__readfsdword __readgsqword PEB TEB

 

 

To get 32-bit PEB from 32-bit process:

BYTE* _teb = (BYTE*)__readfsdword(0x18); PEB32* _peb = *(PEB32**)(_teb + 0x30);

To get 64-bit PEB from 64-bit process:

BYTE* _teb = (BYTE*)__readgsqword(0x30); PEB64* _peb = *(PEB64**)(_teb + 0x60);

To get 64-bit PEB from 32-bit WoW64 process:

BYTE* _teb = (BYTE*)__readfsdword(0x18) - 0x2000; DWORD64 _peb = *(DWORD64*)(_teb + 0x60);

 

微软已经给我们准备好了现成的方法

NtCurrentPeb（）

NtCurrentPeb（）

内联方式的函数，对win32 和64 做了处理，最终也是调用了以上的函数 

__readfsdword

__readgsqword

转载于:https://www.cnblogs.com/M4ster/p/readfsd_gsq_word_TEP_PEB.html