Posted December 22, 20222 yr I came into a problem where i need to grab BeingDebugged BYTE from PEB https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb I got the address of PEB from x64 system PEB* _PEB = (PEB*)(__readgsqword(0x60)); to get the address of BeingDebugged flag i need something like (PBYTE)_PEB + 0x002 but i am not sure what typecasting exactly i have to use , give me your lights.
December 24, 20222 yr Author 14 hours ago, h4sh3m said: Hi Do you mean this ?! BYTE IsDebugging = _PEB.BeingDebugged; This works , however i was trying to do it other way. I think i found what i was looking for. IsDebug = (BYTE) * (PDWORD64)((PBYTE)_PEB + 0x2);
Create an account or sign in to comment