pebAddress->ProcessParameters, ¶ms, sizeof(params), nullptr)) | |
| { | |
| // Read the ImagePathName field from the ProcessParameters | |
| WCHAR imagePathName[MAX_PATH]; | |
| if (ReadProcessMemory(hProcess, params->ImagePathName.Buffer, imagePathName, MAX_PATH * sizeof(WCHAR), nullptr)) | |
| { | |
| return std::wstring(imagePathName); | |
| } | |
| } | |
| } | |
| // Return an empty string if we couldn't retrieve the image file name | |
| return L""; | |
| } | |
| int main() | |
| { | |
| // Get the current process image file name | |
| std::wstring currentProcessImageFileName = GetCurrentProcessImageFileName(); | |
| // Check if the process image file name is "test.exe" | |
| if (currentProcessImageFileName.find(L"test.exe") == std::wstring::npos) | |
| { | |
| std::wcerr << L"Invalid process image file name. Exiting." << std::endl; | |
| return 1; // Exit with an error code | |
| } | |
| // Proceed with the execution of the main function | |
| // Print out the image file name | |
| std::wcout << L"Current process image file name: " << currentProcessImageFileName << std::endl; | |
| return 0; | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment