| 65 | } |
| 66 | |
| 67 | PPEB NativeWinApi::getProcessEnvironmentBlockAddress(HANDLE processHandle) |
| 68 | { |
| 69 | ULONG lReturnLength = 0; |
| 70 | PROCESS_BASIC_INFORMATION processBasicInformation; |
| 71 | |
| 72 | if ((NtQueryInformationProcess(processHandle,ProcessBasicInformation,&processBasicInformation,sizeof(PROCESS_BASIC_INFORMATION),&lReturnLength) >= 0) && (lReturnLength == sizeof(PROCESS_BASIC_INFORMATION))) |
| 73 | { |
| 74 | //printf("NtQueryInformationProcess success %d\n",sizeof(PROCESS_BASIC_INFORMATION)); |
| 75 | |
| 76 | return processBasicInformation.PebBaseAddress; |
| 77 | } |
| 78 | else |
| 79 | { |
| 80 | //printf("NtQueryInformationProcess failed %d vs %d\n",lReturnLength,sizeof(PROCESS_BASIC_INFORMATION)); |
| 81 | return 0; |
| 82 | } |
| 83 | } |
nothing calls this directly
no outgoing calls
no test coverage detected