mov eax,dword ptr fs:[18h] //! TEB -> TIB
mov ecx,dword ptr ds:[eax+30h] //! self
movzx eax,dword ptr ds:[ecx+0A4h] //! OSMajorVersino
shl eax,8
or eax,dword ptr ds:[ecx+0A8h] //! OSMinorVersion
O/S VERSION dwMajorVersion dwMinorVersion
Windows 8 6.2 6 2
Windows 7 6.1 6 1
Windows Server 2008 R2 6.1 6 1
Windows Server 2008 6.0 6 0
Windows Vista 6.0 6 0
Windows Server 2003 R2 5.2 5 2
Windows Server 2003 5.2 5 2
Windows XP 5.1 5 1
Windows 2000 5.0 5 0
Windows Me 4.90 4 90
Windows 98 4.10 4 10
'Reversing' 카테고리의 다른 글
PE구조파일 Image Base Address 쉽게 얻자 (0) | 2012.06.11 |
---|---|
ANTI D3D9 hooking (0) | 2012.05.17 |
[ANTI-Reversing] ANTI_DLL Injection (0) | 2012.04.24 |
[ANTI Reversing] BegingDebuged 설명 (0) | 2012.04.24 |
PEB구조체 시작 주소 MS Windows 버전별 (0) | 2012.04.24 |