Modules loaded by a exe

PEB is present starting from NT+.
The exact implementation of the structure is different. You can extract it from PDB-files using pdb-dump by de Quency.

[JMI]

Here's a little searching project for you all. The de Quincy article is available on "Searchlore" and his utility is available on "Sourceforge."

Regards,

As opposed in a concurrent thread (initial register values), the PEB can easily be retrieved with the following (VC) C++ code:
void *PEB = NULL;
__asm
{
mov eax,fs:[0x30]
mov PEB,eax
}
On windows 2000 it is constantly 0x7ffdf000
regards, PHaX

My dear JMI, no need to go to Sourceforge
http://wasm.ru/tools/21/pdbdump.zip
+ DIA SDK:
http://wasm.ru/tools/4/dia.zip

[JMI]

volodya:

I already knew that these utilities were available in many places. I was merely intending to encourage people to learn better how to search. I also thought some might like to actually read de Quincy's article.

Regards,

[TQN]

Hi volodya !
I have try to use pdbdump with ntdll.dbg and ntdll.pdb, but the output is only the name of public, import, export symbols... We don't have the layout or struct define of PEB.
Regards

Try ntoskrnl.pdb.