Walking the Process Environment Block (PEB) - How-To Discover In-Memory Libraries

There are a several key internal structures in the Windows operating system that are regularly used to obtain non-standard functionality. The process environment block, commonly referred to as the PEB, is one of those structures. In this video, we'll discuss the overall structure of the peb and use WinDbg to view it's structure. We'll also look at a sample program that walks the peb to find the base of NTDLL and discuss how this code works and how you can …

base block discover discuss environment find how-to internal key memory non operating system process program standard system video windbg windows