+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] Getting window title from PEB (/showthread.php?tid=6064162)
Getting window title from PEB - ShallowME - Apr 6, 2020
Getting window title from PEB.
So I got the address of the PEB using NtQuerySystemInformation.
PEB + 0x10 => ProcessParameters
ProcessParameters + 0x70 => WindowTitle
I typecast this address to _UNICODE_STRING structure but still I get my Buffer as NULL.
What gives?
RE: Getting window title from PEB - 4Txe4y33C9zvNhMj - Apr 7, 2020
Why not just use GetWindowText()?
The info is also stored in a _LARGE_UNICODE_STRING structure.
Check this out: https://www.nccgroup.trust/globalassets/newsroom/uk/blog/documents/2015/07/exploiting-cve-2015.pdf
Should be on page 13.
RE: Getting window title from PEB - ShallowME - Apr 7, 2020
(Apr 7, 2020 02:13 AM)4Txe4y33C9zvNhMj Wrote: Why not just use GetWindowText()?This is supposed to be a exercise. I don't want to use GetWindowText.
The info is also stored in a _LARGE_UNICODE_STRING structure.
Check this out: https://www.nccgroup.trust/globalassets/newsroom/uk/blog/documents/2015/07/exploiting-cve-2015.pdf
Should be on page 13.
RE: Getting window title from PEB - 4Txe4y33C9zvNhMj - Apr 7, 2020
(Apr 7, 2020 02:46 AM)ShallowME Wrote: This is supposed to be a exercise. I don't want to use GetWindowText.
Did you read the link I sent you?
Describes how to get the string you need from the PEB.
RE: Getting window title from PEB - ShallowME - Apr 7, 2020
(Apr 7, 2020 02:49 AM)4Txe4y33C9zvNhMj Wrote: Did you read the link I sent you?
Describes how to get the string you need from the PEB.
Yes, I did. I can do it from WinDbg but for some reason it comes out to be NULL when I do it from
Code
int main(){
DWORD *PEB_ADDR = NULL;
__asm{
MOV EAX, FS:[30h]
MOV PEB_ADDR, EAX
}
void *PebPtr = (void*)PEB_ADDR;
PebPtr += 0x10;
PebPtr +=0x70;
_UNICODE_STRING *str = (_UNICODE_STRING*)PebPtr;
printf(L"%ws\n",PebPtr->Buffer);
return 0;
}RE: Getting window title from PEB - HFDone - Apr 7, 2020
PEB + 0x10 => ProcessParameters
??? PebPtr +=0x38; ???
ProcessParameters + 0x70 => WindowTitle
RE: Getting window title from PEB - ShallowME - Apr 7, 2020
(Apr 7, 2020 06:33 AM)HFDone Wrote: PEB + 0x10 => ProcessParameters
??? PebPtr +=0x38; ???
ProcessParameters + 0x70 => WindowTitle
Typo. ðŸ˜ðŸ˜
RE: Getting window title from PEB - HFDone - Apr 7, 2020
in your code you add to ProcessParameters 0x38 when it shold be 0x70
and you trying to get WindowTitle of console application which is nul
you need to do it with window application
RE: Getting window title from PEB - ShallowME - Apr 7, 2020
I am doing it for Window's form application.
RE: Getting window title from PEB - akali - Apr 8, 2020
I don't know which compiler you're using, regardless I'm pretty sure this is wrong.
Code
void *PebPtr = (void*)PEB_ADDR;
PebPtr += 0x10;
PebPtr +=0x70;RE: Getting window title from PEB - ShallowME - Apr 8, 2020
(Apr 8, 2020 02:33 AM)akali Wrote: I don't know which compiler you're using, regardless I'm pretty sure this is wrong.
Codevoid *PebPtr = (void*)PEB_ADDR;
PebPtr += 0x10;
PebPtr +=0x70;
I am using GCC.
Why is it wrong? I am type casting it to void so that it does't multiply it with sizeof(data_type) when doing pointer arithmetic.
RE: Getting window title from PEB - akali - Apr 8, 2020
(Apr 8, 2020 04:02 AM)ShallowME Wrote: I am using GCC.
Why is it wrong? I am type casting it to void so that it does't multiply it with sizeof(data_type) when doing pointer arithmetic.
I guess GCC allows pointer arithmetic to void* types. Microsoft's compiler doesn't. That's why I asked.
RE: Getting window title from PEB - ShallowME - Apr 9, 2020
(Apr 8, 2020 11:48 AM)akali Wrote: I guess GCC allows pointer arithmetic to void* types. Microsoft's compiler doesn't. That's why I asked.
The ASM part is according to MSVC but I have added that here for readability.