Change PEB Name

posted 9 Dec 2010, 14:45 by Delphi Basics
This snippet details how to spoof the PEB name of your process in the LDR module list. 

Author: SF6 
Modded by: steve10120 

procedure ChangePebName(szPath:PWideChar);
//SF6 & steve10120
var
  pPEB:       Pointer;
  dwLen:      DWORD;
  pLdrModule: Pointer;
begin
  asm
    MOV EAX, FS:[$30]
    MOV pPEB, EAX
  end;
  dwLen := lstrlenW(szPath) * 2;
  pLdrModule := Pointer(PDWORD(DWORD(pPEB) + $C)^);
  pLdrModule := Pointer(PDWORD(DWORD(pLdrModule) + $C)^);
  PDWORD(DWORD(pLdrModule) + $24)^ := dwLen;
  PDWORD(DWORD(pLdrModule) + $28)^ := DWORD(szPath);
end;
Comments