| |

VerySource

 Forgot password?
 Register
Search
View: 756|Reply: 5

Where is the address of the thread environment block (PEB)? ?

[Copy link]

1

Threads

2

Posts

3.00

Credits

Newbie

Rank: 1

Credits
3.00

 China

Post time: 2020-1-6 07:50:01
| Show all posts |Read mode
Is the address of the thread environment block (PEB) the value of fs, where are fs: [18h], fs: [30h]?
Reply

Use magic Report

0

Threads

36

Posts

13.00

Credits

Newbie

Rank: 1

Credits
13.00

 China

Post time: 2020-1-22 08:27:01
| Show all posts
top
Reply

Use magic Report

0

Threads

24

Posts

7.00

Credits

Newbie

Rank: 1

Credits
7.00

 China

Post time: 2020-1-25 17:09:01
| Show all posts
What operating system?
Reply

Use magic Report

1

Threads

2

Posts

3.00

Credits

Newbie

Rank: 1

Credits
3.00

 China

 Author| Post time: 2020-1-27 01:54:01
| Show all posts
windows 2000
fs points to PEB
fs: [30h] points to TEB
Reply

Use magic Report

0

Threads

3

Posts

3.00

Credits

Newbie

Rank: 1

Credits
3.00

 China

Post time: 2020-2-5 21:15:01
| Show all posts
The thread environment block should be a TEB and is generally stored in [FS: 0].
TEB is a structure, fs: [18h], fs: [30h] are of course members of the structure!
For details, please refer to "Encryption and Decryption" and "Software Encryption Technology" published by "www.pediy.com", which have detailed introductions.
Reply

Use magic Report

0

Threads

2

Posts

3.00

Credits

Newbie

Rank: 1

Credits
3.00

 China

Post time: 2020-2-7 09:30:01
| Show all posts
The thread environment block should be a TEB and is generally stored in [FS: 0].
TEB is a structure, fs: [18h] is a pointer to TEB,
                   fs: [30h] points to PEB (Process Environment Block)
For details, please refer to "Encryption and Decryption" and "Software Encryption Technology" published by "www.pediy.com", which have detailed introductions.
Reply

Use magic Report

You have to log in before you can reply Login | Register

Points Rules

Contact us|Archive|Mobile|CopyRight © 2008-2023|verysource.com ( 京ICP备17048824号-1 )

Quick Reply To Top Return to the list