Process Environment Block location

[chep]

Hi all,

I know that on W2k and XP the PEB (pointed by fs:[30h]) is always located at 7FFDF000h.

I wonder if a few Win98/NT4/XP64 owners out there could run the attached app (which prints the PEB location) and tell me if it's the same location, as I don't have access to these Windows versions.

The value from WOW32 on XP64 is of particular interest to me, as IMO there are strong chances that Microsoft will keep this legacy location in WOW32 implementations of future Windows versions if XP64 uses it.

Thanks by advance.

[attachment deleted by admin]

[QvasiModo]

I understand the PEB location changes frequently across versions for security reasons... maybe anyone can shed some light on this?