Win x64 Shellcode – Part 2: TEB, PEB and List of Loaded Modules

Tue, 30 Jun 2026 00:00:00 +0000

In the previous part, we explained why shellcode cannot use statically written addresses of Windows API functions. The solution lies in the structures that Windows maintains directly in the memory of each process. Today we will look at them closely.

Prerequisites

Before reading this part, it is advisable to read and understand the previous part. At the same time, it is highly advisable to have at least a basic understanding of what virtual memory and a pointer are.

Win x64 Shellcode – Part 1: Why We Can't Use Static Addresses

Fri, 10 Apr 2026 00:00:00 +0000

I have a background in writing 32-bit shellcodes for Windows [1][2][3]. The transition to x64 looks like a cosmetic change at first glance (wider registers, a different calling convention). In reality, it is an entirely different mental model.

The goal of this series is to describe the fundamentals of Win64 shellcode development in a simplified yet comprehensive way. It does not aim to be exhaustive documentation on the topic, but rather to provide accessible learning material that can serve as a stepping stone into this field.

Windows-Internals on proteqtum

Win x64 Shellcode – Part 2: TEB, PEB and List of Loaded Modules

Prerequisites

Win x64 Shellcode – Part 1: Why We Can't Use Static Addresses