Option Explicit
'---------------------------------------------------------------------------------------
' Module    : mGetMyPath
' Author    : Karcrack
' Now$      : 28/05/2009  22:01
' Used for? : Get our own path
' Reference : http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Process/PEB.html
'             http://www.nirsoft.net/kernel_struct/vista/RTL_USER_PROCESS_PARAMETERS.html
'
' Thanks.   : ctlon -> For the links
'             Cobein & SqUeEzEr -> For the mem job (http://hackhound.org/forum/index.php?topic=16203.0)
'
'---------------------------------------------------------------------------------------

'USER32
Private Declare Function CallWindowProc Lib "user32.dll" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hwnd As Long, ByVal msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
'MSVBVM60
Private Declare Sub GetMem1 Lib "msvbvm60.dll" (ByVal lAddress As Long, var As Byte)

'Function Credits: Cobein & SqUeEzEr
Private Function RtlGetString(lAddr As Long) As String
    Dim i       As Long
    Dim b       As Byte
   
    Do
        Call GetMem1(lAddr + i * 2, b)
        i = i + 1
        If b = 0 Then Exit Do
        RtlGetString = RtlGetString & Chr$(b)
    Loop
End Function

Public Function GetMyPath() As String
    Dim lAddr           As Long
    Dim bvCode()        As Byte
   
    ReDim bvCode(0 To 14)
    'asm (
    ' mov eax, [FS:0x30]
    ' mov eax, [DS:eax+0x10]
    ' mov eax, [DS:eax+0x3C]
    ' ret 16
    ');
    bvCode(0) = &H64:    bvCode(1) = &HA1:    bvCode(2) = &H30:    bvCode(3) = &H0:     bvCode(4) = &H0:    bvCode(5) = &H0:     bvCode(6) = &H8B:    bvCode(7) = &H40:    bvCode(8) = &H10:    bvCode(9) = &H8B:   bvCode(10) = &H40:    bvCode(11) = &H3C:   bvCode(12) = &HC2:    bvCode(13) = &H10:    bvCode(14) = &H0
   
    'Get the Addr of our path saved in the PEB
    lAddr = CallWindowProc(VarPtr(bvCode(0)), 0&, 0&, 0&, 0&)
   
    If lAddr > 0 Then
        'Return the DATA
        GetMyPath = RtlGetString(lAddr)
    End If
End Function