Access to the Windows PEB structure.
Author: dagonet1Created Dec 18, 2024Updated Jul 14, 2026
LabelsWindowsRDebug
Description
Provide the ability to read the Process Environment Block in Windows to mimic the functionality of windbg.
Dynamically finding the address of the PEB
Overlaying the PEB structure on the aforementioned address.
Microsoft seems to have removed the PEB symbol from recent versions of ntdll.pdb. Attached is a version that contains the PEB symbol.
Source: radareorg/radare2