Thread: Read registers in memory
View Single Post
  #5  
Old 09-26-2014, 17:39
Carbon Carbon is offline
VIP
  
Join Date: Sep 2013
Posts: 113
Rept. Given: 7
Rept. Rcvd 189 Times in 48 Posts
Thanks Given: 0
Thanks Rcvd at 60 Times in 19 Posts
Carbon Reputation: 100-199 Carbon Reputation: 100-199
Quote:
Originally Posted by anon_c View Post
ReadProcessMemory(PI.hProcess, pointer(Context.Ebx + 8), @BaseAddress,
EBX -> PEB

+ sizeof(void*)*2

== PEB->ImageBase
__________________
My blog: https://ntquery.wordpress.com
Reply With Quote
The Following 2 Users Say Thank You to Carbon For This Useful Post:
anon_c (09-15-2015), niculaita (06-30-2021)