Skip to content

Instantly share code, notes, and snippets.

@gavz

gavz/working_set_peb_search.cpp

Forked from daaximus/working_set_peb_search.cpp
Created May 4, 2025 02:24
Show Gist options
  • Save gavz/8403a15970f8283e614352b6130b17fd to your computer and use it in GitHub Desktop.
Save gavz/8403a15970f8283e614352b6130b17fd to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @daaximus daaximus revised this gist May 4, 2025. 1 changed file with 0 additions and 3 deletions.
    3 changes: 0 additions & 3 deletions working_set_peb_search.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -1,7 +1,4 @@
    // author: daax
    // "undetected" peb walk
    // maldev get peb undetected
    // malware development undetected peb walk

    // 0x4a65 = 19045 (windows version)
    int main()
  2. @daaximus daaximus revised this gist May 3, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion working_set_peb_search.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    // created by daax
    // author: daax
    // "undetected" peb walk
    // maldev get peb undetected
    // malware development undetected peb walk
  3. @daaximus daaximus revised this gist May 3, 2025. 1 changed file with 1 addition and 3 deletions.
    4 changes: 1 addition & 3 deletions working_set_peb_search.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -47,6 +47,4 @@ int main()
    }
    free( wsi );
    return 0;
    }

    // if you paid for this in some maldev course you got scammed :^) this is obviously a meme (that works)
    }
  4. @daaximus daaximus revised this gist May 2, 2025. 1 changed file with 7 additions and 3 deletions.
    10 changes: 7 additions & 3 deletions working_set_peb_search.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,7 @@
    // created by daax - 5.2.2025
    // if you paid for this in some maldev course you got scammed :^)
    // created by daax
    // "undetected" peb walk
    // maldev get peb undetected
    // malware development undetected peb walk

    // 0x4a65 = 19045 (windows version)
    int main()
    @@ -45,4 +47,6 @@ int main()
    }
    free( wsi );
    return 0;
    }
    }

    // if you paid for this in some maldev course you got scammed :^) this is obviously a meme (that works)
  5. @daaximus daaximus revised this gist May 2, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion working_set_peb_search.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    // created by daax - 5.2.2025
    // always google curriculums of courses before they make you pay :^) it's free
    // if you paid for this in some maldev course you got scammed :^)

    // 0x4a65 = 19045 (windows version)
    int main()
  6. @daaximus daaximus revised this gist May 2, 2025. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions working_set_peb_search.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,7 @@
    // created by daax - 5.2.2025
    // always google curriculums of courses before they make you pay :^) it's free

    // 0x4a65 = 19045 (windows version)
    int main()
    {
    PSAPI_WORKING_SET_INFORMATION* w = ( PSAPI_WORKING_SET_INFORMATION* ) malloc( 1 << 20 );
  7. @daaximus daaximus created this gist May 2, 2025.
    47 changes: 47 additions & 0 deletions working_set_peb_search.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,47 @@
    // created by daax - 5.2.2025
    // always google curriculums of courses before they make you pay :^) it's free

    int main()
    {
    PSAPI_WORKING_SET_INFORMATION* w = ( PSAPI_WORKING_SET_INFORMATION* ) malloc( 1 << 20 );
    QueryWorkingSet( GetCurrentProcess(), w, 1 << 20 );
    for ( u32 i = 0; i < w->NumberOfEntries; i++ )
    if ( ( w->WorkingSetInfo[ i ].Flags & 31 ) == 4 )
    for ( u8* p = ( u8* ) ( ( w->WorkingSetInfo[ i ].Flags >> 12 ) << 12 ),
    *e = p + 4094; p < e && !( *( u16* ) p == 0x4A65 &&
    printf( "%p\n%S\n", ( PPEB ) ( p - 0x120 ),
    *( PWSTR* ) ( ( u8* ) ( *( u64* ) ( ( p - 0x120 ) + 0x20 ) ) + 0xc0 + 0x8 ) ) );
    p++ );
    return free( w ), 0;
    }

    #define READWRITE 4
    int main()
    {
    PSAPI_WORKING_SET_INFORMATION* wsi = ( PSAPI_WORKING_SET_INFORMATION * )malloc( 1<<20 );
    QueryWorkingSet( GetCurrentProcess(), wsi, 1<<20 );

    for ( ULONG_PTR i = 0; i < wsi->NumberOfEntries; i++ )
    {
    ULONG_PTR flags = wsi->WorkingSetInfo[ i ].Flags;
    if ( ( flags & 0x1F ) == READWRITE )
    {
    unsigned char* addr = ( unsigned char* ) ( ( flags >> 12 ) << 12 );
    unsigned char* end = addr + 4094;

    while ( addr < end )
    {
    if ( *( uint16_t* ) addr == 0x4A65 )
    {
    PPEB peb = ( PPEB ) ( ( ULONG_PTR ) addr - 0x120 );
    printf( "%p\n%S\n", peb, peb->ProcessParameters->DesktopInfo.Buffer );
    free( wsi );
    return 0;
    }
    addr++;
    }
    }
    }
    free( wsi );
    return 0;
    }