How to access user mode memory?

I'm trying to read the PEB of notepad.exe Currently I'm trying to access the PEB by registering a ProcessCreation callback and then waiting until notepad.exe is created. When notepad is created I use it's PID to open the process and find the PEB with ZwQuerryProcess(PROCESS_BASIC_INFORMATION).

But when I try to read beyond INFORMATION->PEB an exception is raised (I assume this is because I can't access the memory)

When I first discovered this I remembered someone mentioning the KeStackAttachProcess and it's counterpart to access addresses inside another process context.

The problem is that I don't know how to check if the context change was successful or not. And once I'm supposedly inside another context I still can't access the peb. Does anyone know how I can access the PEB of notepad?

Here's the code I'm currently using to find and access the PEB:

Assume hgtPid = the PID of notepad

void ModuleDumperThread(){

NTSTATUS Status = STATUS_SUCCESS;
HANDLE hPr开发者_开发百科ocessHandle = NULL;
PLIST_ENTRY Next;
PLDR_DATA_TABLE_ENTRY LdrDataTableEntry;
CLIENT_ID clientID; 
ACCESS_MASK DesiredAccess = PROCESS_ALL_ACCESS;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE hProcessId = hgtPid;
PROCESS_BASIC_INFORMATION BasicInfoReal;
ULONG SizeReturned;

PEPROCESS ep;
KAPC_STATE *ka_state = NULL;


InitializeObjectAttributes (&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

   clientID.UniqueProcess = hProcessId;  
   clientID.UniqueThread = NULL; 

__try{


Status = ZwOpenProcess(&hProcessHandle, DesiredAccess, &ObjectAttributes, &clientID);

                if(Status != STATUS_SUCCESS){
                        DbgPrint("Failed to open process\n");
                        DbgPrint("NtStatus: 0x%x", Status);
                        return;
                }

            Status = gZwQueryprocess(hProcessHandle, ProcessBasicInformation, (PVOID)&BasicInfoReal, sizeof(PROCESS_BASIC_INFORMATION), &SizeReturned);

                    if(Status != STATUS_SUCCESS){
                                DbgPrint("gZwQueryprocess failed\n");
                                DbgPrint("Size returned: 0x%x\nNtStatus: 0x%x\n", SizeReturned, Status);
                                ZwClose(hProcessHandle);
                                return;
                    }

            ZwClose(hProcessHandle);        

        Status = PsLookupProcessByProcessId(hProcessId, &ep);

                    if(Status != STATUS_SUCCESS){
                                DbgPrint("PsLookupProcessByProcessId failed\n");
                                DbgPrint("NtStatus: 0x%x\n", Status);
                                return;
                    }

ka_state = ExAllocatePoolWithTag(NonPagedPool, sizeof(KAPC_STATE),'trak');

            KeStackAttachProcess(ep, ka_state);

__try{

                if(BasicInfoReal.PebBaseAddress->Ldr){

                           Next = BasicInfoReal.PebBaseAddress->Ldr->InLoadOrderModuleList.Blink;
                           LdrDataTableEntry = CONTAINING_RECORD( Next,
                                                                  LDR_DATA_TABLE_ENTRY,
                                                                  LoadOrder
                                                                );
                    DbgPrint("Module base address: 0x%x", LdrDataTableEntry->ModuleBaseAddress);
                } 
    }__except( EXCEPTION_EXECUTE_HANDLER ) {
        DbgPrint("Exception while trying to access the PEB\n");
       }

            KeUnstackDetachProcess(ka_state);
            ExFreePool(ka_state);


}__except( EXCEPTION_EXECUTE_HANDLER ) {
                DbgPrint("Exception in ModuleDumper\n");
        }

              if(ep){
                ObDereferenceObject(ep);        
              } 
return;
}

Does anyone spot any errors/faults?

Thanks in advance

EDIT:

I've changed a few things, and this is where it gets really bizarre. For the sake of being sure I changed the 'ep' of KeStackAttachProcess() to the by msdn designated PRKPROCESS type, when I call KeStackAttachProcess() now execution just disappears. Before the call everything is going fine, after the call there's just nothing. No errors no exceptions no BSOD's: Nothing. What's going on?!?

Changes:

    __asm{
        mov eax, ep
        mov eax, [eax]
        mov myPKPROCESS, eax  // just dereferencing my pointer (I don't have the structs)
    }

  DbgPrint("Test print\n");   // gets printed just fine

            KeStackAttachProcess(&myPKPROCESS, ka_state); 
DbgPrint("Test print\n");  // nothing happens

EDIT2:

I have solved the problem. I still don't know what went wrong in the above code, however this code appears to be working:

void ModuleDumperThread(){

NTSTATUS Status = STATUS_SUCCESS;
HANDLE hProcessHandle = NULL;
PLIST_ENTRY Next;
PLDR_DATA_TABLE_ENTRY LdrDataTableEntry;
CLIENT_ID clientID; 
ACCESS_MASK DesiredAccess = PROCESS_ALL_ACCESS;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE hProcessId = hgtPid;
PROCESS_BASIC_INFORMATION BasicInfoReal;
ULONG SizeReturned;
PEPROCESS ep = NULL;
unsigned int Index = 0;
InitializeObjectAttributes (&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

   clientID.UniqueProcess = hProcessId;  
   clientID.UniqueThread = NULL; 


__try{

    Status = ZwOpenProcess(&hProcessHandle, DesiredAccess, &ObjectAttributes, &clientID);

                if(Status != STATUS_SUCCESS){
                        DbgPrint("Failed to open process\n");
                        DbgPrint("NtStatus: 0x%x", Status);
                        return;
                }

            Status = gZwQueryprocess(hProcessHandle, ProcessBasicInformation, (PVOID)&BasicInfoReal, sizeof(PROCESS_BASIC_INFORMATION), &SizeReturned);

                    if(Status != STATUS_SUCCESS){
                                DbgPrint("gZwQueryprocess failed\n"); 
                                DbgPrint("Size returned: 0x%x\nNtStatus: 0x%x\n", SizeReturned, Status);
                                ZwClose(hProcessHandle);
                                return;
                    }

    //DbgPrint("Basic info: 0x%x\n", BasicInfoReal);
    //DbgPrint("BasicInfoReal->PebBaseAddress: 0x%x\n", BasicInfoReal->PebBaseAddress);
    //DbgPrint("RealPeb: 0x%x\n", RealPeb);
    //DbgPrint("gZwReadVirtualMemory: 0x%x\n", gZwReadVirtualMemory);

                    Status = PsLookupProcessByProcessId(hProcessId, &ep);

                    if(Status != STATUS_SUCCESS){
                                DbgPrint("PsLookupProcessByProcessId failed\n");
                                DbgPrint("NtStatus: 0x%x\n", Status);
                                ZwClose(hProcessHandle);
                                return;
                    }
Timeout((INT64)0x1FFFFFF);

KeAttachProcess(ep);
__try{
   DbgPrint("ImageBaseAddress of notepad.exe: 0x%x\n", BasicInfoReal.PebBaseAddress->ImageBaseAddress);

    Next = BasicInfoReal.PebBaseAddress->Ldr->InLoadOrderModuleList.Blink;
    LdrDataTableEntry = CONTAINING_RECORD( Next, LDR_DATA_TABLE_ENTRY, LoadOrder);


    for(Index = 0; Index != 17; Index++){
       DbgPrint("%d: ImageBase of %wZ in Notepad.exe: 0x%x\n", Index, &(LdrDataTableEntry->ModuleName), LdrDataTableEntry->ModuleBaseAddress);
       Next = Next->Blink;
       LdrDataTableEntry = CONTAINING_RECORD(Next, LDR_DATA_TABLE_ENTRY, LoadOrder);
    }


   }__except( EXCEPTION_EXECUTE_HANDLER ) {
                DbgPrint("Exception while accessing the LDR\n");
        }

KeDetachProcess();

    }__except( EXCEPTION_EXECUTE_HANDLER ) {
                DbgPrint("Exception in ModuleDumper\n");
        }
        ObDereferenceObject((PVOID)ep);
        ZwClose(hProcessHandle);    


return;
}

You can use PPEB PsGetProcessPeb ( IN PEPROCESS Process ). You need to use MmGetSystemRoutineAddress to get this API's address. Take a look at GetDllByPeb function in this file: http://code.google.com/p/arkitlib/source/browse/trunk/ARKitDrv/Ps.c

This is your PsGetProcessPeb :

/base/ntos/ps/pshelper.c

PPEB
PsGetProcessPeb(
    __in PEPROCESS Process
    )
{
    return Process->Peb;
}

No need to do extra-work to extract PEB pointer from the EPROCESS struct (which is pretty same for all Windows versions, except 32/64-bit difference)

And you can get EPROCESS by PsLookupProcessByProcessId, using ID=4 (System Process).