mirror of
https://github.com/yardenshafir/WinDbg_Scripts
synced 2026-06-08 18:28:57 +00:00
yardenshafir
4 lines
227 B
Plaintext
4 lines
227 B
Plaintext
# get the 64-bit and 32-bit PEB for all WoW64 processes
|
|
|
|
dx -g @$cursession.Processes.Where(p => p.KernelObject.WoW64Process).Select(p => new {Name = p.Name, Peb = p.KernelObject.Peb, Peb32 = p.KernelObject.WoW64Process->Peb})
|