Structure Definitions for PEB in IDA

if you are using IDA FREE then this and several other type libraries are not available

and if you intend to

create them yourself and export them somehow (would have to figure out how). 

this walk through provides few hints on how to accomplish it

os winxp sp3 vm

(all opaque structures like EPROCESS can vary from os to os / hotfix to hotfix patch tuesday to patch tuesday ) 

supposing you are reversing PsGetProcessId() in ntkrnlpa.exe

 ; Exported entry 872. PsGetProcessId ; Attributes: bp-based frame ; __stdcall PsGetProcessId(x) public _PsGetProcessId@4 _PsGetProcessId@4 proc near 8B FF mov edi, edi 55 push ebp 8B EC mov ebp, esp 8B 45 08 mov eax, [ebp+8] 8B 80 84 00 00 00 mov eax, [eax+84h] <----- 5D pop ebp C2 04 00 retn 4 _PsGetProcessId@4 endp 

and you find out 84 is EPROCESS->Pid and want to impart this information to the disassembly

make a text file named EPROCESS.h

type the following in the text file and save it for accessing it later

typedef struct EPROCESS { BYTE unknown[0x84]; DWORD Pid; } EPROCESS, *EPROCESS; 

go to ida free ->File->Load File->Parse Header File or shortcut ctrl+f9 browse to the EPROCESS.h

you should see this is ida information window on being successful

The initial autoanalysis has been finished. C:\Documents and Settings\Admin\Desktop\EPROCESS.h: `successfully compiled` 

view->open subviews->structures or shortcut shift+f9 press insert key click add standard structure start typing peb and you should see the window scrolling and showing you the structure you just added

00000000 EPROCESS struc ; (sizeof=0x88, standard type) 00000000 unknown db 132 dup(?) 00000084 Pid dd ? 00000088 EPROCESS ends 

go to idaview select 84h / right click->select structure offset

and apply the Eprocess.Pid

disassembly will become a bit more readable

8B 80 84 00 00 00 mov eax, [eax+EPROCESS.Pid] 

start adding other discovered offset to this eprocess.h and load it again for updated structure definitions

many of the structures definitions can be viewed via windbg

for example peb and peb_ldr_data can be viewed like this

dt nt!_PEB dt nt!_PEB_LDR_DATA 

Additional Details

if you modify the .h file to add another structure member like this

typedef struct EPROCESS { BYTE unknown[0x84]; DWORD Pid; BYTE unk2[0xbc-0x88]; DWORD DebugPort; BYTE unknown1[0x174-0xc0]; BYTE ImageFileName[16]; } EPROCESS, *PEPROCESS; 

Be Aware you would need to delete the earlier definitions before parsing the header file again and this implies all your earlier work will be lost on reloading so save your work