Does anyone know of a program that will display the TIB/PEB contents of a PE. I wrote a program that will read and display the TEB/PEB but I think some of the returned data is wrong.

  • 2
    a pe by itself does not contain any process environment block details or thread environment block details those are part of a running process one of the tool that can display the details is cdb or windbg C:\>cdb -c "!peb;q" calc.exe 0:000> cdb: Reading initial command '!peb;q' PEB at 7ffd4000 InheritedAddressSpace: No ReadImageFileExecOptions: No and a better query that states what you tried whatwent wrong and why you think it is wrong can yield better answers – blabb Sep 8 '15 at 4:08
  • Yea, I should have been more specific (a running process). Thanks for the suggestion to use windbg. It appears to do what I want. – TurtleMan Sep 8 '15 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.