Function QueryWow64PebAddress

src/OSTPlatform/Windows/Process.cpp:100–113

}

std::optional<ULONG_PTR> QueryWow64PebAddress(HANDLE process) {
    const auto ntQueryInformationProcess = NtQueryInformationProcessProc();
    if (!ntQueryInformationProcess) return std::nullopt;

    ULONG_PTR peb32 = 0;
    const NTSTATUS status = ntQueryInformationProcess(
        process,
        NtAbi::ProcessInfoClass::Wow64Information,
        &peb32,
        sizeof(peb32),
        nullptr);
    if (!NtAbi::NtSuccess(status) || peb32 == 0) return std::nullopt;
    return peb32;
}

std::optional<PVOID> QueryNativeEnvironmentAddress(HANDLE process) {
    const auto pebAddress = QueryNativePebAddress(process);