Eric Pouech pouech-eric@wanadoo.fr writes:
so I'll add the PROCESS_PARAMETERS pointer in the merged PDB/PEB at an unused offset (as 0x10 is already used by the PDB). 0x14 will do fine.
Please don't do that. There's no point in using the proper structures if we don't store things at the right offset. There must be one and only one PDB/PEB structure, we have to merge it somehow. In this specific case you can simply throw away exit_code, it's not used anywhere.