Exemple #1
0
        static IntPtr GetPebNative(IntPtr hProcess)
        {
            var pbi     = new WindowsApi.PROCESS_BASIC_INFORMATION();
            int res_len = 0;
            int pbiSize = Marshal.SizeOf(pbi);
            int status  = WindowsApi.NtQueryInformationProcess(
                hProcess,
                WindowsApi.ProcessBasicInformation,
                ref pbi,
                pbiSize,
                ref res_len);

            if (res_len != pbiSize)
            {
                throw new Exception("Unable to query process information.");
            }
            return(pbi.PebBaseAddress);
        }
Exemple #2
0
 static IntPtr _GetPebNative(IntPtr hProcess)
 {
     var pbi = new WindowsApi.PROCESS_BASIC_INFORMATION();
     int res_len = 0;
     int pbiSize = Marshal.SizeOf(pbi);
     int status = WindowsApi.NtQueryInformationProcess(
         hProcess,
         WindowsApi.ProcessBasicInformation,
         ref pbi,
         pbiSize,
         ref res_len);
     if (res_len != pbiSize)
         throw new Exception("Unable to query process information.");
     return pbi.PebBaseAddress;
 }