A forum for reverse engineering, OS internals and malware analysis 

How to get PEB32 of 32-bit process in WIN7X64

Forum for discussion about kernel-mode development.

How to get PEB32 of 32-bit process in WIN7X64

 #23081  by myid
 Tue Jun 10, 2014 9:41 am
Hi, everyone.
We can use EPROCESS->PEB or PsGetProcessPeb to get PEB64 of 32-bit process.
But how to get PEB32 of 32-bit process?
I found this:
Peb32 = (PPEB32)Process->Wow64Process->Wow64
But what is the definition of Wow64Process structure?
 Return to “Kernel-Mode Development”