Windows Sürüm

#define WINDOWS_1803 17134
#define WINDOWS_1809 17763
#define WINDOWS_1903 18362
#define WINDOWS_1909 18363
#define WINDOWS_2004 19041
#define WINDOWS_20H2 19569
#define WINDOWS_21H1 20180
 
DWORD GetUserDirectoryTableBaseOffset()
{
    RTL_OSVERSIONINFOW ver = { 0 };
    RtlGetVersion(&ver);
 
    switch (ver.dwBuildNumber)
    {
    case WINDOWS_1803:
        return 0x0278;
        break;
    case WINDOWS_1809:
        return 0x0278;
        break;
    case WINDOWS_1903:
        return 0x0280;
        break;
    case WINDOWS_1909:
        return 0x0280;
        break;
    case WINDOWS_2004:
        return 0x0388;
        break;
    case WINDOWS_20H2:
        return 0x0388;
        break;
    case WINDOWS_21H1:
        return 0x0388;
        break;
    default:
        return 0x0388;
    }
}

#include <Windows.h>
#include <iostream>
#include <ntstatus.h>
#include <winternl.h>

typedef NTSTATUS(NTAPI* pfnNtQueryInformationProcess)(
    IN HANDLE ProcessHandle,
    IN PROCESSINFOCLASS ProcessInformationClass,
    OUT PVOID ProcessInformation,
    IN ULONG ProcessInformationLength,
    OUT PULONG ReturnLength OPTIONAL
    );

int main()
{
    HMODULE hNtdll = LoadLibraryA("ntdll.dll");
    if (hNtdll == NULL)
    {
        std::cout << "Error loading ntdll.dll" << std::endl;
        return 1;
    }

    // Get address of NtQueryInformationProcess function
    pfnNtQueryInformationProcess NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(hNtdll, "NtQueryInformationProcess");

    if (NtQueryInformationProcess == NULL)
    {
        std::cout << "Error finding NtQueryInformationProcess function" << std::endl;
        return 1;
    }

    // Get handle to current process
    HANDLE hProcess = GetCurrentProcess();

    // Define variables for process information
    PROCESS_BASIC_INFORMATION pbi;
    ULONG ulRetLen = 0;

    // Call NtQueryInformationProcess to get process information
    NTSTATUS status = NtQueryInformationProcess(
        hProcess,
        ProcessBasicInformation,
        &pbi,
        sizeof(PROCESS_BASIC_INFORMATION),
        &ulRetLen
    );

    if (!NT_SUCCESS(status))
    {
        std::cout << "Error calling NtQueryInformationProcess" << std::endl;
        return 1;
    }

    // Get PEB address from process information
    PVOID PebBaseAddress = pbi.PebBaseAddress;
    DWORD UserDirTableBaseOffset = *(DWORD*)((PBYTE)PebBaseAddress + 0x68);
    std::cout << "User Directory Table Base Offset: 0x" << std::hex << UserDirTableBaseOffset << std::endl;
    return 0;
}

HMODULE hNtdll = LoadLibraryA("ntdll.dll");
    if (hNtdll == NULL)
    {
        std::cout << "Error loading ntdll.dll" << std::endl;
        return 1;
    }

    // Get address of NtQueryInformationProcess function
    pfnNtQueryInformationProcess NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(hNtdll, "NtQueryInformationProcess");

    if (NtQueryInformationProcess == NULL)
    {
        std::cout << "Error finding NtQueryInformationProcess function" << std::endl;
        return 1;
    }