I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of PEB_LDR_DATA I found the the pointer of InInitializationOrderModuleList and I was told that I can find the ntdll.dll address there. And that I should first find the address of kernel32.dll (which is always the second entry). So, I was able to find the address of kernel32.dll but it seems like I can't find the address of ntdll.dll. 00251ED8  .%%%%.....@@.TV.............%%%%00251F58  %%.:............C:\WINDOWS\system32\00251FD8  kernel32.dll.......%%%%%%.@B%%..00252058  .........C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b002520D8  9a1e18e3b_9.0.21022.8_x-ww_d08d0375\MSVCR90.dll......%%00252158  %%%%..%%...........%%This is the part where I have found the kernel32.dll. But in the fact of that this a linked list. Shouldn't I be able to find ntdll.dll too? When, I open up the window of Executable Modules I can see the ntdll.dll but it seem I am not able to find the base address inside of the Struct. Please tell me if you need clarification or if I am grievously mistaken.
Where is ntdll.dll?
windows;assembly;memory;immunity debugger
The code below will set EAX to the image base address of ntdll.dll:MOV EAX, DWORD PTR FS:[30]     ; EAX = PEBMOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->LdrMOV EAX, DWORD PTR DS:[EAX+1C] ; EAX = PEB->Ldr.InInitializationOrderModuleList.FlinkMOV EAX, DWORD PTR DS:[EAX+8]  ; EAX = image base of ntdll (LDR_MODULE's BaseAddress)Based on your question above, it seems like you understand everything through the MOV EAX, DWORD PTR DS:[EAX+1C] instruction. Since ntdll.dll is the first module loaded, it's the first LDR_MODULE entry in InInitializationOrderModuleList. So with EAX pointing to PEB->Ldr.InInitializationOrderModuleList.Flink, [EAX+0] points to the list entry's Flink, [EAX+4] points to the list entry's Blink, and [EAX+8] is the BaseAddress value of the first LDR_MODULE entry (ntdll.dll's LDR_MODULE).This image from http://blog.csdn.net/programmingring/article/details/11357393 may help:When EAX is set to PEB->Ldr.InInitializationOrderModuleList.Flink, it's pointing to the orange Flink in the first LDR_MODULE above. It's followed by the Blink at [EAX+4], and the DllBase (BaseAddress) at [EAX+8].