Access to the Windows PEB structure.

[numonce]

Description

Provide the ability to read the Process Environment Block in Windows to mimic the functionality of windbg.

Dynamically finding the address of the PEB

Overlaying the PEB structure on the aforementioned address.

Microsoft seems to have removed the PEB symbol from recent versions of ntdll.pdb. Attached is a version that contains the PEB symbol.

ntdllpdb.tar.gz

[trufae]

The :tls command should be implemented in the w32dbg plugin or maybe add a new callback in the rdebug plugin structure to get the thread local storage address for the given thread id.