From 8cf49f080e9eb6fc75b52a303f72b4b58799fe89 Mon Sep 17 00:00:00 2001
From: yardenshafir <yardenshafir2@gmail.com>
Date: Sat, 6 Aug 2022 12:59:13 -0400
Subject: [PATCH] Create wow64_peb

---
 wow64_peb | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 wow64_peb

diff --git a/wow64_peb b/wow64_peb
new file mode 100644
index 0000000..b746daf
--- /dev/null
+++ b/wow64_peb
@@ -0,0 +1,3 @@
+# get the 64-bit and 32-bit PEB for all WoW64 processes
+
+dx -g @$cursession.Processes.Where(p => p.KernelObject.WoW64Process).Select(p => new {Name = p.Name, Peb = p.KernelObject.Peb, Peb32 = p.KernelObject.WoW64Process->Peb})