typedef struct _PEB32                                      // 84 elements, 0x238 bytes (sizeof)
          {
/*0x000*/     UINT8        InheritedAddressSpace;
/*0x001*/     UINT8        ReadImageFileExecOptions;
/*0x002*/     UINT8        BeingDebugged;
              union                                                  // 2 elements, 0x1 bytes (sizeof)
              {
/*0x003*/         UINT8        BitField;
                  struct                                             // 6 elements, 0x1 bytes (sizeof)
                  {
/*0x003*/             UINT8        ImageUsesLargePages : 1;          // 0 BitPosition
/*0x003*/             UINT8        IsProtectedProcess : 1;           // 1 BitPosition
/*0x003*/             UINT8        IsLegacyProcess : 1;              // 2 BitPosition
/*0x003*/             UINT8        IsImageDynamicallyRelocated : 1;  // 3 BitPosition
/*0x003*/             UINT8        SkipPatchingUser32Forwarders : 1; // 4 BitPosition
/*0x003*/             UINT8        SpareBits : 3;                    // 5 BitPosition
                  };
              };
/*0x004*/     ULONG32      Mutant;
/*0x008*/     ULONG32      ImageBaseAddress;
/*0x00C*/     ULONG32      Ldr;
/*0x010*/     ULONG32      ProcessParameters;
/*0x014*/     ULONG32      SubSystemData;
/*0x018*/     ULONG32      ProcessHeap;
/*0x01C*/     ULONG32      FastPebLock;
/*0x020*/     ULONG32      AtlThunkSListPtr;
/*0x024*/     ULONG32      IFEOKey;
              union                                                  // 2 elements, 0x4 bytes (sizeof)
              {
/*0x028*/         ULONG32      CrossProcessFlags;
                  struct                                             // 5 elements, 0x4 bytes (sizeof)
                  {
/*0x028*/             ULONG32      ProcessInJob : 1;                 // 0 BitPosition
/*0x028*/             ULONG32      ProcessInitializing : 1;          // 1 BitPosition
/*0x028*/             ULONG32      ProcessUsingVEH : 1;              // 2 BitPosition
/*0x028*/             ULONG32      ProcessUsingVCH : 1;              // 3 BitPosition
/*0x028*/             ULONG32      ReservedBits0 : 28;               // 4 BitPosition
                  };
              };
              union                                                  // 2 elements, 0x4 bytes (sizeof)
              {
/*0x02C*/         ULONG32      KernelCallbackTable;
/*0x02C*/         ULONG32      UserSharedInfoPtr;
              };
/*0x030*/     ULONG32      SystemReserved[1];
/*0x034*/     ULONG32      SpareUlong;
/*0x038*/     ULONG32      SparePebPtr0;
/*0x03C*/     ULONG32      TlsExpansionCounter;
/*0x040*/     ULONG32      TlsBitmap;
/*0x044*/     ULONG32      TlsBitmapBits[2];
/*0x04C*/     ULONG32      ReadOnlySharedMemoryBase;
/*0x050*/     ULONG32      HotpatchInformation;
/*0x054*/     ULONG32      ReadOnlyStaticServerData;
/*0x058*/     ULONG32      AnsiCodePageData;
/*0x05C*/     ULONG32      OemCodePageData;
/*0x060*/     ULONG32      UnicodeCaseTableData;
/*0x064*/     ULONG32      NumberOfProcessors;
/*0x068*/     ULONG32      NtGlobalFlag;
/*0x06C*/     UINT8        _PADDING0_[0x4];
/*0x070*/     union _LARGE_INTEGER CriticalSectionTimeout;           // 4 elements, 0x8 bytes (sizeof)
/*0x078*/     ULONG32      HeapSegmentReserve;
/*0x07C*/     ULONG32      HeapSegmentCommit;
/*0x080*/     ULONG32      HeapDeCommitTotalFreeThreshold;
/*0x084*/     ULONG32      HeapDeCommitFreeBlockThreshold;
/*0x088*/     ULONG32      NumberOfHeaps;
/*0x08C*/     ULONG32      MaximumNumberOfHeaps;
/*0x090*/     ULONG32      ProcessHeaps;
/*0x094*/     ULONG32      GdiSharedHandleTable;
/*0x098*/     ULONG32      ProcessStarterHelper;
/*0x09C*/     ULONG32      GdiDCAttributeList;
/*0x0A0*/     ULONG32      LoaderLock;
/*0x0A4*/     ULONG32      OSMajorVersion;
/*0x0A8*/     ULONG32      OSMinorVersion;
/*0x0AC*/     UINT16       OSBuildNumber;
/*0x0AE*/     UINT16       OSCSDVersion;
/*0x0B0*/     ULONG32      OSPlatformId;
/*0x0B4*/     ULONG32      ImageSubsystem;
/*0x0B8*/     ULONG32      ImageSubsystemMajorVersion;
/*0x0BC*/     ULONG32      ImageSubsystemMinorVersion;
/*0x0C0*/     ULONG32      ActiveProcessAffinityMask;
/*0x0C4*/     ULONG32      GdiHandleBuffer[34];
/*0x14C*/     ULONG32      PostProcessInitRoutine;
/*0x150*/     ULONG32      TlsExpansionBitmap;
/*0x154*/     ULONG32      TlsExpansionBitmapBits[32];
/*0x1D4*/     ULONG32      SessionId;
/*0x1D8*/     union _ULARGE_INTEGER AppCompatFlags;                  // 4 elements, 0x8 bytes (sizeof)
/*0x1E0*/     union _ULARGE_INTEGER AppCompatFlagsUser;              // 4 elements, 0x8 bytes (sizeof)
/*0x1E8*/     ULONG32      pShimData;
/*0x1EC*/     ULONG32      AppCompatInfo;
/*0x1F0*/     struct _STRING32 CSDVersion;                           // 3 elements, 0x8 bytes (sizeof)
/*0x1F8*/     ULONG32      ActivationContextData;
/*0x1FC*/     ULONG32      ProcessAssemblyStorageMap;
/*0x200*/     ULONG32      SystemDefaultActivationContextData;
/*0x204*/     ULONG32      SystemAssemblyStorageMap;
/*0x208*/     ULONG32      MinimumStackCommit;
/*0x20C*/     ULONG32      FlsCallback;
/*0x210*/     struct _LIST_ENTRY32 FlsListHead;                      // 2 elements, 0x8 bytes (sizeof)
/*0x218*/     ULONG32      FlsBitmap;
/*0x21C*/     ULONG32      FlsBitmapBits[4];
/*0x22C*/     ULONG32      FlsHighIndex;
/*0x230*/     ULONG32      WerRegistrationData;
/*0x234*/     ULONG32      WerShipAssertPtr;
          }PEB32, *PPEB32;
Return to structures/enums list.
Return to O.S. version list.

(c) MoonSols 2010.