kd> dt_EPROCESS
nt!_EPROCESS
+0x1b0 Peb : Ptr32 _PEB
kd> dt_peb
nt!_PEB
+0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
kd> dt _RTL_USER_PROCESS_PARAMETERS
nt!_RTL_USER_PROCESS_PARAMETERS
+0x038 ImagePathName : _UNICODE_STRING
kd> dt _UNICODE_STRING
nt!_UNICODE_STRING
+0x000 Length : Uint2B
+0x002 MaximumLength : Uint2B
+0x004 Buffer : Ptr32 Uint2B
kd> !peb
PEB at 7ffdb000
kd> dd 7ffdb000+0x10
7ffdb010 00020000 00000000 00150000 7c99e4c0
kd> dd 0x00020000 +0x038 + 0x4
0002003c 00020650 00720070 000206c0 00010000
kd> db 00020650
00020650 43 00 3a 00 5c 00 50 00-72 00 6f 00 67 00 72 00 C.:.\.P.r.o.g.r.
00020660 61 00 6d 00 20 00 46 00-69 00 6c 00 65 00 73 00 a.m. .F.i.l.e.s.
00020670 5c 00 56 00 4d 00 77 00-61 00 72 00 65 00 5c 00 \.V.M.w.a.r.e.\.
00020680 56 00 4d 00 77 00 61 00-72 00 65 00 20 00 54 00 V.M.w.a.r.e. .T.
00020690 6f 00 6f 00 6c 00 73 00-5c 00 56 00 4d 00 77 00 o.o.l.s.\.V.M.w.
000206a0 61 00 72 00 65 00 53 00-65 00 72 00 76 00 69 00 a.r.e.S.e.r.v.i.
000206b0 63 00 65 00 2e 00 65 00-78 00 65 00 00 00 00 00 c.e...e.x.e.....
kd> dt 0x00020000 +0x038 _UNICODE_STRING
nt!_UNICODE_STRING
"C:\Program Files\VMware\VMware Tools\VMwareService.exe"
+0x000 Length : 0x6c
+0x002 MaximumLength : 0x6e
+0x004 Buffer : 0x00020650 "C:\Program Files\VMware\VMware Tools\VMwareService.exe"