Search notes:

PEB - Windows Process Environment Block

PEB is the Windows Process Environment block

Offset 0x30 of the TIB (on Win32?) points to the PEB.

The PEB can be programatically found with NtCurrentTeb() -> ProcessEnvironmentBlock

PEB.BeingDebugged indicates if a debugger is attached.

It seems like the ebx register (x64: rbx) register points to the PEB when an exe's entry point is called.

peb.c

Wack0 has written a small c source file (peb.c) as github gist which gets a pointer to the PEB for every architecture that NT was ported to (x86, x64, ARM, ARM64, IA64, Alpha AXP, MIPS, PowerPC). This source relies on Visual-C compiler intrinsics. -

For x86, the relevant instruction is __readfsdword(0x30), for x64, it is __readgsqword(0x60).

I have allowed myself to fork this gist here.

Index