No replies to this topic

[kresh7]

Ok Days ago i did this function to get The ProcessID using PEB by reading THE FS = Segment Registry on position 0x20

Option Explicit

Private Declare Function NtCurrentTeb Lib "NTDLL" () As Long

Private Declare Sub CopyMemory _

                Lib "kernel32" _

                Alias "RtlMoveMemory" (pDst As Any, _

                                       pSrc As Any, _

                                       ByVal ByteLen As Long)

Private Declare Sub GetMem4 Lib "MSVBVM60" (ByVal Addr As Long, ByRef RetVal As Long)


Public Function GetProIDbyGetMem4() As Long

    Dim MemBuffer As Long

    Call GetMem4(NtCurrentTeb + &H20&, MemBuffer)

    GetProIDbyGetMem4 = MemBuffer

End Function 

Hope this comes handle for anyone of you guys