mov ebx,fs:[0x18] ; get self pointer from TEB
mov eax,fs:[0x30] ; get pointer to PEB / database
mov [eax + 2], 0; being debugged
typedef struct _PEB { // Size: 0x1D8
/000/ UCHAR InheritedAddressSpace;
/001/ UCHAR ReadImageFileExecOptions;
/002/ UCHAR BeingDebugged;
/003/ UCHAR SpareBool; // Allocation size
/004/ HANDLE Mutant;
/008/ HINSTANCE ImageBaseAddress; // Instance
/00C/ VOID DllList;
/010/ PPROCESS_PARAMETERS ProcessParameters;
/014/ ULONG SubSystemData;
/018/ HANDLE DefaultHeap;
/01C/ KSPIN_LOCK FastPebLock;
/020/ ULONG FastPebLockRoutine;
/024/ ULONG FastPebUnlockRoutine;
/028/ ULONG EnvironmentUpdateCount;
/02C/ ULONG KernelCallbackTable;
/030/ LARGE_INTEGER SystemReserved;
/038/ ULONG FreeList;
/03C/ ULONG TlsExpansionCounter;
/040/ ULONG TlsBitmap;
/044/ LARGE_INTEGER TlsBitmapBits;
/04C/ ULONG ReadOnlySharedMemoryBase;
/050/ ULONG ReadOnlySharedMemoryHeap;
/054/ ULONG ReadOnlyStaticServerData;
/058/ ULONG AnsiCodePageData;
/05C/ ULONG OemCodePageData;
/060/ ULONG UnicodeCaseTableData;
/064/ ULONG NumberOfProcessors;
/068/ LARGE_INTEGER NtGlobalFlag; // Address of a local copy
/070/ LARGE_INTEGER CriticalSectionTimeout;
/078/ ULONG HeapSegmentReserve;
/07C/ ULONG HeapSegmentCommit;
/080/ ULONG HeapDeCommitTotalFreeThreshold;
/084/ ULONG HeapDeCommitFreeBlockThreshold;
/088/ ULONG NumberOfHeaps;
/08C/ ULONG MaximumNumberOfHeaps;
/090/ ULONG ProcessHeaps;
/094/ ULONG GdiSharedHandleTable;
/098/ ULONG ProcessStarterHelper;
/09C/ ULONG GdiDCAttributeList;
/0A0/ KSPIN_LOCK LoaderLock;
/0A4/ ULONG OSMajorVersion;
/0A8/ ULONG OSMinorVersion;
/0AC/ USHORT OSBuildNumber;
/0AE/ USHORT OSCSDVersion;
/0B0/ ULONG OSPlatformId;
/0B4/ ULONG ImageSubsystem;
/0B8/ ULONG ImageSubsystemMajorVersion;
/0BC/ ULONG ImageSubsystemMinorVersion;
/0C0/ ULONG ImageProcessAffinityMask;
/0C4/ ULONG GdiHandleBuffer[0x22];
/14C/ ULONG PostProcessInitRoutine;
/150/ ULONG TlsExpansionBitmap;
/154/ UCHAR TlsExpansionBitmapBits[0x80];
/1D4/ ULONG SessionId;
} PEB, PPEB;
以上就是关于Icesword 使用说明书全部的内容,包括:Icesword 使用说明书、冰刃怎么用啊 全是英文看不懂、mov eax,fs:[0x00000018]是什么意思等相关内容解答,如果想了解更多相关内容,可以关注我们,你们的支持是我们更新的动力!
欢迎分享,转载请注明来源:内存溢出
评论列表(0条)