时间戳

首页 > 解决方案 > 32位进程在Windows10 x64系统上获取另一个32位进程的PEB失败

c++ - 32位进程在Windows10 x64系统上获取另一个32位进程的PEB失败

问题描述

代码：

STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };

WCHAR lpCmdline[] = L"ad.exe";
if (!CreateProcess(
    NULL,
    lpCmdline,
    NULL, NULL, TRUE,
    CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
    wprintf(L"Create process fail: %d\n", GetLastError());
    return -1;
}

PROCESS_BASIC_INFORMATION pbi = { 0 };
NtQueryInformationProcessFn pNtQueryInformationProcess = (NtQueryInformationProcessFn) \
    GetProcAddress(LoadLibrary(L"ntdll"), "NtQueryInformationProcess");

ULONG dwRead;
if (NT_ERROR(pNtQueryInformationProcess(
    pi.hProcess, ProcessBasicInformation,
    &pbi, sizeof pbi, &dwRead))) {
    wprintf(L"Call NtQueryInformationProcess error: %d\n", GetLastError());
    return -1;
}

PEB peb = { 0 };
SIZE_T stRead;
if (!ReadProcessMemory(pi.hProcess, pbi.PebBaseAddress, &peb, sizeof PEB, NULL)) {
    wprintf(L"Call ReadProcessMemory fail: %d\n", GetLastError());
    return -1;
}

return 0;

编译为 x86 二进制文件，ad.exe也是 x86 二进制文件。系统是Windows10 64位

PS C:\> .\t.exe
Call ReadProcessMemory fail: 6
PS C:\> file .\t.exe
.\t.exe: PE32 executable (console) Intel 80386, for MS Windows
PS C:\> file .\ad.exe
.\ad.exe: PE32 executable (console) Intel 80386, for MS Windows

标签： c++winapireadprocessmemorywow64

解决方案

推荐阅读