Function QueryNativePebAddress

src/OSTPlatform/Windows/Process.cpp:84–98

}

std::optional<PVOID> QueryNativePebAddress(HANDLE process) {
    const auto ntQueryInformationProcess = NtQueryInformationProcessProc();
    if (!ntQueryInformationProcess) return std::nullopt;

    NtAbi::ProcessBasicInformation info{};
    const NTSTATUS status = ntQueryInformationProcess(
        process,
        NtAbi::ProcessInfoClass::BasicInformation,
        &info,
        sizeof(info),
        nullptr);
    if (!NtAbi::NtSuccess(status) || !info.pebBaseAddress) return std::nullopt;

    return info.pebBaseAddress;
}

std::optional<ULONG_PTR> QueryWow64PebAddress(HANDLE process) {
    const auto ntQueryInformationProcess = NtQueryInformationProcessProc();