mov eax, fs:[18] mov eax, [eax+30] // NOW eax point to the PEB
mov ecx, [eax+0x90] // List of Heaps mov edx, [eax+0x88] // Number of heaps
(FARPROC) nqip = GetProcAddress(ntdll,"NtQueryInformationProcess"); nqip(hp, 0, &info, sizeof(PROCESS_BASIC_INFORMATION), &retlen); // On the info structure, you grab the PEB like info.PebBaseAddress
Microsoft (R) Windows Debugger Version 6.7.0005.0 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\ProcHeapViewer.exe.mdmp] User Mini Dump File: Only registers, stack and portions of memory are available Symbol search path is: srv*d:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows XP Version 2600 (Service Pack 1) UP Free x86 compatible Product: WinNt, suite: SingleUserTS Debug session time: Thu Sep 13 15:47:38.000 2007 (GMT+5) System Uptime: not available Process Uptime: 0 days 0:00:20.000 ............... This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (c94.c98): Application hang - code cfffffff (first/second chance not available) eax=0012dad8 ebx=00000000 ecx=00000060 edx=00000000 esi=00980000 edi=00000000 eip=7ffe0304 esp=0012da64 ebp=0012dac8 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202 SharedUserData!SystemCallStub+0x4: 7ffe0304 c3 ret 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** ERROR: Module load completed but symbols could not be loaded for ProcHeapViewer.exe FAULTING_IP: SharedUserData!SystemCallStub+4 7ffe0304 c3 ret EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 7ffe0304 (SharedUserData!SystemCallStub+0x00000004) ExceptionCode: cfffffff (Application hang) ExceptionFlags: 00000000 NumberParameters: 0 BUGCHECK_STR: HANG DEFAULT_BUCKET_ID: APPLICATION_HANG PROCESS_NAME: ProcHeapViewer.exe ERROR_CODE: (NTSTATUS) 0xcfffffff - <Unable to get error code text> DERIVED_WAIT_CHAIN: Dl Eid Cid WaitType -- --- ------- -------------------------- 0 c94.c98 Unknown WAIT_CHAIN_COMMAND: ~0s;k;; UNRESPONSIVE_UI_THREAD: 00000c98 UNRESPONSIVE_UI_PROBLEM_CLASS: UI_HANG BLOCKING_THREAD: 00000c98 PRIMARY_PROBLEM_CLASS: APPLICATION_HANG LAST_CONTROL_TRANSFER: from 77f7671a to 7ffe0304 UNRESPONSIVE_UI_SYMBOL_NAME: ProcHeapViewer UNRESPONSIVE_UI_FOLLOWUP_NAME: MachineOwner FAULTING_THREAD: 00000c98 STACK_TEXT: 0012da60 77f7671a 77f7f417 00000068 00000001 SharedUserData!SystemCallStub+0x4 0012da64 77f7f417 00000068 00000001 00000000 ntdll!NtWaitForSingleObject+0xc 0012dac8 004029c2 00000060 00000014 00000068 ntdll!RtlQueryProcessDebugInformation+0x15a WARNING: Stack unwind information not available. Following frames may be wrong. 0012f7a0 00000000 00000000 00000000 00000000 ProcHeapViewer+0x29c2 FOLLOWUP_IP: ProcHeapViewer+29c2 004029c2 85c0 test eax,eax SYMBOL_STACK_INDEX: 3 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ProcHeapViewer IMAGE_NAME: ProcHeapViewer.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4654e7e2 SYMBOL_NAME: ProcHeapViewer+29c2 STACK_COMMAND: ~0s ; kb FAILURE_BUCKET_ID: HANG_ProcHeapViewer+29c2 BUCKET_ID: HANG_ProcHeapViewer+29c2 Followup: MachineOwner ---------
0:000> ub 004029c2 ProcHeapViewer+0x29a8: 004029a8 33c0 xor eax,eax 004029aa e9ab010000 jmp ProcHeapViewer+0x2b5a (00402b5a) 004029af 8bb424b0130000 mov esi,dword ptr [esp+13B0h] 004029b6 8b8d5c070000 mov ecx,dword ptr [ebp+75Ch] 004029bc 53 push ebx 004029bd 6a14 push 14h 004029bf 56 push esi 004029c0 ffd1 call ecx <------- 0:000> u 004029c2 ProcHeapViewer+0x29c2: 004029c2 85c0 test eax,eax 004029c4 7442 je ProcHeapViewer+0x2a08 (00402a08) 004029c6 8b955c070000 mov edx,dword ptr [ebp+75Ch] 004029cc 53 push ebx 004029cd 6a04 push 4 004029cf 56 push esi 004029d0 ffd2 call edx 004029d2 85c0 test eax,eax
There are 31,328 total registered users.
[+] expand
Printer Friendly ...
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}