diff options
Diffstat (limited to 'ReverseEngineering/Get-PEB.ps1')
| -rw-r--r-- | ReverseEngineering/Get-PEB.ps1 | 1092 |
1 files changed, 0 insertions, 1092 deletions
diff --git a/ReverseEngineering/Get-PEB.ps1 b/ReverseEngineering/Get-PEB.ps1 deleted file mode 100644 index 7ec5089..0000000 --- a/ReverseEngineering/Get-PEB.ps1 +++ /dev/null @@ -1,1092 +0,0 @@ -function Get-PEB
-{
-<#
-.SYNOPSIS
-
-Returns the process environment block (PEB) of a process.
-
-PowerSploit Function: Get-PEB
-Author: Matthew Graeber (@mattifestation)
-License: BSD 3-Clause
-Required Dependencies: None
-Optional Dependencies: Get-PEB.format.ps1xml
-
-.DESCRIPTION
-
-Get-PEB returns a fully parsed process environment block (PEB) of any process. Because the PEB and its underlying structure differ according to OS version and architecture, Get-PEB builds the PEB dynamically at runtime. Get-PEB is designed to work in Windows XP - Windows 8 32/64-bit. It will also return the PEB of Wow64 processes.
-
-.PARAMETER Id
-
-The process ID of the process whose PEB will be retrieved.
-
-.EXAMPLE
-
-C:\PS> $AllPEBs = Get-Process | Get-PEB
-
-Description
------------
-Get the PEB of every process. Note: To get the PEBs for all processes, run this command from an elevated instance of PowerShell
-
-.EXAMPLE
-
-C:\PS> $NotepadPEB = Get-PEB -Id (ps notepad)
-C:\PS> $NotepadPEB.InInitializationOrderModuleList
-
-Description
------------
-Display all loaded modules of the notepad process in initialization order.
-
-.NOTES
-
-Some processes will not issue a handle unless you are running Get-PEB from an elevated instance of PowerShell.
-
-.LINK
-
-http://www.exploit-monday.com/2013/01/Get-PEB.html
-http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx
-#>
-
- [CmdletBinding()] Param (
- [Parameter(Position = 0, Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
- [Alias('PID')]
- [UInt16[]]
- $Id
- )
-
- BEGIN
- {
- Set-StrictMode -Version 2
-
- $mscorlib = [AppDomain]::CurrentDomain.GetAssemblies() | ? { $_.FullName.Split(',')[0].ToLower() -eq 'mscorlib' }
- $Win32Native = $mscorlib.GetTypes() | ? { $_.FullName -eq 'Microsoft.Win32.Win32Native' }
-
- if ($Win32Native -eq $null)
- {
- throw 'Unable to get a reference to type: Microsoft.Win32.Win32Native'
- }
-
- function Local:Get-NTStatusException
- {
- [CmdletBinding()] Param (
- [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True)]
- [Int32[]]
- $ErrorCode
- )
-
- BEGIN
- {
- $LsaNtStatusToWinError = $Win32Native.GetMethod('LsaNtStatusToWinError', [Reflection.BindingFlags] 'NonPublic, Static')
- $GetMessage = $Win32Native.GetMethod('GetMessage', [Reflection.BindingFlags] 'NonPublic, Static')
- }
- PROCESS
- {
- foreach ($Error in $ErrorCode)
- {
- $WinErrorCode = $LsaNtStatusToWinError.Invoke($null, @($ErrorCode))
-
- Write-Output $GetMessage.Invoke($null, @($WinErrorCode))
- }
- }
- END{}
- }
-
- # The return value from Get-WindowsNTDDIVersion will be compared against these values to determine the structure of the PEB.
- $NTDDI_VISTA = 0x06000000
- $NTDDI_WS03 = 0x05020000
- $NTDDI_WINXP = 0x05010000
-
- function Local:Get-WindowsNTDDIVersion
- {
- # Return Windows version information as NTDDI_VERSION as defined in SdkDdkVer.h
- # This will aid in determining version specific PEB fields to return
- # Could this be accomplished with `Get-WmiObject Win32_OperatingSystem`? Yes, but I prefer not rely upon services that might be turned off.
- $OSVersionInfoEx = $Win32Native.GetNestedTypes('NonPublic') | ? { $_.FullName -eq 'Microsoft.Win32.Win32Native+OSVERSIONINFOEX' }
-
- if ($OSVersionInfoEx -eq $null)
- {
- Write-Error "Unable to get a reference to kernel32!OSVersionInfoEx."
- return
- }
-
- $MajorVersion = $OSVersionInfoEx.GetField('MajorVersion', [Reflection.BindingFlags] 'NonPublic, Instance')
- $MinorVersion = $OSVersionInfoEx.GetField('MinorVersion', [Reflection.BindingFlags] 'NonPublic, Instance')
- $ServicePackMajor = $OSVersionInfoEx.GetField('ServicePackMajor', [Reflection.BindingFlags] 'NonPublic, Instance')
- $ServicePackMinor = $OSVersionInfoEx.GetField('ServicePackMinor', [Reflection.BindingFlags] 'NonPublic, Instance')
- $ProductTypeField = $OSVersionInfoEx.GetField('ProductType', [Reflection.BindingFlags] 'NonPublic, Instance')
-
- $OSVersionInfoContructor = $OSVersionInfoEx.GetConstructors()[0]
- $OSVersionEx = $OSVersionInfoContructor.Invoke($null)
- # This version is present in .NET 2
- $GetVersionEx = $Win32Native.GetMethod('GetVersionEx', [Reflection.BindingFlags] 'NonPublic, Static', $null, @($OSVersionInfoEx), $null)
- if ($GetVersionEx -eq $null)
- {
- # This version is present in .NET 4
- $GetVersionEx = [Environment].GetMethod('GetVersionEx', [Reflection.BindingFlags] 'NonPublic, Static', $null, @($OSVersionInfoEx), $null)
- }
- if ($GetVersionEx -eq $null)
- {
- Write-Error "Unable to get a reference to GetVersionEx method."
- return
- }
- $Success = $GetVersionEx.Invoke($null, @($OSVersionEx))
-
- if (-not $Success)
- {
- Write-Error ([ComponentModel.Win32Exception][Runtime.InteropServices.Marshal]::GetLastWin32Error())
- return
- }
-
- # Build the version string
- $Version = [Int32] "0x$($MajorVersion.GetValue($OSVersionEx).ToString('D2'))$($MinorVersion.GetValue($OSVersionEx).ToString('D2'))$($ServicePackMajor.GetValue($OSVersionEx).ToString('D2'))$($ServicePackMinor.GetValue($OSVersionEx).ToString('D2'))"
- $ProductType = $ProductTypeField.GetValue($OSVersionEx)
-
- if ($Version -lt $NTDDI_WINXP)
- {
- throw 'Could not determine the correct Windows version! Windows ME, Windows 3.1, and OS/2 Warp are not supported. :P'
- }
-
- Write-Output $Version
- }
-
- $NTDDI_VERSION = Get-WindowsNTDDIVersion
-
- try { $NativeMethods = @([AppDomain]::CurrentDomain.GetAssemblies() | % { $_.GetTypes() } | ? { $_.FullName -eq 'Microsoft.Win32.NativeMethods' })[0] } catch {}
- $NtProcessBasicInfo = $NativeMethods.GetNestedType('NtProcessBasicInfo', [Reflection.BindingFlags]::NonPublic)
- $NtProcessBasicInfoConstructor = $NtProcessBasicInfo.GetConstructors()[0]
- $ProcessBasicInfo = $NtProcessBasicInfoConstructor.Invoke($null)
-
- $GetProcessHandle = [Diagnostics.Process].GetMethod('GetProcessHandle', [Reflection.BindingFlags] 'NonPublic, Instance', $null, @([Int]), $null)
- $PROCESS_QUERY_INFORMATION = 0x400
- $PROCESS_VM_READ = 0x0010
-
- # Sanity check to make sure that we can proceed. Without proper references, a call to NtQueryInformationProcess will crash PowerShell.
- if ($ProcessBasicInfo -eq $null)
- {
- Write-Error "Unable to get a reference to ProcessBasicInfo."
- return
- }
-
- $MEMORY_BASIC_INFORMATION = $Win32Native.GetNestedType('MEMORY_BASIC_INFORMATION', [Reflection.BindingFlags] 'NonPublic')
-
- if ($MEMORY_BASIC_INFORMATION -eq $null)
- {
- Write-Error 'Unable to get a reference to the MEMORY_BASIC_INFORMATION structure.'
- return
- }
-
- $OSArchitecture = [Int](Get-WmiObject Win32_OperatingSystem).OSArchitecture.Split('-')[0]
-
- try { $NativeUtils = [NativeUtils] } catch [Management.Automation.RuntimeException] # Only build the assembly if it hasn't already been defined
- {
- $DynAssembly = New-Object Reflection.AssemblyName('MemHacker')
- $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
- $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('MemHacker', $False)
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
- $TypeBuilder = $ModuleBuilder.DefineType('NativeUtils', $Attributes, [ValueType])
- $TypeBuilder.DefinePInvokeMethod('ReadProcessMemory', 'kernel32.dll', [Reflection.MethodAttributes] 'Public, Static', [Reflection.CallingConventions]::Standard, [Bool], @([IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, 'Auto') | Out-Null
- $TypeBuilder.DefinePInvokeMethod('VirtualQueryEx', 'kernel32.dll', [Reflection.MethodAttributes] 'Public, Static', [Reflection.CallingConventions]::Standard, [UInt32], @([IntPtr], [IntPtr], $MEMORY_BASIC_INFORMATION.MakeByRefType(), [UInt32]), [Runtime.InteropServices.CallingConvention]::Winapi, 'Auto') | Out-Null
- if ($OSArchitecture -eq 64)
- {
- $TypeBuilder.DefinePInvokeMethod('IsWow64Process', 'kernel32.dll', [Reflection.MethodAttributes] 'Public, Static', [Reflection.CallingConventions]::Standard, [Bool], @([IntPtr], [Bool].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, 'Auto') | Out-Null
- }
- $TypeBuilder.DefinePInvokeMethod('NtQueryInformationProcess', 'ntdll.dll', [Reflection.MethodAttributes] 'Public, Static', [Reflection.CallingConventions]::Standard, [UInt32], @([IntPtr], [Int], $NtProcessBasicInfo, [Int], [IntPtr]), [Runtime.InteropServices.CallingConvention]::Winapi, 'Auto') | Out-Null
- $NativeUtils = $TypeBuilder.CreateType()
- }
-
- #region Determine OS/Process/PowerShell bitness
-
- # Get PowerShell's bit-ness accordingly to [IntPtr]::Size. The bitness of PowerShell is used as the basis for determining
- # the bitness of the processes you're interested in. For example, calling Get-Process from 32-bit PowerShell will only
- # return 32-bit processes. Get-Process on 64-bit PowerShell however will return 64-bit and Wow64 processes.
- if ([IntPtr]::Size -eq 4)
- {
- $PowerShellArchitecture = 32
- }
- else
- {
- $PowerShellArchitecture = 64
- }
- #endregion
-
- #region Build PEB structure dynamically
- try
- {
- $PEBStruct = [_PEB]
- $UnicodeStringStruct = [_UNICODE_STRING]
- $ProcessParametersStruct = [_RTL_USER_PROCESS_PARAMETERS]
- $ListEntryStruct = [_LIST_ENTRY]
- $LdrDataStruct = [_PEB_LDR_DATA]
- $BalancedNodeStruct = [_RTL_BALANCED_NODE]
- $LoadReasonEnum = [_LDR_DLL_LOAD_REASON]
- $LdrModuleStruct = [_LDR_DATA_TABLE_ENTRY]
- }
- catch
- {
- # Note: Once this strcuture is built, it cannot be rebuilt or unloaded without restarting PowerShell
- $DynAssembly = New-Object Reflection.AssemblyName('PEBTools')
- $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
- $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('PEBModule', $False)
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
- $TypeBuilder = $ModuleBuilder.DefineType('_PEB', $Attributes, [ValueType])
-
- $ConstructorInfo = [Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0]
- $ConstructorValue = [Runtime.InteropServices.UnmanagedType]::ByValArray
- $FieldArray = @([Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst'))
-
- # Build type for _UNICODE_STRING
- $UnicodeTypeBuilder = $ModuleBuilder.DefineType('_UNICODE_STRING', $Attributes, [ValueType])
- $UnicodeTypeBuilder.DefineField('Length', [UInt16], 'Public') | Out-Null
- $UnicodeTypeBuilder.DefineField('MaximumLength', [UInt16], 'Public') | Out-Null
- $UnicodeTypeBuilder.DefineField('Buffer', [IntPtr], 'Public') | Out-Null
- $UnicodeStringStruct = $UnicodeTypeBuilder.CreateType()
-
- # Build type for _RTL_USER_PROCESS_PARAMETERS
- $ProcParamTypeBuilder = $ModuleBuilder.DefineType('_RTL_USER_PROCESS_PARAMETERS', $Attributes, [ValueType], 4)
- $ProcParamTypeBuilder.DefineField('MaximumLength', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('Length', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('Flags', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('DebugFlags', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('ConsoleHandle', [IntPtr], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('ConsoleFlags', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('StandardInput', [IntPtr], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('StandardOutput', [IntPtr], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('StandardError', [IntPtr], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('CurrentDirectory', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('CurrentDirectoryHandle', [IntPtr], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('DllPath', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('ImagePathName', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('CommandLine', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('Environment', [IntPtr], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('StartingX', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('StartingY', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('CountX', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('CountY', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('CountCharsX', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('CountCharsY', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('FillAttribute', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('WindowFlags', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('ShowWindowFlags', [UInt32], 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('WindowTitle', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('DesktopInfo', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('ShellInfo', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcParamTypeBuilder.DefineField('RuntimeData', $UnicodeStringStruct, 'Public') | Out-Null
- $ProcessParametersStruct = $ProcParamTypeBuilder.CreateType()
-
- # Build type for _LIST_ENTRY
- $ListEntryTypeBuilder = $ModuleBuilder.DefineType('_LIST_ENTRY', $Attributes, [System.ValueType])
- $ListEntryTypeBuilder.DefineField('Flink', [IntPtr], 'Public') | Out-Null
- $ListEntryTypeBuilder.DefineField('Blink', [IntPtr], 'Public') | Out-Null
- $ListEntryStruct = $ListEntryTypeBuilder.CreateType()
-
- # Build type for _PEB_LDR_DATA
- $PEBLdrDataTypeBuilder = $ModuleBuilder.DefineType('_PEB_LDR_DATA', $Attributes, [System.ValueType])
- $PEBLdrDataTypeBuilder.DefineField('Length', [UInt32], 'Public') | Out-Null
- $InitializedField = $PEBLdrDataTypeBuilder.DefineField('Initialized', [Byte[]], 'Public')
- $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4))
- $InitializedField.SetCustomAttribute($AttribBuilder)
- $PEBLdrDataTypeBuilder.DefineField('SsHandle', [IntPtr], 'Public') | Out-Null
- $PEBLdrDataTypeBuilder.DefineField('InLoadOrderModuleList', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrDataTypeBuilder.DefineField('InMemoryOrderModuleList', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrDataTypeBuilder.DefineField('InInitializationOrderModuleList', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrDataTypeBuilder.DefineField('EntryInProgress', [IntPtr], 'Public') | Out-Null
- $ShutdownInProgressField = $PEBLdrDataTypeBuilder.DefineField('ShutdownInProgress', [Byte[]], 'Public')
- $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 2))
- $ShutdownInProgressField.SetCustomAttribute($AttribBuilder)
- $PEBLdrDataTypeBuilder.DefineField('ShutdownThreadId', [IntPtr], 'Public') | Out-Null
- $LdrDataStruct = $PEBLdrDataTypeBuilder.CreateType()
-
- # Build type for _RTL_BALANCED_NODE
- $BalancedNodeTypeBuilder = $ModuleBuilder.DefineType('_RTL_BALANCED_NODE', $Attributes, [System.ValueType])
- $BalancedNodeTypeBuilder.DefineField('Left', [IntPtr], 'Public') | Out-Null
- $BalancedNodeTypeBuilder.DefineField('Right', [IntPtr], 'Public') | Out-Null
- if ($PowerShellArchitecture -eq 64) { $BalancedNodeTypeBuilder.DefineField('ParentValue', [UInt64], 'Public') | Out-Null }
- else { $BalancedNodeTypeBuilder.DefineField('ParentValue', [UInt32], 'Public') | Out-Null }
- $BalancedNodeStruct = $BalancedNodeTypeBuilder.CreateType()
-
- # Build type for _LDR_DLL_LOAD_REASON enum
- $EnumBuilder = $ModuleBuilder.DefineEnum('_LDR_DLL_LOAD_REASON', 'Public', [Int32])
- # Define values of the enum
- $EnumBuilder.DefineLiteral('StaticDependency', [Int32] 0) | Out-Null
- $EnumBuilder.DefineLiteral('StaticForwarderDependency', [Int32] 1) | Out-Null
- $EnumBuilder.DefineLiteral('DynamicForwarderDependency', [Int32] 2) | Out-Null
- $EnumBuilder.DefineLiteral('DelayloadDependency', [Int32] 3) | Out-Null
- $EnumBuilder.DefineLiteral('DynamicLoad', [Int32] 4) | Out-Null
- $EnumBuilder.DefineLiteral('AsImageLoad', [Int32] 5) | Out-Null
- $EnumBuilder.DefineLiteral('AsDataLoad', [Int32] 6) | Out-Null
- $EnumBuilder.DefineLiteral('Unknown', [Int32] -1) | Out-Null
- $LoadReasonEnum = $EnumBuilder.CreateType()
-
- # Build type for _LDR_DATA_TABLE_ENTRY
- $PEBLdrModuleTypeBuilder = $ModuleBuilder.DefineType('_LDR_DATA_TABLE_ENTRY', $Attributes, [System.ValueType])
- $PEBLdrModuleTypeBuilder.DefineField('InLoadOrderModuleList', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('InMemoryOrderModuleList', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('InInitializationOrderModuleList', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('BaseAddress', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('EntryPoint', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('FullDllName', [_UNICODE_STRING], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('BaseDllName', [_UNICODE_STRING], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('Flags', [UInt32], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('ObsoleteLoadCount', [UInt16], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('TlsIndex', [UInt16], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('HashLinks', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('EntryPointActivationContext', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('PatchInformation', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('DdagNode', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('NodeModuleLink', [_LIST_ENTRY], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('SnapContext', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('ParentDllBase', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('SwitchBackContext', [IntPtr], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('BaseAddressIndexNode', [_RTL_BALANCED_NODE], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('MappingInfoIndexNode', [_RTL_BALANCED_NODE], 'Public') | Out-Null
- if ($PowerShellArchitecture -eq 64) { $PEBLdrModuleTypeBuilder.DefineField('OriginalBase', [UInt64], 'Public') | Out-Null }
- else { $PEBLdrModuleTypeBuilder.DefineField('OriginalBase', [UInt32], 'Public') | Out-Null }
- $PEBLdrModuleTypeBuilder.DefineField('LoadTime', [UInt64], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('BaseNameHashValue', [UInt32], 'Public') | Out-Null
- $PEBLdrModuleTypeBuilder.DefineField('LoadReason', [_LDR_DLL_LOAD_REASON], 'Public') | Out-Null
- $LdrModuleStruct = $PEBLdrModuleTypeBuilder.CreateType()
-
- $TypeBuilder.DefineField('InheritedAddressSpace', [Byte], 'Public') | Out-Null
- $TypeBuilder.DefineField('ReadImageFileExecOptions', [Byte], 'Public') | Out-Null
- $TypeBuilder.DefineField('BeingDebugged', [Byte], 'Public') | Out-Null
- $TypeBuilder.DefineField('BitField', [Byte], 'Public') | Out-Null
- if ($PowerShellArchitecture -eq 64) { $TypeBuilder.DefineField('Reserved3', [UInt32], 'Public, HasFieldMarshal') | Out-Null }
- $TypeBuilder.DefineField('Mutant', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('ImageBaseAddress', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('Ldr', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('ProcessParameters', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('SubSystemData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('ProcessHeap', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('FastPebLock', [IntPtr], 'Public') | Out-Null
-
- if ($NTDDI_VERSION -ge $NTDDI_VISTA)
- {
- $TypeBuilder.DefineField('AtlThunkSListPtr', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('IFEOKey', [IntPtr], 'Public') | Out-Null
- if ($PowerShellArchitecture -eq 64) { $TypeBuilder.DefineField('CrossProcessFlags', [UInt64], 'Public') | Out-Null
- } else { $TypeBuilder.DefineField('CrossProcessFlags', [UInt32], 'Public') | Out-Null }
- $TypeBuilder.DefineField('KernelCallbackTable', [IntPtr], 'Public') | Out-Null
- }
- elseif ($NTDDI_VERSION -ge $NTDDI_WS03)
- {
- $TypeBuilder.DefineField('AtlThunkSListPtr', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('SparePtr2', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('EnvironmentUpdateCount', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('KernelCallbackTable', [IntPtr], 'Public') | Out-Null
- }
- else
- {
- $TypeBuilder.DefineField('FastPebLockRoutine', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('FastPebUnlockRoutine', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('EnvironmentUpdateCount', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('KernelCallbackTable', [IntPtr], 'Public') | Out-Null
- }
- $TypeBuilder.DefineField('SystemReserved', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('AtlThunkSListPtr32', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('ApiSetMap', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('TlsExpansionCounter', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('TlsBitmap', [IntPtr], 'Public') | Out-Null
- $TlsBitmapBitsField = $TypeBuilder.DefineField('TlsBitmapBits', [UInt32[]], 'Public, HasFieldMarshal')
- $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 2))
- $TlsBitmapBitsField.SetCustomAttribute($AttribBuilder)
- $TypeBuilder.DefineField('ReadOnlySharedMemoryBase', [IntPtr], 'Public') | Out-Null
- if ($NTDDI_VERSION -ge $NTDDI_VISTA)
- {
- $TypeBuilder.DefineField('HotpatchInformation', [IntPtr], 'Public') | Out-Null
- }
- else
- {
- $TypeBuilder.DefineField('ReadOnlySharedMemoryHeap', [IntPtr], 'Public') | Out-Null
- }
- $TypeBuilder.DefineField('ReadOnlyStaticServerData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('AnsiCodePageData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('OemCodePageData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('UnicodeCaseTableData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('NumberOfProcessors', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('NtGlobalFlag', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('CriticalSectionTimeout', [Int64], 'Public') | Out-Null
- if ($PowerShellArchitecture -eq 64)
- {
- $TypeBuilder.DefineField('HeapSegmentReserve', [UInt64], 'Public') | Out-Null
- $TypeBuilder.DefineField('HeapSegmentCommit', [UInt64], 'Public') | Out-Null
- }
- else
- {
- $TypeBuilder.DefineField('HeapSegmentReserve', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('HeapSegmentCommit', [UInt32], 'Public') | Out-Null
- }
- $TypeBuilder.DefineField('HeapDeCommitTotalFreeThreshold', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('HeapDeCommitFreeBlockThreshold', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('NumberOfHeaps', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('MaximumNumberOfHeaps', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('ProcessHeaps', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('GdiSharedHandleTable', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('ProcessStarterHelper', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('GdiDCAttributeList', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('LoaderLock', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('OSMajorVersion', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('OSMinorVersion', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('OSBuildNumber', [UInt16], 'Public') | Out-Null
- $TypeBuilder.DefineField('OSCSDVersion', [UInt16], 'Public') | Out-Null
- $TypeBuilder.DefineField('OSPlatformId', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('ImageSubsystem', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('ImageSubsystemMajorVersion', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('ImageSubsystemMinorVersion', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('ActiveProcessAffinityMask', [IntPtr], 'Public') | Out-Null
- $GdiHandleBufferField = $TypeBuilder.DefineField('GdiHandleBuffer', [UInt32[]], 'Public, HasFieldMarshal')
- if ($PowerShellArchitecture -eq 64) { $GDI_HANDLE_BUFFER_SIZE = 60 } else { $GDI_HANDLE_BUFFER_SIZE = 34 }
- $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] $GDI_HANDLE_BUFFER_SIZE))
- $GdiHandleBufferField.SetCustomAttribute($AttribBuilder)
- $TypeBuilder.DefineField('PostProcessInitRoutine', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('TlsExpansionBitmap', [IntPtr], 'Public') | Out-Null
- $TlsExpansionBitmapBitsField = $TypeBuilder.DefineField('TlsExpansionBitmapBits', [UInt32[]], 'Public, HasFieldMarshal')
- $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 32))
- $TlsExpansionBitmapBitsField.SetCustomAttribute($AttribBuilder)
- $TypeBuilder.DefineField('SessionId', [UInt32], 'Public') | Out-Null
-
- if ($NTDDI_VERSION -ge $NTDDI_WINXP)
- {
- $TypeBuilder.DefineField('AppCompatFlags', [UInt64], 'Public') | Out-Null
- $TypeBuilder.DefineField('AppCompatFlagsUser', [UInt64], 'Public') | Out-Null
- $TypeBuilder.DefineField('pShimData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('AppCompatInfo', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('CSDVersion', [_UNICODE_STRING], 'Public') | Out-Null
- $TypeBuilder.DefineField('ActivationContextData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('ProcessAssemblyStorageMap', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('SystemDefaultActivationContextData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('SystemAssemblyStorageMap', [IntPtr], 'Public') | Out-Null
- if ($PowerShellArchitecture -eq 64) { $TypeBuilder.DefineField('MinimumStackCommit', [UInt64], 'Public') | Out-Null
- } else { $TypeBuilder.DefineField('MinimumStackCommit', [UInt32], 'Public') | Out-Null }
- }
- if ($NTDDI_VERSION -ge $NTDDI_WS03)
- {
- $TypeBuilder.DefineField('FlsCallback', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('FlsListHead', [_LIST_ENTRY], 'Public') | Out-Null
- $TypeBuilder.DefineField('FlsBitmap', [IntPtr], 'Public') | Out-Null
- $FlsBitmapBitsField = $TypeBuilder.DefineField('FlsBitmapBits', [UInt32[]], 'Public')
- $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4))
- $FlsBitmapBitsField.SetCustomAttribute($AttribBuilder)
- $TypeBuilder.DefineField('FlsHighIndex', [UInt32], 'Public') | Out-Null
- }
- if ($NTDDI_VERSION -ge $NTDDI_VISTA)
- {
- $TypeBuilder.DefineField('WerRegistrationData', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('WerShipAssertPtr', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('pUnused', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('pImageHeaderHash', [IntPtr], 'Public') | Out-Null
- $TypeBuilder.DefineField('TracingFlags', [UInt32], 'Public') | Out-Null
- $TypeBuilder.DefineField('CsrServerReadOnlySharedMemoryBase', [UInt64], 'Public') | Out-Null
- }
-
- $PEBStruct = $TypeBuilder.CreateType()
- }
-
- $PEBSize = [Runtime.InteropServices.Marshal]::SizeOf([Type]$PEBStruct)
- #endregion
-
- function Local:Get-StructFromMemory
- {
- [CmdletBinding()] Param (
- [Parameter(Position = 0, Mandatory = $True)]
- [Alias('ProcessId')]
- [UInt16]
- $ProcId,
-
- [Parameter(Position = 1, Mandatory = $True)]
- [IntPtr]
- $MemoryAddress,
-
- [Parameter(Position = 2, Mandatory = $True)]
- [Alias('Type')]
- [Type]
- $StructType,
-
- [ValidateSet('InLoadOrderModuleList','InMemoryOrderModuleList','InInitializationOrderModuleList')]
- [String]
- $LoadOrder,
-
- [UInt16]
- $UnicodeStringSize
- )
-
- if (($StructType -eq [String]) -and ($MemoryAddress -eq 0)) { Write-Output ''; return }
- elseif ($MemoryAddress -eq 0) { Write-Output $null; return }
-
- $PROCESS_VM_READ = 0x0010 # The process permissions we'l ask for when getting a handle to the process
-
- $GetProcessHandle = [Diagnostics.Process].GetMethod('GetProcessHandle', [Reflection.BindingFlags] 'NonPublic, Instance', $null, @([Int]), $null)
-
- try
- {
- $Process = Get-Process -Id $ProcId -ErrorVariable GetProcessError
- $Handle = $Process.Handle
- }
- catch [Exception]
- {
- Write-Error $GetProcessError
- return
- }
-
- if ($Handle -eq $null)
- {
- Write-Error "Unable to obtain a handle for PID $ProcId. You will likely need to run this script elevated."
- return
- }
-
- $ProtectField = $MEMORY_BASIC_INFORMATION.GetField('Protect', [Reflection.BindingFlags] 'NonPublic, Instance')
- $AllocationBaseField = $MEMORY_BASIC_INFORMATION.GetField('BaseAddress', [Reflection.BindingFlags] 'NonPublic, Instance')
- $RegionSizeField = $MEMORY_BASIC_INFORMATION.GetField('RegionSize', [Reflection.BindingFlags] 'NonPublic, Instance')
-
- try
- {
- $SafeHandle = $GetProcessHandle.Invoke($Process, @($PROCESS_VM_READ))
- $Handle = $SafeHandle.DangerousGetHandle()
- }
- catch
- {
- Write-Error $Error[0]
- return
- }
-
- $PAGE_EXECUTE_READ = 0x20
- $PAGE_EXECUTE_READWRITE = 0x40
- $PAGE_READONLY = 2
- $PAGE_READWRITE = 4
-
- if ($StructType -eq $LdrModuleStruct -and $LoadOrder)
- {
- $OriginalFlink = $MemoryAddress
- $Flink = $OriginalFlink
-
- do
- {
- $MemoryBasicInformation = [Activator]::CreateInstance($MEMORY_BASIC_INFORMATION)
- $NativeUtils::VirtualQueryEx($Handle, $Flink, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf([Type]$MEMORY_BASIC_INFORMATION)) | Out-Null
-
- $Protection = $ProtectField.GetValue($MemoryBasicInformation)
- $AllocationBaseOriginal = $AllocationBaseField.GetValue($MemoryBasicInformation)
- $GetPointerValue = $AllocationBaseOriginal.GetType().GetMethod('GetPointerValue', [Reflection.BindingFlags] 'NonPublic, Instance')
- $AllocationBase = $GetPointerValue.Invoke($AllocationBaseOriginal, $null).ToInt64()
- $RegionSize = $RegionSizeField.GetValue($MemoryBasicInformation).ToUInt64()
-
- if (($Protection -ne $PAGE_READONLY) -and ($Protection -ne $PAGE_READWRITE) -and ($Protection -ne $PAGE_EXECUTE_READ) -and ($Protection -ne $PAGE_EXECUTE_READWRITE))
- {
- $SafeHandle.Close()
- Write-Error 'The address specified does not have read access.'
- return
- }
-
- $StructSize = [Runtime.InteropServices.Marshal]::SizeOf([Type]$LdrModuleStruct)
- $EndOfAllocation = $AllocationBase + $RegionSize
- $EndOfStruct = $MemoryAddress.ToInt64() + $StructSize
-
- if ($EndOfStruct -gt $EndOfAllocation)
- {
- $SafeHandle.Close()
- Write-Error 'You are attempting to read beyond what was allocated.'
- return
- }
-
- try
- {
- $LocalStructPtr = [Runtime.InteropServices.Marshal]::AllocHGlobal($StructSize)
- }
- catch [OutOfMemoryException]
- {
- Write-Error $Error[0]
- return
- }
-
- $ZeroBytes = New-Object Byte[]($StructSize)
- [Runtime.InteropServices.Marshal]::Copy($ZeroBytes, 0, $LocalStructPtr, $StructSize)
-
- $BytesRead = [UInt32] 0
-
- if ($NativeUtils::ReadProcessMemory($Handle, $Flink, $LocalStructPtr, $StructSize, [Ref] $BytesRead))
- {
- $SafeHandle.Close()
- [Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
- Write-Error ([ComponentModel.Win32Exception][Runtime.InteropServices.Marshal]::GetLastWin32Error())
- return
- }
-
- $ParsedLdrModule = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, [Type] $LdrModuleStruct)
-
- [Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
-
- switch ($LoadOrder)
- {
- 'InLoadOrderModuleList' { $Flink = $ParsedLdrModule.InLoadOrderModuleList.Flink }
- 'InMemoryOrderModuleList' { $Flink = [IntPtr] ($ParsedLdrModule.InMemoryOrderModuleList.Flink.ToInt64() - [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct)) }
- 'InInitializationOrderModuleList' { $Flink = [IntPtr] ($ParsedLdrModule.InInitializationOrderModuleList.Flink.ToInt64() - (2 * [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct))) }
- }
-
- $SafeHandle = $GetProcessHandle.Invoke($Process, @($PROCESS_VM_READ))
- $Handle = $SafeHandle.DangerousGetHandle()
-
- if ($ParsedLdrModule.SizeOfImage)
- {
- Write-Output $ParsedLdrModule
- }
- } while (($Flink -ne 0) -and ($Flink -ne $OriginalFlink))
-
- $SafeHandle.Close()
- }
- elseif ($StructType -eq [String] -and $UnicodeStringSize)
- {
- $MemoryBasicInformation = [Activator]::CreateInstance($MEMORY_BASIC_INFORMATION)
- $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf([Type]$MEMORY_BASIC_INFORMATION)) | Out-Null
-
- $Protection = $ProtectField.GetValue($MemoryBasicInformation)
- $AllocationBaseOriginal = $AllocationBaseField.GetValue($MemoryBasicInformation)
- $GetPointerValue = $AllocationBaseOriginal.GetType().GetMethod('GetPointerValue', [Reflection.BindingFlags] 'NonPublic, Instance')
- $AllocationBase = $GetPointerValue.Invoke($AllocationBaseOriginal, $null).ToInt64()
- $RegionSize = $RegionSizeField.GetValue($MemoryBasicInformation).ToUInt64()
-
- if (($Protection -ne $PAGE_READONLY) -and ($Protection -ne $PAGE_READWRITE) -and ($Protection -ne $PAGE_EXECUTE_READ) -and ($Protection -ne $PAGE_EXECUTE_READWRITE))
- {
- $SafeHandle.Close()
- Write-Error 'The address specified does not have read access.'
- return
- }
-
- $StructSize = $UnicodeStringSize
- $EndOfAllocation = $AllocationBase + $RegionSize
- $EndOfStruct = $MemoryAddress.ToInt64() + $StructSize
-
- if ($EndOfStruct -gt $EndOfAllocation)
- {
- $SafeHandle.Close()
- Write-Error 'You are attempting to read beyond what was allocated.'
- return
- }
-
- try
- {
- $LocalStructPtr = [Runtime.InteropServices.Marshal]::AllocHGlobal($StructSize)
- }
- catch [OutOfMemoryException]
- {
- Write-Error $Error[0]
- return
- }
-
- $ZeroBytes = New-Object Byte[]($StructSize)
- [Runtime.InteropServices.Marshal]::Copy($ZeroBytes, 0, $LocalStructPtr, $StructSize)
-
- $BytesRead = [UInt32] 0
-
- if ($NativeUtils::ReadProcessMemory($Handle, $MemoryAddress, $LocalStructPtr, $StructSize, [Ref] $BytesRead))
- {
- $SafeHandle.Close()
- [Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
- Write-Error ([ComponentModel.Win32Exception][Runtime.InteropServices.Marshal]::GetLastWin32Error())
- return
- }
-
- $ParsedStruct = [Runtime.InteropServices.Marshal]::PtrToStringUni($LocalStructPtr)
-
- [Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
- $SafeHandle.Close()
-
- Write-Output $ParsedStruct
- }
- else
- {
- $MemoryBasicInformation = [Activator]::CreateInstance($MEMORY_BASIC_INFORMATION)
- $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf([Type]$MEMORY_BASIC_INFORMATION)) | Out-Null
-
- $Protection = $ProtectField.GetValue($MemoryBasicInformation)
- $AllocationBaseOriginal = $AllocationBaseField.GetValue($MemoryBasicInformation)
- $GetPointerValue = $AllocationBaseOriginal.GetType().GetMethod('GetPointerValue', [Reflection.BindingFlags] 'NonPublic, Instance')
- $AllocationBase = $GetPointerValue.Invoke($AllocationBaseOriginal, $null).ToInt64()
- $RegionSize = $RegionSizeField.GetValue($MemoryBasicInformation).ToUInt64()
-
- if (($Protection -ne $PAGE_READONLY) -and ($Protection -ne $PAGE_READWRITE) -and ($Protection -ne $PAGE_EXECUTE_READ) -and ($Protection -ne $PAGE_EXECUTE_READWRITE))
- {
- $SafeHandle.Close()
- Write-Error 'The address specified does not have read access.'
- return
- }
-
- $StructSize = [Runtime.InteropServices.Marshal]::SizeOf([Type]$StructType)
- $EndOfAllocation = $AllocationBase + $RegionSize
- $EndOfStruct = $MemoryAddress.ToInt64() + $StructSize
-
- if ($EndOfStruct -gt $EndOfAllocation)
- {
- $SafeHandle.Close()
- Write-Error 'You are attempting to read beyond what was allocated.'
- return
- }
-
- try
- {
- $LocalStructPtr = [Runtime.InteropServices.Marshal]::AllocHGlobal($StructSize)
- }
- catch [OutOfMemoryException]
- {
- Write-Error $Error[0]
- return
- }
-
- $ZeroBytes = New-Object Byte[]($StructSize)
- [Runtime.InteropServices.Marshal]::Copy($ZeroBytes, 0, $LocalStructPtr, $StructSize)
-
- $BytesRead = [UInt32] 0
-
- if ($NativeUtils::ReadProcessMemory($Handle, $MemoryAddress, $LocalStructPtr, $StructSize, [Ref] $BytesRead))
- {
- $SafeHandle.Close()
- [Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
- Write-Error ([ComponentModel.Win32Exception][Runtime.InteropServices.Marshal]::GetLastWin32Error())
- return
- }
-
- $ParsedStruct = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, [Type] $StructType)
-
- [Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
- $SafeHandle.Close()
-
- Write-Output $ParsedStruct
- }
- }
- }
-
- PROCESS
- {
- foreach ($ProcessId in $Id)
- {
- $Handle = $null
-
- try
- {
- $Process = Get-Process -Id $ProcessId -ErrorVariable GetProcessError
- # Get the process handle
- $Handle = $Process.Handle
- }
- catch { }
-
- if ($Handle -eq $null)
- {
- Write-Error "Unable to obtain a handle for PID $ProcessId. You will likely need to run this script elevated."
- }
- else
- {
- $SafeHandle = $GetProcessHandle.Invoke($Process, @($PROCESS_QUERY_INFORMATION -bor $PROCESS_VM_READ))
- $Handle = $SafeHandle.DangerousGetHandle()
-
- Write-Verbose "ProcessName: $($Process.ProcessName)"
- Write-Verbose "Handle: $Handle"
-
- if ($OSArchitecture -eq 64)
- {
- $IsWow64 = $False
- $NativeUtils::IsWow64Process($Handle, [Ref] $IsWow64) | Out-Null
-
- if ($PowerShellArchitecture -eq 32 -and (-not $IsWow64))
- {
- $SafeHandle.Close()
- Write-Error 'Cannot get the PEB of a 64-bit process from a Wow64 process. Use 64-bit PowerShell and try again.'
- return
- }
- }
-
- $ProcessBasicInfo = $NtProcessBasicInfoConstructor.Invoke($null)
-
- $Status = $NativeUtils::NtQueryInformationProcess($Handle, 0, $ProcessBasicInfo, [Runtime.InteropServices.Marshal]::SizeOf($ProcessBasicInfo), [IntPtr]::Zero)
-
- Write-Verbose 'ProcessBasicInfo:'
- Write-Verbose ($ProcessBasicInfo | Out-String)
-
- if ($Status -ne 0)
- {
- $SafeHandle.Close()
- Write-Error (Get-NTStatusException $Status)
- return
- }
-
- $SafeHandle.Close()
-
- $PEB = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessBasicInfo.PebBaseAddress) -StructType ($PEBStruct)
-
- $ProcessParams = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($PEB.ProcessParameters) -StructType ($ProcessParametersStruct)
-
- $CurrentDirectory = ''
- $DllPath = ''
- $ImagePathName = ''
- $CommandLine = ''
- $WindowTitle = ''
- $DesktopInfo = ''
- $ShellInfo = ''
- $RuntimeData = ''
-
- if ($ProcessParams.CurrentDirectory.Buffer) { $CurrentDirectory = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.CurrentDirectory.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.CurrentDirectory.MaximumLength) }
- if ($ProcessParams.DllPath.Buffer) { $DllPath = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.DllPath.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.DllPath.MaximumLength) } else { $DllPath = '' }
- if ($ProcessParams.ImagePathName.Buffer) { $ImagePathName = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.ImagePathName.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.ImagePathName.MaximumLength) }
- if ($ProcessParams.CommandLine.Buffer) { $CommandLine = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.CommandLine.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.CommandLine.MaximumLength) }
- if ($ProcessParams.WindowTitle.Buffer) { $WindowTitle = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.WindowTitle.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.WindowTitle.MaximumLength) }
- if ($ProcessParams.DesktopInfo.Buffer) { $DesktopInfo = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.DesktopInfo.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.DesktopInfo.MaximumLength) }
- if ($ProcessParams.ShellInfo.Buffer) { $ShellInfo = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.ShellInfo.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.ShellInfo.MaximumLength) }
- if ($ProcessParams.RuntimeData.Buffer) { $RuntimeData = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($ProcessParams.RuntimeData.Buffer) -StructType ([String]) -UnicodeStringSize ($ProcessParams.RuntimeData.MaximumLength) }
-
- $ProcessParameters = @{
- MaximumLength = $ProcessParams.MaximumLength
- Length = $ProcessParams.Length
- Flags = $ProcessParams.Flags
- DebugFlags = $ProcessParams.DebugFlags
- ConsoleHandle = $ProcessParams.ConsoleHandle
- ConsoleFlags = $ProcessParams.ConsoleFlags
- StandardInput = $ProcessParams.StandardInput
- StandardOutput = $ProcessParams.StandardOutput
- StandardError = $ProcessParams.StandardError
- CurrentDirectory = $CurrentDirectory
- DllPath = $DllPath
- ImagePathName = $ImagePathName
- CommandLine = $CommandLine
- Environment = $ProcessParams.Environment
- StartingX = $ProcessParams.StartingX
- StartingY = $ProcessParams.StartingY
- CountX = $ProcessParams.CountX
- CountY = $ProcessParams.CountY
- CountCharsX = $ProcessParams.CountCharsX
- CountCharsY = $ProcessParams.CountCharsY
- FillAttribute = $ProcessParams.FillAttribute
- WindowFlags = $ProcessParams.WindowFlags
- ShowWindowFlags = $ProcessParams.ShowWindowFlags
- WindowTitle = $WindowTitle
- DesktopInfo = $DesktopInfo
- ShellInfo = $ShellInfo
- RuntimeData = $RuntimeData
- }
-
- $ProcessParamsParsed = New-Object PSObject -Property $ProcessParameters
- $ProcessParamsParsed.PSObject.TypeNames[0] = 'PEB.ProcessParameters'
-
- # Get custom objects for the PEB based upon OS version
- # First, build up the custom object with fields common amongst all versions of the PEB
- $CustomPEB = @{
- ProcessName = $Process.ProcessName
- ProcessId = $ProcessId
- InheritedAddressSpace = if($PEB.InheritedAddressSpace -eq 0){$False}else{$True}
- ReadImageFileExecOptions = if($PEB.ReadImageFileExecOptions -eq 0){$False}else{$True}
- BeingDebugged = if($PEB.BeingDebugged -eq 0){$False}else{$True}
- Mutant = $PEB.Mutant
- ImageBaseAddress = $PEB.ImageBaseAddress
- Ldr = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($PEB.Ldr) -StructType ($LdrDataStruct)
- ProcessParameters = $ProcessParamsParsed
- SubSystemData = $PEB.SubSystemData
- ProcessHeap = $PEB.ProcessHeap
- FastPebLock = $PEB.FastPebLock
- SystemReserved = $PEB.SystemReserved
- AtlThunkSListPtr32 = $PEB.AtlThunkSListPtr32
- ApiSetMap = $PEB.ApiSetMap
- TlsExpansionCounter = $PEB.TlsExpansionCounter
- TlsBitmap = $PEB.TlsBitmap
- TlsBitmapBits = $PEB.TlsBitmapBits
- ReadOnlySharedMemoryBase = $PEB.ReadOnlySharedMemoryBase
- ReadOnlyStaticServerData = $PEB.ReadOnlyStaticServerData
- AnsiCodePageData = $PEB.AnsiCodePageData
- OemCodePageData = $PEB.OemCodePageData
- UnicodeCaseTableData = $PEB.UnicodeCaseTableData
- NumberOfProcessors = $PEB.NumberOfProcessors
- NtGlobalFlag = $PEB.NtGlobalFlag
- CriticalSectionTimeout = $PEB.CriticalSectionTimeout
- HeapSegmentReserve = $PEB.HeapSegmentReserve
- HeapSegmentCommit = $PEB.HeapSegmentCommit
- HeapDeCommitTotalFreeThreshold = $PEB.HeapDeCommitTotalFreeThreshold
- HeapDeCommitFreeBlockThreshold = $PEB.HeapDeCommitFreeBlockThreshold
- NumberOfHeaps = $PEB.NumberOfHeaps
- MaximumNumberOfHeaps = $PEB.MaximumNumberOfHeaps
- ProcessHeaps = $PEB.ProcessHeaps
- GdiSharedHandleTable = $PEB.GdiSharedHandleTable
- ProcessStarterHelper = $PEB.ProcessStarterHelper
- GdiDCAttributeList = $PEB.GdiDCAttributeList
- LoaderLock = $PEB.LoaderLock
- OSMajorVersion = $PEB.OSMajorVersion
- OSMinorVersion = $PEB.OSMinorVersion
- OSBuildNumber = $PEB.OSBuildNumber
- OSCSDVersion = $PEB.OSCSDVersion
- OSPlatformId = $PEB.OSPlatformId
- ImageSubsystem = $PEB.ImageSubsystem
- ImageSubsystemMajorVersion = $PEB.ImageSubsystemMajorVersion
- ImageSubsystemMinorVersion = $PEB.ImageSubsystemMinorVersion
- ActiveProcessAffinityMask = $PEB.ActiveProcessAffinityMask
- GdiHandleBuffer = $PEB.GdiHandleBuffer
- PostProcessInitRoutine = $PEB.PostProcessInitRoutine
- TlsExpansionBitmap = $PEB.TlsExpansionBitmap
- TlsExpansionBitmapBits = $PEB.TlsExpansionBitmapBits
- SessionId = $PEB.SessionId
- AppCompatFlags = $PEB.AppCompatFlags
- AppCompatFlagsUser = $PEB.AppCompatFlagsUser
- pShimData = $PEB.pShimData
- AppCompatInfo = $PEB.AppCompatInfo
- CSDVersion = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($PEB.CSDVersion.Buffer) -StructType ([String]) -UnicodeStringSize ($PEB.CSDVersion.MaximumLength)
- ActivationContextData = $PEB.ActivationContextData
- ProcessAssemblyStorageMap = $PEB.ProcessAssemblyStorageMap
- SystemDefaultActivationContextData = $PEB.SystemDefaultActivationContextData
- SystemAssemblyStorageMap = $PEB.SystemAssemblyStorageMap
- MinimumStackCommit = $PEB.MinimumStackCommit
- }
-
- foreach ($j in 1..3)
- {
- switch ($j)
- {
- 1 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($CustomPEB['Ldr'].InLoadOrderModuleList.Flink) -StructType ($LdrModuleStruct) -LoadOrder 'InLoadOrderModuleList' }
- 2 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ([IntPtr] ($CustomPEB['Ldr'].InMemoryOrderModuleList.Flink.ToInt64() - [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct))) -StructType ($LdrModuleStruct) -LoadOrder 'InMemoryOrderModuleList' }
- 3 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ([IntPtr] ($CustomPEB['Ldr'].InInitializationOrderModuleList.Flink.ToInt64() - (2 * [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct)))) -StructType ($LdrModuleStruct) -LoadOrder 'InInitializationOrderModuleList' }
- }
-
- $ParsedOrderedModules = New-Object Hashtable[]($OrderedModules.Length)
- $Modules = New-Object PSObject[]($OrderedModules.Length)
-
- $i = 0
- foreach ($Module in $OrderedModules)
- {
- $ParsedOrderedModules[$i] = @{
- InLoadOrderModuleList = $Module.InLoadOrderModuleList
- InMemoryOrderModuleList = $Module.InMemoryOrderModuleList
- InInitializationOrderModuleList = $Module.InInitializationOrderModuleList
- BaseAddress = $Module.BaseAddress
- EntryPoint = $Module.EntryPoint
- SizeOfImage = $Module.SizeOfImage
- FullDllName = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($Module.FullDllName.Buffer) -StructType ([String]) -UnicodeStringSize ($Module.FullDllName.MaximumLength)
- BaseDllName = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($Module.BaseDllName.Buffer) -StructType ([String]) -UnicodeStringSize ($Module.BaseDllName.MaximumLength)
- PackagedBinary = if(($Module.Flags -band 1) -eq 0){$False}else{$True}
- MarkedForRemoval = if(($Module.Flags -band 2) -eq 0){$False}else{$True}
- ImageDll = if(($Module.Flags -band 4) -eq 0){$False}else{$True}
- LoadNotificationsSent = if(($Module.Flags -band 8) -eq 0){$False}else{$True}
- TelemetryEntryProcessed = if(($Module.Flags -band 16) -eq 0){$False}else{$True}
- ProcessStaticImport = if(($Module.Flags -band 32) -eq 0){$False}else{$True}
- InLegacyLists = if(($Module.Flags -band 64) -eq 0){$False}else{$True}
- InIndexes = if(($Module.Flags -band 128) -eq 0){$False}else{$True}
- ShimDll = if(($Module.Flags -band 256) -eq 0){$False}else{$True}
- InExceptionTable = if(($Module.Flags -band 512) -eq 0){$False}else{$True}
- LoadInProgress = if(($Module.Flags -band 4096) -eq 0){$False}else{$True}
- EntryProcessed = if(($Module.Flags -band 16384) -eq 0){$False}else{$True}
- DontCallForThreads = if(($Module.Flags -band 262144) -eq 0){$False}else{$True}
- ProcessAttachCalled = if(($Module.Flags -band 524288) -eq 0){$False}else{$True}
- ProcessAttachFailed = if(($Module.Flags -band 1048576) -eq 0){$False}else{$True}
- CorDeferredValidate = if(($Module.Flags -band 2097152) -eq 0){$False}else{$True}
- CorImage = if(($Module.Flags -band 4194304) -eq 0){$False}else{$True}
- DontRelocate = if(($Module.Flags -band 8388608) -eq 0){$False}else{$True}
- CorILOnly = if(($Module.Flags -band 16777216) -eq 0){$False}else{$True}
- Redirected = if(($Module.Flags -band 268435456) -eq 0){$False}else{$True}
- CompatDatabaseProcessed = if(($Module.Flags -band 2147483648) -eq 0){$False}else{$True}
- ObsoleteLoadCount = $Module.ObsoleteLoadCount
- TlsIndex = $Module.TlsIndex
- HashLinks = $Module.HashLinks
- TimeDateStamp = (New-Object DateTime(1970, 1, 1, 0, 0, 0)).AddSeconds($Module.TimeDateStamp)
- EntryPointActivationContext = $Module.EntryPointActivationContext
- PatchInformation = $Module.PatchInformation
- DdagNode = $Module.DdagNode
- NodeModuleLink = $Module.NodeModuleLink
- SnapContext = $Module.SnapContext
- ParentDllBase = $Module.ParentDllBase
- SwitchBackContext = $Module.SwitchBackContext
- BaseAddressIndexNode = $Module.BaseAddressIndexNode
- MappingInfoIndexNode = $Module.MappingInfoIndexNode
- OriginalBase = $Module.OriginalBase
- LoadTime = $Module.LoadTime
- BaseNameHashValue = $Module.BaseNameHashValue
- LoadReason = $Module.LoadReason
- }
-
- $CustomModuleObject = New-Object PSObject -Property $ParsedOrderedModules[$i]
- $CustomModuleObject.PSObject.TypeNames[0] = 'PEB.ModuleEntry'
- $Modules[$i] = $CustomModuleObject
-
- $i++
- }
-
- switch ($j)
- {
- 1 { $CustomPEB['InLoadOrderModuleList'] = $Modules }
- 2 { $CustomPEB['InMemoryOrderModuleList'] = $Modules }
- 3 { $CustomPEB['InInitializationOrderModuleList'] = $Modules }
- }
- }
-
- if ($NTDDI_VERSION -ge $NTDDI_VISTA)
- {
- $CustomPEB['ImageUsesLargePages'] = if(($PEB.BitField -band 1) -eq 0){$False}else{$True}
- $CustomPEB['IsProtectedProcess'] = if(($PEB.BitField -band 2) -eq 0){$False}else{$True}
- $CustomPEB['IsLegacyProcess'] = if(($PEB.BitField -band 4) -eq 0){$False}else{$True}
- $CustomPEB['IsImageDynamicallyRelocated'] = if(($PEB.BitField -band 8) -eq 0){$False}else{$True}
- $CustomPEB['SkipPatchingUser32Forwarders'] = if(($PEB.BitField -band 16) -eq 0){$False}else{$True}
- $CustomPEB['IsPackagedProcess'] = if(($PEB.BitField -band 32) -eq 0){$False}else{$True}
- $CustomPEB['IsAppContainer'] = if(($PEB.BitField -band 64) -eq 0){$False}else{$True}
- $CustomPEB['AtlThunkSListPtr'] = $PEB.AtlThunkSListPtr
- $CustomPEB['IFEOKey'] = $PEB.IFEOKey
- $CustomPEB['ProcessInJob'] = if(($PEB.CrossProcessFlags -band 1) -eq 0){$False}else{$True}
- $CustomPEB['ProcessInitializing'] = if(($PEB.CrossProcessFlags -band 2) -eq 0){$False}else{$True}
- $CustomPEB['ProcessUsingVEH'] = if(($PEB.CrossProcessFlags -band 4) -eq 0){$False}else{$True}
- $CustomPEB['ProcessUsingVCH'] = if(($PEB.CrossProcessFlags -band 8) -eq 0){$False}else{$True}
- $CustomPEB['ProcessUsingFTH'] = if(($PEB.CrossProcessFlags -band 16) -eq 0){$False}else{$True}
- $CustomPEB['KernelCallbackTable'] = $PEB.KernelCallbackTable
- $CustomPEB['HotpatchInformation'] = $PEB.HotpatchInformation
- $CustomPEB['FlsCallback'] = $PEB.FlsCallback
- $CustomPEB['FlsListHead'] = $PEB.FlsListHead
- $CustomPEB['FlsBitmap'] = $PEB.FlsBitmap
- $CustomPEB['FlsBitmapBits'] = $PEB.FlsBitmapBits
- $CustomPEB['FlsHighIndex'] = $PEB.FlsHighIndex
- $CustomPEB['WerRegistrationData'] = $PEB.WerRegistrationData
- $CustomPEB['WerShipAssertPtr'] = $PEB.WerShipAssertPtr
- $CustomPEB['pUnused'] = $PEB.pUnused
- $CustomPEB['pImageHeaderHash'] = $PEB.pImageHeaderHash
- $CustomPEB['HeapTracingEnabled'] = if(($PEB.TracingFlags -band 1) -eq 0){$False}else{$True}
- $CustomPEB['CritSecTracingEnabled'] = if(($PEB.TracingFlags -band 2) -eq 0){$False}else{$True}
- $CustomPEB['LibLoaderTracingEnabled'] = if(($PEB.TracingFlags -band 4) -eq 0){$False}else{$True}
- $CustomPEB['CsrServerReadOnlySharedMemoryBase'] = $PEB.CsrServerReadOnlySharedMemoryBase
- }
- elseif ($NTDDI_VERSION -ge $NTDDI_WS03)
- {
- $CustomPEB['ImageUsesLargePages'] = if(($PEB.BitField -band 1) -eq 0){$False}else{$True}
- $CustomPEB['AtlThunkSListPtr'] = $PEB.AtlThunkSListPtr
- $CustomPEB['SparePtr2'] = $PEB.SparePtr2
- $CustomPEB['EnvironmentUpdateCount'] = $PEB.EnvironmentUpdateCount
- $CustomPEB['KernelCallbackTable'] = $PEB.KernelCallbackTable
- $CustomPEB['ReadOnlySharedMemoryHeap'] = $PEB.ReadOnlySharedMemoryHeap
- $CustomPEB['FlsCallback'] = $PEB.FlsCallback
- $CustomPEB['FlsListHead'] = $PEB.FlsListHead
- $CustomPEB['FlsBitmap'] = $PEB.FlsBitmap
- $CustomPEB['FlsBitmapBits'] = $PEB.FlsBitmapBits
- $CustomPEB['FlsHighIndex'] = $PEB.FlsHighIndex
- }
- else
- {
- $CustomPEB['FastPebLockRoutine'] = $PEB.FastPebLockRoutine
- $CustomPEB['FastPebUnlockRoutine'] = $PEB.FastPebUnlockRoutine
- $CustomPEB['EnvironmentUpdateCount'] = $PEB.EnvironmentUpdateCount
- $CustomPEB['KernelCallbackTable'] = $PEB.KernelCallbackTable
- $CustomPEB['ReadOnlySharedMemoryHeap'] = $PEB.ReadOnlySharedMemoryHeap
- }
-
- $NewPEB = New-Object PSObject -Property $CustomPEB
-
- # _PEB will be interpreted by PowerShell depending upon the detected OS. This only applies if Get-PEB.format.ps1xml was loaded
- if ($NTDDI_VERSION -ge $NTDDI_VISTA)
- {
- $NewPEB.PSObject.TypeNames[0] = 'PEB.Vista'
- }
- elseif ($NTDDI_VERSION -ge $NTDDI_WS03)
- {
- $NewPEB.PSObject.TypeNames[0] = 'PEB.Server2003'
- }
- else
- {
- $NewPEB.PSObject.TypeNames[0] = 'PEB.XP'
- }
-
- $Handle = $null
-
- Write-Output $NewPEB
- }
- }
- }
-
- END{}
-
-}
|