获取Kernel32.dll基址

#include <windows.h>

int main()
{
    DWORD dwKernel32 = 0;
    _asm
    {
        mov eax, fs:[0x30]      // peb
        mov eax, [eax+0x0C]     // ldr
        mov eax, [eax+0x1C]     // Module List

    _loop:
        mov esi, [eax+0x08]     // DllBase
        mov ebx, [eax+0x20]     // UNICODE_STRING.Buffer
        mov eax, [eax]          // Next ListEntry
        cmp dword ptr [ebx+0x0C], 0x00320033
        jnz _loop
        mov dwKernel32, esi
    }
　　return 0;
}

 

x64：

GetKernel32 proc
    sub rsp, 100h

    mov rax, gs:[60h]       ; PEB
    mov rax, [rax+18h]    ; Ldr
    mov rax, [rax+30h]    ; InInitializationOrderModuleList

_kernel32:
    mov rsi, [rax+10h]    ; DllBase
    mov rbx, [rax+40h]    ; BaseDllName
    mov rax, [rax]
    cmp dword ptr [rbx+0Ch], 00320033h
    jnz _kernel32

    add rsp, 100h
    ret
GetKernel32 endp