View Single Post
  #2  
Old 10-05-2005, 00:37
JuneMouse
 
Posts: n/a
well fs is not same on all platforms (especially in xp-sp2 fs segment is mapped to random addres (it used to be constant uptill w2k -sp4 i think viz 0x7fffd000 )

you need to fetch the fs via a different mechanism viz
ZwQueryInformationProcess() basic info class struct and look for *ppeb in there

take a look here on a sample implementation

http://www.openrce.org/blog/view/44
Reply With Quote