|
well fs is not same on all platforms (especially in xp-sp2 fs segment is mapped to random addres (it used to be constant uptill w2k -sp4 i think viz 0x7fffd000 )
you need to fetch the fs via a different mechanism viz
ZwQueryInformationProcess() basic info class struct and look for *ppeb in there
take a look here on a sample implementation
http://www.openrce.org/blog/view/44
|