Process Module enumeration and concealment

This picture is the most accurate one I have seen about using PEB to view the module information.

Get TEB

Lkd>!tebteb at7ffdd000 exceptionlist:xxC2976C StackBase:xxc30000 Stacklimit:xxc23000 Subsystemtib:00000000Fiberdata:00001e00Arbitraryuserpointer:00000000Self:7ffdd000 Environmentpointer:00000000ClientId:00000238.000003B8 Rpchandle:00000000Tls Storage:00000000PEB Address:7ffdf000 * * * Lasterrorvalue:0laststatusvalue:c0000139 Count owned Locks:0Harderrormode:0

View PEB

Lkd>DT _PEB7Ffdf000nt!_peb+0x000Inheritedaddressspace:0 "'   +0x001Readimagefileexecoptions:0 "'   +0x002Beingdebugged:0 "'   +0x003Sparebool:0 "'   +0x004Mutant:0xFFFFFFFF Void   +0x008Imagebaseaddress:0x01000000 Void   +0x00cLDR:0x00191e90_peb_ldr_data***   +0x010ProcessParameters:0x00020000_rtl_user_process_parameters+0x014Subsystemdata: (NULL)+0x018Processheap:0x00090000 Void   +0x01cFastpeblock:0x7c99d600_rtl_critical_section+0x020Fastpeblockroutine:0x7c921000 Void   +0x024Fastpebunlockroutine:0x7c9210e0 Void   +0x028Environmentupdatecount:1   +0x02cKernelcallbacktable:0x77d12970 Void   +0x030Systemreserved:[1]0 +0x034 atlthunkslistptr32:0 +0x038 FreeList: (null) +0x03c tlsexpansioncounter:0 +0x040 Tlsbi Tmap:0x7c99d5c0 Void +0x044 tlsbitmapbits:[2]0x3ffffff

View Ldr (similar to head node)

Lkd> DT _peb_ldr_data191e90-r1nt!_peb_ldr_data +0x000Length:0x28+0x004Initialized:0x1 "'+0x008Sshandle: (NULL)    +0x00cInloadordermodulelist: _list_entry [0x191ec0-0x194120]      +0x000Flink:0x00191ec0_list_entry [0x191f18-0x191e9c]      +0x004Blink:0x00194120_list_entry [0x191e9c-0x194030]   +0x014Inmemoryordermodulelist: _list_entry [0x191ec8-0x194128]      +0x000Flink:0x00191ec8_list_entry [0x191f20-0X191EA4] ***      +0x004Blink:0x00194128_list_entry [0X191EA4-0x194038]   +0x01cIninitializationordermodulelist: _list_entry [0x191f28-0x194130]      +0x000Flink:0x00191f28_list_entry [0x191fd0-0X191EAC]      +0x004Blink:0x00194130_list_entry [0X191EAC-0x194040]   +0x024Entryinprogress: (NULL)

View module Nodes

Lkd> DT _ldr_data_table_entry191Ec8-r1nt!_ldr_data_table_entry +0x000Inloadorderlinks: _list_entry [0x191f20-0X191EA4]      +0x000Flink:0x00191f20_list_entry [0x191fc8-0x191ec8]      +0x004Blink:0X00191EA4_list_entry [0x191ec8-0x194248]   +0x008Inmemoryorderlinks: _list_entry [0x0-0x0]      +0x000Flink: (NULL)       +0x004Blink: (NULL)    +0x010Ininitializationorderlinks: _list_entry [0x1000000-0x1058c77]      +0x000Flink:0x01000000_list_entry [0x905a4d-0x3]      +0x004Blink:0x01058c77_list_entry [0x896e8-0xfdc3e900]   +0x018Dllbase:0x00097000Void +0x01cEntryPoint:0x007c007aVoid +0x020Sizeofimage:0x2060c+0x024Fulldllname: _unicode_string"Windbg.exe"+0x000Length:0x14+0x002MaximumLength:0x16+0x004 Buffer:0x00020672  "Windbg.exe"+0x02cBasedllname: _unicode_string"---Memory read error at address 0x0000ffff---"+0x000Length:0x5000+0x002MaximumLength:0+0x004 Buffer:0x0000ffff  "---Memory read error at address 0x0000ffff---"+0x034Flags:0X192FCC+0x038Loadcount:0xb310+0x03aTlsIndex:0x7c99+0x03cHashlinks: _list_entry [0x4b6734c3-0x0]      +0x000Flink:0x4b6734c3_list_entry +0x004Blink: (NULL)    +0x03cSectionpointer:0x4b6734c3Void +0x040CheckSum:0+0x044TimeDateStamp:0+0x044Loadedimports: (NULL)    +0x048Entrypointactivationcontext:0x000b000bVoid +0x04cPatchinformation:0x00080158Void

Process Module enumeration and concealment