#23813·radare2

Access to the Windows PEB structure.

Author: dagonet1Created Dec 18, 2024Updated Jul 14, 2026
LabelsWindowsRDebug

Description

Provide the ability to read the Process Environment Block in Windows to mimic the functionality of windbg.

Dynamically finding the address of the PEB

image

Overlaying the PEB structure on the aforementioned address.

image

Microsoft seems to have removed the PEB symbol from recent versions of ntdll.pdb. Attached is a version that contains the PEB symbol.

ntdllpdb.tar.gz