public static IntPtr FindPeb(SafeMemoryHandle processHandle) { return MemoryCore.NtQueryInformationProcess(processHandle).PebBaseAddress; }