__readfsdword __readgsqword PEB TEB

To get 32-bit PEB from 32-bit process:

	BYTE* _teb = (BYTE*)__readfsdword(0x18);
	PEB32* _peb = *(PEB32**)(_teb + 0x30);

To get 64-bit PEB from 64-bit process:

	BYTE* _teb = (BYTE*)__readgsqword(0x30);
	PEB64* _peb = *(PEB64**)(_teb + 0x60);

To get 64-bit PEB from 32-bit WoW64 process:

	BYTE* _teb = (BYTE*)__readfsdword(0x18) - 0x2000;
	DWORD64 _peb = *(DWORD64*)(_teb + 0x60);

微软已经给我们准备好了现成的方法

NtCurrentPeb()

NtCurrentPeb()

内联方式的函数,对win32 和64 做了处理,最终也是调用了以上的函数 

__readfsdword
__readgsqword
原文地址:https://www.cnblogs.com/M4ster/p/readfsd_gsq_word_TEP_PEB.html