Jump to content
Tuts 4 You

[Help] Typecasting Windows


Recommended Posts

I came into a problem where i need to grab BeingDebugged BYTE from PEB https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb

I got the address of PEB from x64 system

PEB* _PEB = (PEB*)(__readgsqword(0x60));

to get the address of BeingDebugged flag i need something like 

(PBYTE)_PEB + 0x002

but i am not sure what typecasting exactly i have to use , give me your lights.

Link to comment
14 hours ago, h4sh3m said:


Do you mean this ?!

BYTE IsDebugging = _PEB.BeingDebugged;


This works , however i was trying to do it other way. I think i found what i was looking for.

IsDebug = (BYTE) * (PDWORD64)((PBYTE)_PEB + 0x2);


Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...