static UniPtr _GetPeb64(IntPtr hProcess) { if (Environment.Is64BitProcess) { return(_GetPebNative(hProcess)); } else { // Get PEB via WOW64 API. var pbi = new WindowsApi.PROCESS_BASIC_INFORMATION_WOW64(); int res_len = 0; int pbiSize = Marshal.SizeOf(pbi); int status = WindowsApi.NtWow64QueryInformationProcess64( hProcess, WindowsApi.ProcessBasicInformation, ref pbi, pbiSize, ref res_len); if (res_len != pbiSize) { throw new Exception("Unable to query process information."); } return(new UniPtr(pbi.PebBaseAddress)); } }
static UniPtr _GetPeb64(IntPtr hProcess) { if (Environment.Is64BitProcess) { return _GetPebNative(hProcess); } else { // Get PEB via WOW64 API. var pbi = new WindowsApi.PROCESS_BASIC_INFORMATION_WOW64(); int res_len = 0; int pbiSize = Marshal.SizeOf(pbi); int status = WindowsApi.NtWow64QueryInformationProcess64( hProcess, WindowsApi.ProcessBasicInformation, ref pbi, pbiSize, ref res_len); if (res_len != pbiSize) throw new Exception("Unable to query process information."); return new UniPtr(pbi.PebBaseAddress); } }