top of page


Locating DLL Name from the Process Environment Block (PEB)
I often encounter software, especially when performing malware analysis, that dynamically constructs it’s own import table. This can be...

Josh Stroschein
Feb 10, 20245 min read
203 views


Exploring the Process Environment Block (PEB) with WinDbg
The source code for this example can be found here. The assembly is: mov ebx, fs:[ 0x30 ] ; // get a pointer to the PEB mov ebx, [ ebx +...

Josh Stroschein
Feb 10, 20241 min read
30 views
bottom of page