delphi - How to get the Process Environment Block (PEB) from extern process? -


So ... I need peg through the "Notepad.xa" process, how can someone make it?

I was trying with the "GetModuleHandle" API, but ... gives me an indicator (every time I give zero) because I have to call the process of that module.

For this reason, I want to know how to get it with "Enpropysted Modules" or "Create Touleau 2 2 Snapshot".

If anyone knows, please tell me, thank you in advance!

Matt Peterkac told how to do this. How to achieve this environmental variable of another process, where the first stage is to get the PEB an indicator. To do this, they say, call it fills the structure of PROCESS_BASIC_INFORMATION which contains the base address of the PEB structure. (You will need to use ReadProcessMemory to read, because the address will be in the context of the address of the external process address, not yours.)

To call NtQueryInformationProcess , you will need to handle the process if you have started the process yourself (by calling CreateProcess ), you already have the handle, otherwise you will need to enter the process ID And then call OpenProcess . To get the process ID, search for the process you want to do with EnumProcesses or Process32First / Process32 Next . (I like later because it provides more information with less work.)

Comments