diff --git a/Windows API/GetPebAlt.cpp b/Windows API/GetPebAlt.cpp new file mode 100644 index 0000000..e062e48 --- /dev/null +++ b/Windows API/GetPebAlt.cpp @@ -0,0 +1,10 @@ +PPEB GetPebAlt(VOID) +{ + PTEB Teb; +#if defined(_WIN64) + Teb = (PTEB)__readgsqword(0x30); +#elif define(_WIN32) + Teb = (PTEB)__readfsdword(0x18); +#endif + return (PPEB)Teb->ProcessEnvironmentBlock; +}