In this article, I will show how to walk the Process Environment Block (PEB) to resolve API functions dynamically, avoiding static imports that can be analyzed to identify the functions used by the PE. I will use Rust, and I recommend using #![no_std] and #![no_main] to produce a cleaner binary. For more details, check my tutorial: How to Build Minimal Windows PE Files in Rust.

NOTE
The Process Environment Block (PEB) is a data structure allocated for each process by the Windows kernel to provide user-mode access to various process attributes, such as BeingDebugged, ImageBaseAddress, and the list of loaded modules. [1]

PEB#

The official documentation does not tell much about the data present in the PEB, so I used WinDbg to parse the structure with more details. Open WinDbg and attach to or execute any process, then execute the command dt _PEB to show the complete structure fields. To view the data, you need to pass the virtual address of the start of the PEB, which can be found in the first line of the output when executing !peb. After that, run dt _PEB <addr>, like below:

peb_windbg

Ldr is what we looking for, it have a pointer to struct _PEB_LDR_DATA that have InMemoryOrderModuleList a linked-list to loaded modules [2]. Now, define the PEB structure in code, define padding to skip unimportant fields, and retrieve the Ldr pointer:

1
#[repr(C)]
2
struct PEB {
3
    _pad: [u8; 0x18],
4
    ldr: *const PEB_LDR_DATA,
5
}

PEB_LDR_DATA#

When debugging PEB_LDR_DATA, we can find the offset of InMemoryOrderModuleList, as shown below:

peb_ldr_data_windbg

InMemoryOrderModuleList
The head of a doubly-linked list that contains the loaded modules for the process. Each item in the list is a pointer to an LDR_DATA_TABLE_ENTRY structure.

Now, define the structure:

1
#[repr(C)]
2
struct PEB_LDR_DATA {
3
    _pad: [u8; 0x20],
4
    in_memory_order_module_list: LIST_ENTRY,
5
}

LIST_ENTRY#

list_entry_windbg

In practice, in this context, Flink and Blink are pointers inside the LIST_ENTRY structure used as InMemoryOrderLinks in LDR_DATA_TABLE_ENTRY. They point to the next and previous LIST_ENTRY entries in the circular doubly linked list of loaded modules.[3] This will make more sense when we look at LDR_DATA_TABLE_ENTRY next.

Define the structure:

1
#[repr(C)]
2
struct LIST_ENTRY {
3
    flink: *const LIST_ENTRY,
4
    blink: *const LIST_ENTRY,
5
}

LDR_DATA_TABLE_ENTRY#

LDR_DATA_TABLE_ENTRY is a data structure that contains metadata about each module loaded in the process[1]:

ldr_data_table_entry_windbg1

Recapping: when accessing InMemoryOrderModuleList from PEB_LDR_DATA, we are working with a doubly linked list that points to the InMemoryOrderLinks field of LDR_DATA_TABLE_ENTRY.

Therefore, to access the full structure, we need to adjust the pointer to match the start of the struct. Since InMemoryOrderLinks has an offset of 0x10, we can subtract 0x10 from the Flink or Blink pointer to obtain the base address of LDR_DATA_TABLE_ENTRY:

ldr_data_table_entry_windbg2

As you can see, the first module in the list is the main executable itself. Note that the DllBase matches the ImageBaseAddress from the PEB structure. Following the Flink pointer twice, we get:

ldr_data_table_entry_windbg3

Now, we have the base address of Kernel32.dll in the process (DllBase). This is important, as in the next steps we will iterate its export table to locate any function we need.

Define the structures, base_dll_name will be used to locate the Kernel32.dll:

1
#[repr(C)]
2
pub struct UNICODE_STRING {
3
    pub length: u16,
4
    pub maximum_length: u16,
5
    pub buffer: *mut u16,
6
}
7

8
#[repr(C)]
9
struct LDR_DATA_TABLE_ENTRY {
10
    _pad1: [u8; 0x30],
11
    dll_base: *const c_void,
12
    _pad2: [u8; 0x20],
13
    base_dll_name: UNICODE_STRING,
14
}

fn get_base_module(dll_name: &[u8])#

With the knownledge, I write that function of proof of concept:


13 collapsed lines
1
use core::ffi::c_void;
2
use core::arch::asm;
3

4
fn get_peb() -> *const PEB {
5
    unsafe{
6
        let peb;
7
        asm!("mov {}, gs:[0x60]", out(reg) peb);
8
        peb
9
    }
10
}
11

12
const IN_MEMORY_ORDER_LINKS_OFFSET: usize = 0x10;
13

14
fn get_base_module(dll_name: &[u8]) -> Option<*const c_void> {
15
    unsafe {
16
        let peb = get_peb();
17
        let ldr = (*peb).ldr;
18

19
        if ldr.is_null() {
20
            return None;
21
        }
22

23
        let head = &(*ldr).in_memory_order_module_list as *const LIST_ENTRY;
24
        let mut current = (*head).flink;
25

26
        while current != head {
27
            let entry = (current as usize - IN_MEMORY_ORDER_LINKS_OFFSET) as *const LDR_DATA_TABLE_ENTRY;
28

29
            let base_name = &(*entry).base_dll_name;
30

31
            if cmp_utf16_ascii_case_insensitive(
32
                base_name.buffer,
33
                (base_name.length / 2) as usize,
34
                dll_name,
35
            ) {
36
                return Some((*entry).dll_base);
37
            }
38

39
            current = (*current).flink;
40
        }
41

42
        None
43
    }
44
}
37 collapsed lines
45

46
fn cmp_utf16_ascii_case_insensitive(
47
    buf: *const u16,
48
    len: usize,
49
    ascii: &[u8],
50
) -> bool {
51
    if len != ascii.len() {
52
        return false;
53
    }
54

55
    let mut i = 0;
56

57
    while i < len {
58
        let c1 = unsafe { *buf.add(i) as u8 };
59
        let c2 = ascii[i];
60

61
        let c1 = if c1 >= b'a' && c1 <= b'z' {
62
            c1 - 32
63
        } else {
64
            c1
65
        };
66

67
        let c2 = if c2 >= b'a' && c2 <= b'z' {
68
            c2 - 32
69
        } else {
70
            c2
71
        };
72

73
        if c1 != c2 {
74
            return false;
75
        }
76

77
        i += 1;
78
    }
79

80
    true
81
}

Example:

1
let kernel32_base = match get_base_module(b"KERNEL32.DLL") {
2
    Some(addr) => addr,
3
    None => return 1,
4
};

Kernel32.dll#

Known DLLs
Windows keeps some important DLLs loaded by default in most processes. These are known as Known DLLs: “If the DLL is on the list of known DLLs for the version of Windows on which the application is running, then the system uses its copy of the known DLL (and the known DLL’s dependent DLLs, if any).” [4].

Now that we have the base address of Kernel32.dll, we need to traverse its export table to resolve the addresses of the functions we want to use. This requires parsing several PE headers, as shown below.

IMAGE_DOS_HEADER#

That struct start in the begining of the module address, the field important here is e_lfanew, which point to IMAGE_NT_HEADERS64. Define:

1
#[repr(C)]
2
struct IMAGE_DOS_HEADER {
3
    _pad: [u8; 0x3c],
4
    e_lfanew: i32,
5
}

IMAGE_NT_HEADERS64#

We continue navigating, now the important field is OptionalHeader:

1
#[repr(C)]
2
struct IMAGE_NT_HEADERS64 {
3
    _pad: [u8; 0x18],
4
    optional: IMAGE_OPTIONAL_HEADER64,
5
}

IMAGE_OPTIONAL_HEADER64#

Finally, we arrive at the export table, which is referenced in the DataDirectory, an array of IMAGE_DATA_DIRECTORY:

optional_header_windbg

Since the export table is the first entry [5], we can simply:

1
#[repr(C)]
2
struct IMAGE_OPTIONAL_HEADER64 {
3
    _pad: [u8; 0x70],
4
    export: IMAGE_DATA_DIRECTORY,
5
}

IMAGE_DATA_DIRECTORY#

This structure gives us the relative address of IMAGE_EXPORT_DIRECTORY, which can be obtained by adding dll_base and virtual_address:

1
#[repr(C)]
2
struct IMAGE_DATA_DIRECTORY {
3
    virtual_address: u32,
4
    size: u32,
5
}

IMAGE_EXPORT_DIRECTORY#

We are almost there, we just need to understand a few details about the structure.

Basically, address_of_names is a contiguous region in memory containing 32-bit relative pointers (RVAs) to the ASCII names of each exported function. The idea is to iterate through these entries: for each 32-bit pointer, compute the actual address by adding it to dll_base. If the name does not match the target, move to the next entry and continue.

Once a match is found, keep its index and use it to access the corresponding entry in address_of_name_ordinals, which then allows retrieving the correct function address from address_of_functions.

1
#[repr(C)]
2
struct IMAGE_EXPORT_DIRECTORY {
3
    _pad: [u8; 0x18],
4
    number_of_names: u32,
5
    address_of_functions: u32,
6
    address_of_names: u32,
7
    address_of_name_ordinals: u32,
8
}

fn get_proc_by_name()#

With this function, it is possible to find any function/procedure from any DLL base address.

1
fn get_proc_by_name(base: *const c_void, target: &[u8]) -> *const c_void {
2
    unsafe{
3
        let base = base as usize;
4

5
        let dos = base as *const IMAGE_DOS_HEADER;
6
        let nt = (base + (*dos).e_lfanew as usize) as *const IMAGE_NT_HEADERS64;
7

8
        let export_dir =
9
            (base + (*nt).optional.export.virtual_address as usize)
10
                as *const IMAGE_EXPORT_DIRECTORY;
11

12
        let names = (base + (*export_dir).address_of_names as usize) as *const u32;
13
        let funcs = (base + (*export_dir).address_of_functions as usize) as *const u32;
14
        let ords = (base + (*export_dir).address_of_name_ordinals as usize) as *const u16;
15

16
        for i in 0..(*export_dir).number_of_names {
17
            let name_rva = *names.add(i as usize);
18
            let name_ptr = (base + name_rva as usize) as *const u8;
19

20
            if strcmp(name_ptr, target.as_ptr()) {
21
                let ord = *ords.add(i as usize) as usize;
22
                let func_rva = *funcs.add(ord);
23

24
                return (base + func_rva as usize) as *const c_void;
25
            }
26
        }
27

28
        core::ptr::null_mut()
29
    }
30
}
21 collapsed lines
31

32
fn strcmp(a: *const u8, b: *const u8) -> bool {
33
    unsafe{
34
        let mut i = 0;
35

36
        loop {
37
            let c1 = *a.add(i);
38
            let c2 = *b.add(i);
39

40
            if c1 != c2 {
41
                return false;
42
            }
43

44
            if c1 == 0 {
45
                return true;
46
            }
47

48
            i += 1;
49
        }
50
    }
51
}

main#

So, use LoadLibraryA to load user32.dll to display MessageBox:

1
#[unsafe(no_mangle)]
2
pub extern "C" fn main() -> i32 {
3
    unsafe {
4
        let k32 = match get_base_module(b"KERNEL32.DLL") {
5
            Some(addr) => addr,
6
            None => return 1
7
        };
8

9
        let loadlib_addr = get_proc_by_name(k32, b"LoadLibraryA\0");
10

11
        type LoadLibraryAT =
12
            unsafe extern "system" fn(*const u8) -> *mut c_void;
13

14
        let load_library: LoadLibraryAT = core::mem::transmute(loadlib_addr);
15

16
        load_library(b"user32.dll\0".as_ptr());
17

18
        let user32 = match get_base_module(b"USER32.DLL") {
19
            Some(addr) => addr,
20
            None => return 1
21
        };
22

23
        let msgbox_addr =
24
            get_proc_by_name(user32, b"MessageBoxA\0");
25

26
        type MessageBoxAT = unsafe extern "system" fn(
27
            *mut c_void,
28
            *const u8,
29
            *const u8,
30
            u32,
31
        ) -> i32;
32

33
        let message_box: MessageBoxAT = core::mem::transmute(msgbox_addr);
34

35
        let text = b"text!\0";
36
        let title = b"title\0";
37

38
        message_box(
39
            core::ptr::null_mut(),
40
            text.as_ptr(),
41
            title.as_ptr(),
42
            0,
43
        );
44
    }
45

46
    0
47
}

Source code#

Check out the full code in my GitHub repository.

Article source:#

matheus-git

spitfire

Waiting for api.github.com...

00K

Waiting...