WinDbg commonly used commands series ---! Peb

!

Brief introduction

! PEB view format displaying the process environment block (PEB) in the information.

Use the form

! [US-Address]

parameter

• PEB-Address
  To check the hex address of its process of PEB. (This is not derived from the kernel process PEB process block address.) If omitted PEB address, the current process in user mode PEB. If you ignore it in kernel mode, the context of the current process corresponding to the PEB is displayed.
  

Support Environment

Windows 2000	Kdextx86.dll Ntsdexts.dll
Windows XP and later	Exts.dll

Remark

PEB is part of the Microsoft Windows user-mode process control structure.
If the! Peb extension no parameters in kernel mode will give you an error, you should use! Process extension of the process used to determine the required process PEB address. Make sure that your process context to the desired process, and then use the PEB address as an argument.
Show the exact output depends on the Windows version, and you are debugging in kernel mode or user mode. The following example is taken from the target attached to a Windows Server 2003 kernel debugger:

kd> !peb
PEB at 7ffdf000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         4ad00000
    Ldr                       77fbe900
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 00241ef8 . 00242360
    Ldr.InLoadOrderModuleList:           00241e90 . 00242350
    Ldr.InMemoryOrderModuleList:         00241e98 . 00242358
            Base TimeStamp                     Module
        4ad00000 3d34633c Jul 16 11:17:32 2002 D:\WINDOWS\system32\cmd.exe
        77f40000 3d346214 Jul 16 11:12:36 2002 D:\WINDOWS\system32\ntdll.dll
        77e50000 3d3484ef Jul 16 13:41:19 2002 D:\WINDOWS\system32\kernel32.dll
....
    SubSystemData:     00000000
    ProcessHeap:       00140000
    ProcessParameters: 00020000
    WindowTitle:  'D:\Documents and Settings\Administrator\Desktop\Debuggers.lnk'
    ImageFile:    'D:\WINDOWS\system32\cmd.exe'
    CommandLine:  '"D:\WINDOWS\system32\cmd.exe" '
    DllPath:      'D:\WINDOWS\system32;D:\WINDOWS\system32;....
    Environment:  00010000
        ALLUSERSPROFILE=D:\Documents and Settings\All Users
        APPDATA=D:\Documents and Settings\UserTwo\Application Data
        CLIENTNAME=Console
....
        windir=D:\WINDOWS