Create wow64_peb

2026-06-08 18:28:57 +00:00 · 2022-08-06 12:59:13 -04:00
parent 450f4eca9f
commit 8cf49f080e
1 changed files with 3 additions and 0 deletions
@@ -0,0 +1,3 @@
+# get the 64-bit and 32-bit PEB for all WoW64 processes
+
+dx -g @$cursession.Processes.Where(p => p.KernelObject.WoW64Process).Select(p => new {Name = p.Name, Peb = p.KernelObject.Peb, Peb32 = p.KernelObject.WoW64Process->Peb})