Skip to content

Commit

Permalink
[REFACT] Verified read PEB size
Browse files Browse the repository at this point in the history
  • Loading branch information
hasherezade committed Aug 23, 2024
1 parent bda723b commit eeed2da
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions AntiDebug.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -478,15 +478,15 @@ BOOL getPEB(CONTEXT* ctxt, ADDRINT& pebAddr)
PIN_GetContextRegval(ctxt, REG_SEG_GS_BASE, reinterpret_cast<UINT8*>(&gsValue));
gsValue += 0x60;
// Save PEB Address
if (PIN_SafeCopy(&pebAddr, reinterpret_cast<VOID*>(gsValue), sizeof(pebAddr)))is_ok = TRUE;
if (PIN_SafeCopy(&pebAddr, reinterpret_cast<VOID*>(gsValue), sizeof(pebAddr)) == sizeof(pebAddr)) is_ok = TRUE;
#else
// Read the value from the memory address pointed by FS:[30h] and save it in the global variable
ADDRINT fsValue;
PIN_GetContextRegval(ctxt, REG_SEG_FS_BASE, reinterpret_cast<UINT8*>(&fsValue));
fsValue += 0x30;

// Save PEB Address
if (PIN_SafeCopy(&pebAddr, reinterpret_cast<VOID*>(fsValue), sizeof(pebAddr))) is_ok = TRUE;
if (PIN_SafeCopy(&pebAddr, reinterpret_cast<VOID*>(fsValue), sizeof(pebAddr)) == sizeof(pebAddr)) is_ok = TRUE;
#endif
return is_ok;
}
Expand Down

0 comments on commit eeed2da

Please sign in to comment.