changePeb.cpp

#include <windows.h>
#include <winternl.h>
#include <stdio.h>
#include <string>
#include <iostream>

// Define the PROCESS_BASIC_INFORMATION structure


// Define the NtQueryInformationProcess function
typedef NTSTATUS(NTAPI* PNtQueryInformationProcess)(
    HANDLE ProcessHandle,
    PROCESSINFOCLASS ProcessInformationClass,
    PVOID ProcessInformation,
    ULONG ProcessInformationLength,
    PULONG ReturnLength
    );

int main() {

    wchar_t CommandLine[] = L"C:\\Windows\\system32\\explorer.exe";
    wchar_t CurrentDirectory[] = L"C:\\Windows\\explorer.exe";
    int result = SetCurrentDirectoryW(L"C:\\Windows\\");
    std::cout << result << std::endl;
    // Open the current process
    HANDLE hProcess = GetCurrentProcess();
    // Define a buffer to hold the information
    PROCESS_BASIC_INFORMATION pbi;

    // Load NtQueryInformationProcess dynamically
    HMODULE hNtDll = GetModuleHandle(L"ntdll.dll");
    PNtQueryInformationProcess pNtQueryInformationProcess =
        (PNtQueryInformationProcess)GetProcAddress(hNtDll, "NtQueryInformationProcess");

    // Call NtQueryInformationProcess to get the PEB address
    NTSTATUS status = pNtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);

    if (NT_SUCCESS(status)) {
        // Access PEB address from the structure
        PPEB pebAddress = pbi.PebBaseAddress;
        wprintf(L"PEB Address: %p\n", pebAddress);
        pbi.PebBaseAddress->ProcessParameters->CommandLine.Length = sizeof CommandLine;
        pbi.PebBaseAddress->ProcessParameters->CommandLine.Buffer = CommandLine;
        pbi.PebBaseAddress->ProcessParameters->ImagePathName.Length = sizeof(CurrentDirectory);
        pbi.PebBaseAddress->ProcessParameters->ImagePathName.Buffer = CurrentDirectory;

        UNICODE_STRING commandline = pbi.PebBaseAddress->ProcessParameters->CommandLine;
        wprintf(L"commandline: %s\n", commandline.Buffer);
        UNICODE_STRING ImagePathName = pbi.PebBaseAddress->ProcessParameters->ImagePathName;
        wprintf(L"ImagePathName: %s\n", ImagePathName.Buffer);

    }
    else {
        wprintf(L"Error: NtQueryInformationProcess failed with status 0x%X\n", status);
    }

    // Close the process handle
    CloseHandle(hProcess);

    return 0;
}