.NET Read PEB path [Anti Emulator/Debugger]

Code
Imports System.Runtime.InteropServices



Class PEB



    <DllImport("Ntdll.dll", EntryPoint:="NtQueryInformationProcess", CharSet:=CharSet.Unicode, SetLastError:=True, ExactSpelling:=True)> _

    Public Shared Function NtQueryInformationProcess(ByVal processHandle As Integer, ByVal ProcessInformationClass As Integer, ByRef ProcessInformation As PROCESS_BASIC_INFORMATION, ByVal ProcessInformationLength As Integer, ByRef ReturnLength As Integer) As Integer

    End Function



    <DllImport("Kernel32.dll", EntryPoint:="ReadProcessMemory", CharSet:=CharSet.Unicode, SetLastError:=True, ExactSpelling:=True)> _

    Public Shared Function ReadProcessMemory(ByVal processHandle As Integer, ByVal BaseAddress As Integer, ByVal Buffer As IntPtr, ByVal Size As Integer, ByRef OutputSize As Integer) As Boolean

    End Function



    <StructLayout(LayoutKind.Sequential)> _

    Public Structure PROCESS_BASIC_INFORMATION

      Public ExitStatus As Integer

      Public PebBaseAddress As Integer

      Public AffinityMask As Integer

      Public BasePriority As Integer

      Public UniqueProcessId As Integer

      Public InheritedFromUniqueProcessId As Integer

    End Structure

    <StructLayout(LayoutKind.Sequential)> _

    Public Structure LDR_MODULE

      Public InLoadOrderModuleList As LIST_ENTRY

      Public InMemoryOrderModuleList As LIST_ENTRY

      Public InInitializationOrderModuleList As LIST_ENTRY

      Public BaseAddress As Integer

      Public EntryPoint As Integer

      Public SizeOfImage As UInt32

      Public FullDllName As UNICODE_STRING

      Public BaseDllName As UNICODE_STRING

      Public Flags As UInt32

      Public LoadCount As Short

      Public TlsIndex As Short

      Public HashTableEntry As LIST_ENTRY

      Public TimeDateStamp As UInt32

    End Structure

    <StructLayout(LayoutKind.Sequential)> _

    Public Structure UNICODE_STRING

      Public Length As UInt16

      Public MaximumLength As UInt16

      Public Buffer As Integer

    End Structure

    <StructLayout(LayoutKind.Sequential)> _

    Public Structure PEB32

      Public InheritedAddressSpace As Byte

      Public ReadImageFileExecOptions As Byte

      Public BeingDebugged As Byte

      Public Spare As Byte

      Public Mutant As Integer

      Public ImageBaseAddress As Integer

      Public LoaderData As Integer

    End Structure

    <StructLayout(LayoutKind.Sequential)> _

    Public Structure PEB_LDR_DATA

      Public Length As Integer

      Public Initialized As Boolean

      Public SsHandle As Integer

      Public InLoadOrderModuleList As LIST_ENTRY

      Public InMemoryOrderModuleList As LIST_ENTRY

      Public InInitializationOrderModuleList As LIST_ENTRY

    End Structure

    <StructLayout(LayoutKind.Sequential)> _

    Public Structure LIST_ENTRY

      Public Flink As Integer

      Public Blink As Integer

    End Structure



    Public Shared Function Read() As String



      Dim PH As IntPtr = Process.GetCurrentProcess.Handle

      Dim PI As New PROCESS_BASIC_INFORMATION

      Dim PEB As New PEB32

      Dim peb_data As New PEB_LDR_DATA

      Dim ldr_module As New LDR_MODULE



      NtQueryInformationProcess(PH, 0, PI, Marshal.SizeOf(PI), 0)



      Dim Ptr1 As IntPtr = Marshal.AllocHGlobal(Marshal.SizeOf(PEB))

      If ReadProcessMemory(PH, PI.PebBaseAddress, Ptr1, Marshal.SizeOf(PEB), 0) = False Then

      Throw New System.ComponentModel.Win32Exception

      End If

      PEB = Marshal.PtrToStructure(Ptr1, GetType(PEB32))

      Marshal.Release(Ptr1)



      Dim Ptr2 As IntPtr = Marshal.AllocHGlobal(Marshal.SizeOf(peb_data))

      If ReadProcessMemory(PH, PEB.LoaderData, Ptr2, Marshal.SizeOf(peb_data), 0) = False Then

      Throw New System.ComponentModel.Win32Exception

      End If

      peb_data = Marshal.PtrToStructure(Ptr2, GetType(PEB_LDR_DATA))

      Marshal.Release(Ptr2)



      Dim Ptr3 As IntPtr = Marshal.AllocHGlobal(Marshal.SizeOf(ldr_module))

      If ReadProcessMemory(PH, peb_data.InLoadOrderModuleList.Flink, Ptr3, Marshal.SizeOf(ldr_module), 0) = False Then

      Throw New System.ComponentModel.Win32Exception

      End If

      ldr_module = Marshal.PtrToStructure(Ptr3, GetType(LDR_MODULE))

      Marshal.Release(Ptr3)



      Dim Ptr4 As IntPtr = Marshal.AllocHGlobal(ldr_module.FullDllName.MaximumLength)



      If ReadProcessMemory(PH, ldr_module.FullDllName.Buffer, Ptr4, ldr_module.FullDllName.MaximumLength, 0) = False Then

      Throw New System.ComponentModel.Win32Exception

      End If

      Return Marshal.PtrToStringUni(Ptr4, ldr_module.FullDllName.MaximumLength)



    End Function



End Class