I've just started programming in C, so I'm not a pro at all, so please excuse my (probably) not so good code, but I'm struggling to find the cause of this problem. The output of this code in VS studio code is currently:
Handle Process: 00000000000000c4
Imagebase:00007ff658520000
For some reason in Visual Studio only the Handle and not the imagebase is displayed, but in VS studio code both values are present.. but never mind.
When I load the PE file in x64 dbg and look at the imagebase in memory, it corresponds with this imagebase (it doesn't match with the imagebase on disk, but that's because ASLR has been applied), so far so good. However, I try to localise the IAT, but for some reason it doesn't seem to work(and it doesn't work with notepad.exe either, maybe because of permissions?).
I'm referring to this part
if (dosHeaders->e_magic == IMAGE_DOS_SIGNATURE) {
printf("%s", dosHeaders->e_magic);}printf("error");}
I have tried many variations (like == NULL etc.), also with the NtHeaders, but it does not provide me anything, neither e_magic nor the string "error"). I don't get an error message but it keeps outputting only the handle to the process and the imagebase. Can someone explain why this is the case?
#include <windows.h>
#include <stdio.h>
#include <winternl.h>
#include <psapi.h>
#include <string.h>
int i;
typedef int(WINAPI* Func_Pointer)(HWND, LPCTSTR, LPCTSTR, UINT);
HMODULE array_modules[1024];
DWORD number_bytes;
TCHAR BUFFER[1024];
int main() {
HANDLE Handle_Process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 11596);
if (Handle_Process == NULL) {
DWORD error = GetLastError();
printf("Handle not retrieved %s", error);
return 1;
}
else {
printf("Handle Process: %p", Handle_Process);
if (EnumProcessModules(Handle_Process, array_modules, sizeof(array_modules), &number_bytes) == 0) {
printf("\n%s", "No Modules");
}
else {
for (i = 0; i < (number_bytes / sizeof(HMODULE)); i++) {
DWORD Module_LEN_string = GetModuleFileNameEx(Handle_Process, array_modules[i], BUFFER, 1024);
// printf("%s\n", BUFFER);
void* ImageBase = NULL;
if (strstr(BUFFER, "OneDrive.exe") != NULL) {
ImageBase = array_modules[i];
printf("\n""Imagebase:""%p", ImageBase);
PIMAGE_DOS_HEADER dosHeaders = (PIMAGE_DOS_HEADER)ImageBase;
if (dosHeaders->e_magic == IMAGE_DOS_SIGNATURE) {
printf("%s", dosHeaders->e_magic);
}
printf("error");
PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)ImageBase + dosHeaders->e_lfanew);
//PIMAGE_IMPORT_DESCRIPTOR ImportsDirectory = NULL;
IMAGE_DATA_DIRECTORY ImportsDirectory = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
if (ntHeaders != NULL) {
printf("%08X", ntHeaders->Signature);
}
else { printf("NT Header not found"); }
}
}
}
}
}