Close Topic Options

i have seen tut by icelzion for validating pe, i know i can retrieve the image base of exe file or dll file with the help of that method, but is there any other way to do the same thing. i mean short method to get the image base of exe or dll file. please share if you know.

It gives many ways to get the imagebase

1.via File Map (like Izelions tut)
2.with Module32First and ModuleEntry32.modBaseAddr
3.with ReadFile
4.Peb and Teb
...
..
.

Well, to get the imagebase im using:

Push 0
Call GetModuleHandle

From own process
But this question was "retrieve the image base of exe file or dll file"

Greets,

from first instruction assuming win 7 x64
MOV EAX,DWORD PTR DS:[EBX+8]

or

DB 064h,0A1h,018h,000h,000h,000h ; = mov eax,dword ptr fs:[18] open PEB structure
mov eax,dword ptr ds:[eax+030h]
mov eax,dword ptr ds:[eax+08h] ; get module imagebase address