<commit_before>﻿function Get-PEB
{
<#
.SYNOPSIS

Returns the process environment block (PEB) of a process.

PowerSploit Module - Get-PEB
Author: <NAME> (@mattifestation)
License: BSD 3-Clause
 
.DESCRIPTION

Get-PEB returns a fully parsed process environment block (PEB) of any process. Because the PEB and its underlying structure differ according to OS version and architecture, Get-PEB builds the PEB dynamically at runtime. Get-PEB is designed to work in Windows XP - Windows 8 32/64-bit. It will also return the PEB of Wow64 processes.

.EXAMPLE

C:\PS> $AllPEBs = Get-Process | Get-PEB

Description
-----------
Get the PEB of every process. Note: To get the PEBs for all processes, run this command from an elevated instance of PowerShell

.EXAMPLE

C:\PS> $NotepadPEB = Get-PEB -Id (ps notepad)
C:\PS> $NotepadPEB.InInitializationOrderModuleList
<commit_msg>Added 'Id' parameter documentation to Get-PEB<commit_after>﻿function Get-PEB
{
<#
.SYNOPSIS

Returns the process environment block (PEB) of a process.

PowerSploit Module - Get-PEB
Author: <NAME> (@mattifestation)
License: BSD 3-Clause
 
.DESCRIPTION

Get-PEB returns a fully parsed process environment block (PEB) of any process. Because the PEB and its underlying structure differ according to OS version and architecture, Get-PEB builds the PEB dynamically at runtime. Get-PEB is designed to work in Windows XP - Windows 8 32/64-bit. It will also return the PEB of Wow64 processes.

.PARAMETER Id

The process ID of the process whose PEB will be retrieved.

.EXAMPLE

C:\PS> $AllPEBs = Get-Process | Get-PEB

Description
-----------
Get the PEB of every process. Note: To get the PEBs for all processes, run this command from an elevated instance of PowerShell

.EXAMPLE

C:\PS> $NotepadPEB = Get-PEB -Id (ps notepad)
C:\PS> $NotepadPEB.InInitializationOrderModuleList

{'fraction_non_alphanumeric': 0.08328796951551443, 'fraction_numerical': 0.008709853021230268, 'mean_word_length': 4.049450549450549, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2443616', 'n_tokens_mistral': 590, 'n_tokens_neox': 562, 'n_words': 244}