View Single Post
  #2  
Old 10-19-2015, 17:43
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 179
Rept. Given: 36
Rept. Rcvd 54 Times in 24 Posts
Thanks Given: 49
Thanks Rcvd at 117 Times in 69 Posts
evlncrn8 Reputation: 54
better way is to use the NtQueryInformationProcess - process_basic_information method to obtain the peb address for the process, its much more reliable than using register values which might change with a service pack / os update etc..
Reply With Quote
The Following User Says Thank You to evlncrn8 For This Useful Post:
giv (10-21-2015)