The user layer gets the TEB PEB structure address traversal process module. doc

1.fsRegister PointTEBstructure
2.in theteb+0x30Local PointPEBstructure 
3.in thepeb+0x0cLocal PointPeb_ldr_datastructure 
4.in thepeb_ldr_data+0x1cPlace is some dynamic connection library address, as the first point ofNtdll.dll, the second one isKernel32.dll's address.  
Its structure 

UsePEBFindKernerl32Assembly implementation of the address 
mov eax, fs:0x30; PEBthe Address 
mov eax, [eax + 0x0c]; Ldrthe Address 
mov esi, [eax + 0x1c]; FlinkAddress 
Lodsd
mov eax, [eax + 0x08]; eaxis thatKernel32.dllthe Address 

The user layer gets the TEB PEB structure address traversal process module. doc