Process Environment Block

One of the main topics of this book is the PEB structure. Figure 3.6 shows some contents of the PEB structure, but for the sake of brevity, only the main points are included. The complete structure can be found in the unpublished Process-Environment-Block (https://www.aldeid.com/wiki/PEB-Process-Environment-Block) listed on the ALDEID website:

Figure 3.6 – PEB structure

Figure 3.6 lists the only status information block for the current process. It holds information such as BeingDebugged at +0x02, which is the value returned internally by the developer when using WINAPI IsDebuggerPresent to check whether it is being debugged. ImageBaseAddress at +0x08, which appeared earlier in the process hollowing technique, is used to record which EXE file is the main PE module of the current process.

ProcessParameters at +0x10 in the 32-bit PEB structure records information about the parameters inherited by the current process when...