typedef struct _PEB64                                     // 81 elements, 0x368 bytes (sizeof)
          {
/*0x000*/     UINT8        InheritedAddressSpace;
/*0x001*/     UINT8        ReadImageFileExecOptions;
/*0x002*/     UINT8        BeingDebugged;
              union                                                 // 2 elements, 0x1 bytes (sizeof)
              {
/*0x003*/         UINT8        BitField;
                  struct                                            // 5 elements, 0x1 bytes (sizeof)
                  {
/*0x003*/             UINT8        ImageUsesLargePages : 1;         // 0 BitPosition
/*0x003*/             UINT8        IsProtectedProcess : 1;          // 1 BitPosition
/*0x003*/             UINT8        IsLegacyProcess : 1;             // 2 BitPosition
/*0x003*/             UINT8        IsImageDynamicallyRelocated : 1; // 3 BitPosition
/*0x003*/             UINT8        SpareBits : 4;                   // 4 BitPosition
                  };
              };
/*0x008*/     UINT64       Mutant;
/*0x010*/     UINT64       ImageBaseAddress;
/*0x018*/     UINT64       Ldr;
/*0x020*/     UINT64       ProcessParameters;
/*0x028*/     UINT64       SubSystemData;
/*0x030*/     UINT64       ProcessHeap;
/*0x038*/     UINT64       FastPebLock;
/*0x040*/     UINT64       AtlThunkSListPtr;
/*0x048*/     UINT64       IFEOKey;
              union                                                 // 2 elements, 0x4 bytes (sizeof)
              {
/*0x050*/         ULONG32      CrossProcessFlags;
                  struct                                            // 3 elements, 0x4 bytes (sizeof)
                  {
/*0x050*/             ULONG32      ProcessInJob : 1;                // 0 BitPosition
/*0x050*/             ULONG32      ProcessInitializing : 1;         // 1 BitPosition
/*0x050*/             ULONG32      ReservedBits0 : 30;              // 2 BitPosition
                  };
              };
              union                                                 // 2 elements, 0x8 bytes (sizeof)
              {
/*0x058*/         UINT64       KernelCallbackTable;
/*0x058*/         UINT64       UserSharedInfoPtr;
              };
/*0x060*/     ULONG32      SystemReserved[1];
/*0x064*/     ULONG32      SpareUlong;
/*0x068*/     UINT64       FreeList;
/*0x070*/     ULONG32      TlsExpansionCounter;
/*0x074*/     UINT8        _PADDING0_[0x4];
/*0x078*/     UINT64       TlsBitmap;
/*0x080*/     ULONG32      TlsBitmapBits[2];
/*0x088*/     UINT64       ReadOnlySharedMemoryBase;
/*0x090*/     UINT64       HotpatchInformation;
/*0x098*/     UINT64       ReadOnlyStaticServerData;
/*0x0A0*/     UINT64       AnsiCodePageData;
/*0x0A8*/     UINT64       OemCodePageData;
/*0x0B0*/     UINT64       UnicodeCaseTableData;
/*0x0B8*/     ULONG32      NumberOfProcessors;
/*0x0BC*/     ULONG32      NtGlobalFlag;
/*0x0C0*/     union _LARGE_INTEGER CriticalSectionTimeout;          // 4 elements, 0x8 bytes (sizeof)
/*0x0C8*/     UINT64       HeapSegmentReserve;
/*0x0D0*/     UINT64       HeapSegmentCommit;
/*0x0D8*/     UINT64       HeapDeCommitTotalFreeThreshold;
/*0x0E0*/     UINT64       HeapDeCommitFreeBlockThreshold;
/*0x0E8*/     ULONG32      NumberOfHeaps;
/*0x0EC*/     ULONG32      MaximumNumberOfHeaps;
/*0x0F0*/     UINT64       ProcessHeaps;
/*0x0F8*/     UINT64       GdiSharedHandleTable;
/*0x100*/     UINT64       ProcessStarterHelper;
/*0x108*/     ULONG32      GdiDCAttributeList;
/*0x10C*/     UINT8        _PADDING1_[0x4];
/*0x110*/     UINT64       LoaderLock;
/*0x118*/     ULONG32      OSMajorVersion;
/*0x11C*/     ULONG32      OSMinorVersion;
/*0x120*/     UINT16       OSBuildNumber;
/*0x122*/     UINT16       OSCSDVersion;
/*0x124*/     ULONG32      OSPlatformId;
/*0x128*/     ULONG32      ImageSubsystem;
/*0x12C*/     ULONG32      ImageSubsystemMajorVersion;
/*0x130*/     ULONG32      ImageSubsystemMinorVersion;
/*0x134*/     UINT8        _PADDING2_[0x4];
/*0x138*/     UINT64       ImageProcessAffinityMask;
/*0x140*/     ULONG32      GdiHandleBuffer[60];
/*0x230*/     UINT64       PostProcessInitRoutine;
/*0x238*/     UINT64       TlsExpansionBitmap;
/*0x240*/     ULONG32      TlsExpansionBitmapBits[32];
/*0x2C0*/     ULONG32      SessionId;
/*0x2C4*/     UINT8        _PADDING3_[0x4];
/*0x2C8*/     union _ULARGE_INTEGER AppCompatFlags;                 // 4 elements, 0x8 bytes (sizeof)
/*0x2D0*/     union _ULARGE_INTEGER AppCompatFlagsUser;             // 4 elements, 0x8 bytes (sizeof)
/*0x2D8*/     UINT64       pShimData;
/*0x2E0*/     UINT64       AppCompatInfo;
/*0x2E8*/     struct _STRING64 CSDVersion;                          // 3 elements, 0x10 bytes (sizeof)
/*0x2F8*/     UINT64       ActivationContextData;
/*0x300*/     UINT64       ProcessAssemblyStorageMap;
/*0x308*/     UINT64       SystemDefaultActivationContextData;
/*0x310*/     UINT64       SystemAssemblyStorageMap;
/*0x318*/     UINT64       MinimumStackCommit;
/*0x320*/     UINT64       FlsCallback;
/*0x328*/     struct _LIST_ENTRY64 FlsListHead;                     // 2 elements, 0x10 bytes (sizeof)
/*0x338*/     UINT64       FlsBitmap;
/*0x340*/     ULONG32      FlsBitmapBits[4];
/*0x350*/     ULONG32      FlsHighIndex;
/*0x354*/     UINT8        _PADDING4_[0x4];
/*0x358*/     UINT64       WerRegistrationData;
/*0x360*/     UINT64       WerShipAssertPtr;
          }PEB64, *PPEB64;
Return to structures/enums list.
Return to O.S. version list.

(c) MoonSols 2010.