diff --git a/wow64_peb b/wow64_peb new file mode 100644 index 0000000..b746daf --- /dev/null +++ b/wow64_peb @@ -0,0 +1,3 @@ +# get the 64-bit and 32-bit PEB for all WoW64 processes + +dx -g @$cursession.Processes.Where(p => p.KernelObject.WoW64Process).Select(p => new {Name = p.Name, Peb = p.KernelObject.Peb, Peb32 = p.KernelObject.WoW64Process->Peb})