[ShallowME]

Getting window title from PEB.
So I got the address of the PEB using NtQuerySystemInformation.
PEB + 0x10 => ProcessParameters
ProcessParameters + 0x70 => WindowTitle

I typecast this address to _UNICODE_STRING structure but still I get my Buffer as NULL.
What gives?

[4Txe4y33C9zvNhMj]

Why not just use GetWindowText()?

The info is also stored in a _LARGE_UNICODE_STRING structure.

Check this out: https://www.nccgroup.trust/globalassets/...e-2015.pdf

Should be on page 13.

[ShallowME]

Why not just use GetWindowText()?

The info is also stored in a _LARGE_UNICODE_STRING structure.

Check this out: https://www.nccgroup.trust/globalassets/...e-2015.pdf

Should be on page 13.

This is supposed to be a exercise. I don't want to use GetWindowText.

[4Txe4y33C9zvNhMj]

This is supposed to be a exercise. I don't want to use GetWindowText.

Did you read the link I sent you?

Describes how to get the string you need from the PEB.

[ShallowME]

Did you read the link I sent you?

Describes how to get the string you need from the PEB.

Yes, I did. I can do it from WinDbg but for some reason it comes out to be NULL when I do it from

Code

int main(){
DWORD *PEB_ADDR = NULL;
__asm{
MOV EAX, FS:[30h]
MOV PEB_ADDR, EAX
}

void *PebPtr = (void*)PEB_ADDR;

PebPtr += 0x10;
PebPtr +=0x70;
_UNICODE_STRING *str = (_UNICODE_STRING*)PebPtr;
printf(L"%ws\n",PebPtr->Buffer);
return 0;
}

[HFDone]

PEB + 0x10 => ProcessParameters
??? PebPtr +=0x38; ???
ProcessParameters + 0x70 => WindowTitle

[ShallowME]

PEB + 0x10 => ProcessParameters
??? PebPtr +=0x38; ???
ProcessParameters + 0x70 => WindowTitle

Typo. 😭😭

[HFDone]

in your code you add to ProcessParameters 0x38 when it shold be 0x70
and you trying to get WindowTitle of console application which is nul
you need to do it with window application

[ShallowME]

I am doing it for Window's form application.

[akali]

I don't know which compiler you're using, regardless I'm pretty sure this is wrong.

Code

void *PebPtr = (void*)PEB_ADDR;

PebPtr += 0x10;
PebPtr +=0x70;

[ShallowME]

I don't know which compiler you're using, regardless I'm pretty sure this is wrong.

Code

void *PebPtr = (void*)PEB_ADDR;

PebPtr += 0x10;
PebPtr +=0x70;

I am using GCC.
Why is it wrong? I am type casting it to void so that it does't multiply it with sizeof(data_type) when doing pointer arithmetic.

[akali]

I am using GCC.
Why is it wrong? I am type casting it to void so that it does't multiply it with sizeof(data_type) when doing pointer arithmetic.

I guess GCC allows pointer arithmetic to void* types. Microsoft's compiler doesn't. That's why I asked.

[ShallowME]

I guess GCC allows pointer arithmetic to void* types. Microsoft's compiler doesn't. That's why I asked.

The ASM part is according to MSVC but I have added that here for readability.