typedef struct _PEB                                                                               // 71 elements, 0x230 bytes (sizeof)
          {
/*0x000*/     UINT8        InheritedAddressSpace;
/*0x001*/     UINT8        ReadImageFileExecOptions;
/*0x002*/     UINT8        BeingDebugged;
/*0x003*/     UINT8        SpareBool;
/*0x004*/     VOID*        Mutant;
/*0x008*/     VOID*        ImageBaseAddress;
/*0x00C*/     struct _PEB_LDR_DATA* Ldr;
/*0x010*/     struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
/*0x014*/     VOID*        SubSystemData;
/*0x018*/     VOID*        ProcessHeap;
/*0x01C*/     struct _RTL_CRITICAL_SECTION* FastPebLock;
/*0x020*/     VOID*        SparePtr1;
/*0x024*/     VOID*        SparePtr2;
/*0x028*/     ULONG32      EnvironmentUpdateCount;
/*0x02C*/     VOID*        KernelCallbackTable;
/*0x030*/     ULONG32      SystemReserved[1];
              struct                                                                                        // 2 elements, 0x4 bytes (sizeof)
              {
/*0x034*/         ULONG32      ExecuteOptions : 2;                                                          // 0 BitPosition
/*0x034*/         ULONG32      SpareBits : 30;                                                              // 2 BitPosition
              };
/*0x038*/     struct _PEB_FREE_BLOCK* FreeList;
/*0x03C*/     ULONG32      TlsExpansionCounter;
/*0x040*/     VOID*        TlsBitmap;
/*0x044*/     ULONG32      TlsBitmapBits[2];
/*0x04C*/     VOID*        ReadOnlySharedMemoryBase;
/*0x050*/     VOID*        ReadOnlySharedMemoryHeap;
/*0x054*/     VOID**       ReadOnlyStaticServerData;
/*0x058*/     VOID*        AnsiCodePageData;
/*0x05C*/     VOID*        OemCodePageData;
/*0x060*/     VOID*        UnicodeCaseTableData;
/*0x064*/     ULONG32      NumberOfProcessors;
/*0x068*/     ULONG32      NtGlobalFlag;
/*0x06C*/     UINT8        _PADDING0_[0x4];
/*0x070*/     union _LARGE_INTEGER CriticalSectionTimeout;                                                  // 4 elements, 0x8 bytes (sizeof)
/*0x078*/     ULONG32      HeapSegmentReserve;
/*0x07C*/     ULONG32      HeapSegmentCommit;
/*0x080*/     ULONG32      HeapDeCommitTotalFreeThreshold;
/*0x084*/     ULONG32      HeapDeCommitFreeBlockThreshold;
/*0x088*/     ULONG32      NumberOfHeaps;
/*0x08C*/     ULONG32      MaximumNumberOfHeaps;
/*0x090*/     VOID**       ProcessHeaps;
/*0x094*/     VOID*        GdiSharedHandleTable;
/*0x098*/     VOID*        ProcessStarterHelper;
/*0x09C*/     ULONG32      GdiDCAttributeList;
/*0x0A0*/     struct _RTL_CRITICAL_SECTION* LoaderLock;
/*0x0A4*/     ULONG32      OSMajorVersion;
/*0x0A8*/     ULONG32      OSMinorVersion;
/*0x0AC*/     UINT16       OSBuildNumber;
/*0x0AE*/     UINT16       OSCSDVersion;
/*0x0B0*/     ULONG32      OSPlatformId;
/*0x0B4*/     ULONG32      ImageSubsystem;
/*0x0B8*/     ULONG32      ImageSubsystemMajorVersion;
/*0x0BC*/     ULONG32      ImageSubsystemMinorVersion;
/*0x0C0*/     ULONG32      ImageProcessAffinityMask;
/*0x0C4*/     ULONG32      GdiHandleBuffer[34];
/*0x14C*/     PVOID PostProcessInitRoutine;
/*0x150*/     VOID*        TlsExpansionBitmap;
/*0x154*/     ULONG32      TlsExpansionBitmapBits[32];
/*0x1D4*/     ULONG32      SessionId;
/*0x1D8*/     union _ULARGE_INTEGER AppCompatFlags;                                                         // 4 elements, 0x8 bytes (sizeof)
/*0x1E0*/     union _ULARGE_INTEGER AppCompatFlagsUser;                                                     // 4 elements, 0x8 bytes (sizeof)
/*0x1E8*/     VOID*        pShimData;
/*0x1EC*/     VOID*        AppCompatInfo;
/*0x1F0*/     struct _UNICODE_STRING CSDVersion;                                                            // 3 elements, 0x8 bytes (sizeof)
/*0x1F8*/     struct _ACTIVATION_CONTEXT_DATA* ActivationContextData;
/*0x1FC*/     struct _ASSEMBLY_STORAGE_MAP* ProcessAssemblyStorageMap;
/*0x200*/     struct _ACTIVATION_CONTEXT_DATA* SystemDefaultActivationContextData;
/*0x204*/     struct _ASSEMBLY_STORAGE_MAP* SystemAssemblyStorageMap;
/*0x208*/     ULONG32      MinimumStackCommit;
/*0x20C*/     VOID**       FlsCallback;
/*0x210*/     struct _LIST_ENTRY FlsListHead;                                                               // 2 elements, 0x8 bytes (sizeof)
/*0x218*/     VOID*        FlsBitmap;
/*0x21C*/     ULONG32      FlsBitmapBits[4];
/*0x22C*/     ULONG32      FlsHighIndex;
          }PEB, *PPEB;
Return to structures/enums list.
Return to O.S. version list.

(c) MoonSols 2010.