CODEWITHSUNDEEP
windowskerneldriverdumpportable-executable
maysam
maysam

Reputation: 519

find base address of current procrss in kernel space

hi i will dump the other process in kernel driver

and use KeStackAttachProcess to change driver current context

after user-mode address changed how can find base address of current process i need base address for cast it to PIMAGE_DOS_HEADER( and parse it to find sections) can use PEB?

any other solution?

Upvotes: 1

Views: 5596

Answers (1)

Sergey Podobry
Sergey Podobry

Reputation: 7189

There is a special API function for that:

NTKERNELAPI
PVOID
PsGetProcessSectionBaseAddress(
    __in PEPROCESS Process
    );

And you can use SectionBaseAddress field in the EPROCESS structure:

+0x128 SectionBaseAddress : 0x00400000 Void

It may vary in different OS versions.

Upvotes: 8

Related Questions