typedef struct _PEB                                                                               // 84 elements, 0x238 bytes (sizeof)
          {
/*0x000*/     UINT8        InheritedAddressSpace;
/*0x001*/     UINT8        ReadImageFileExecOptions;
/*0x002*/     UINT8        BeingDebugged;
              union                                                                                         // 2 elements, 0x1 bytes (sizeof)
              {
/*0x003*/         UINT8        BitField;
                  struct                                                                                    // 6 elements, 0x1 bytes (sizeof)
                  {
/*0x003*/             UINT8        ImageUsesLargePages : 1;                                                 // 0 BitPosition
/*0x003*/             UINT8        IsProtectedProcess : 1;                                                  // 1 BitPosition
/*0x003*/             UINT8        IsLegacyProcess : 1;                                                     // 2 BitPosition
/*0x003*/             UINT8        IsImageDynamicallyRelocated : 1;                                         // 3 BitPosition
/*0x003*/             UINT8        SkipPatchingUser32Forwarders : 1;                                        // 4 BitPosition
/*0x003*/             UINT8        SpareBits : 3;                                                           // 5 BitPosition
                  };
              };
/*0x004*/     VOID*        Mutant;
/*0x008*/     VOID*        ImageBaseAddress;
/*0x00C*/     struct _PEB_LDR_DATA* Ldr;
/*0x010*/     struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
/*0x014*/     VOID*        SubSystemData;
/*0x018*/     VOID*        ProcessHeap;
/*0x01C*/     struct _RTL_CRITICAL_SECTION* FastPebLock;
/*0x020*/     VOID*        AtlThunkSListPtr;
/*0x024*/     VOID*        IFEOKey;
              union                                                                                         // 2 elements, 0x4 bytes (sizeof)
              {
/*0x028*/         ULONG32      CrossProcessFlags;
                  struct                                                                                    // 5 elements, 0x4 bytes (sizeof)
                  {
/*0x028*/             ULONG32      ProcessInJob : 1;                                                        // 0 BitPosition
/*0x028*/             ULONG32      ProcessInitializing : 1;                                                 // 1 BitPosition
/*0x028*/             ULONG32      ProcessUsingVEH : 1;                                                     // 2 BitPosition
/*0x028*/             ULONG32      ProcessUsingVCH : 1;                                                     // 3 BitPosition
/*0x028*/             ULONG32      ReservedBits0 : 28;                                                      // 4 BitPosition
                  };
              };
              union                                                                                         // 2 elements, 0x4 bytes (sizeof)
              {
/*0x02C*/         VOID*        KernelCallbackTable;
/*0x02C*/         VOID*        UserSharedInfoPtr;
              };
/*0x030*/     ULONG32      SystemReserved[1];
/*0x034*/     ULONG32      SpareUlong;
/*0x038*/     ULONG32      SparePebPtr0;
/*0x03C*/     ULONG32      TlsExpansionCounter;
/*0x040*/     VOID*        TlsBitmap;
/*0x044*/     ULONG32      TlsBitmapBits[2];
/*0x04C*/     VOID*        ReadOnlySharedMemoryBase;
/*0x050*/     VOID*        HotpatchInformation;
/*0x054*/     VOID**       ReadOnlyStaticServerData;
/*0x058*/     VOID*        AnsiCodePageData;
/*0x05C*/     VOID*        OemCodePageData;
/*0x060*/     VOID*        UnicodeCaseTableData;
/*0x064*/     ULONG32      NumberOfProcessors;
/*0x068*/     ULONG32      NtGlobalFlag;
/*0x06C*/     UINT8        _PADDING0_[0x4];
/*0x070*/     union _LARGE_INTEGER CriticalSectionTimeout;                                                  // 4 elements, 0x8 bytes (sizeof)
/*0x078*/     ULONG32      HeapSegmentReserve;
/*0x07C*/     ULONG32      HeapSegmentCommit;
/*0x080*/     ULONG32      HeapDeCommitTotalFreeThreshold;
/*0x084*/     ULONG32      HeapDeCommitFreeBlockThreshold;
/*0x088*/     ULONG32      NumberOfHeaps;
/*0x08C*/     ULONG32      MaximumNumberOfHeaps;
/*0x090*/     VOID**       ProcessHeaps;
/*0x094*/     VOID*        GdiSharedHandleTable;
/*0x098*/     VOID*        ProcessStarterHelper;
/*0x09C*/     ULONG32      GdiDCAttributeList;
/*0x0A0*/     struct _RTL_CRITICAL_SECTION* LoaderLock;
/*0x0A4*/     ULONG32      OSMajorVersion;
/*0x0A8*/     ULONG32      OSMinorVersion;
/*0x0AC*/     UINT16       OSBuildNumber;
/*0x0AE*/     UINT16       OSCSDVersion;
/*0x0B0*/     ULONG32      OSPlatformId;
/*0x0B4*/     ULONG32      ImageSubsystem;
/*0x0B8*/     ULONG32      ImageSubsystemMajorVersion;
/*0x0BC*/     ULONG32      ImageSubsystemMinorVersion;
/*0x0C0*/     ULONG32      ActiveProcessAffinityMask;
/*0x0C4*/     ULONG32      GdiHandleBuffer[34];
/*0x14C*/     PVOID PostProcessInitRoutine;
/*0x150*/     VOID*        TlsExpansionBitmap;
/*0x154*/     ULONG32      TlsExpansionBitmapBits[32];
/*0x1D4*/     ULONG32      SessionId;
/*0x1D8*/     union _ULARGE_INTEGER AppCompatFlags;                                                         // 4 elements, 0x8 bytes (sizeof)
/*0x1E0*/     union _ULARGE_INTEGER AppCompatFlagsUser;                                                     // 4 elements, 0x8 bytes (sizeof)
/*0x1E8*/     VOID*        pShimData;
/*0x1EC*/     VOID*        AppCompatInfo;
/*0x1F0*/     struct _UNICODE_STRING CSDVersion;                                                            // 3 elements, 0x8 bytes (sizeof)
/*0x1F8*/     struct _ACTIVATION_CONTEXT_DATA* ActivationContextData;
/*0x1FC*/     struct _ASSEMBLY_STORAGE_MAP* ProcessAssemblyStorageMap;
/*0x200*/     struct _ACTIVATION_CONTEXT_DATA* SystemDefaultActivationContextData;
/*0x204*/     struct _ASSEMBLY_STORAGE_MAP* SystemAssemblyStorageMap;
/*0x208*/     ULONG32      MinimumStackCommit;
/*0x20C*/     struct _FLS_CALLBACK_INFO* FlsCallback;
/*0x210*/     struct _LIST_ENTRY FlsListHead;                                                               // 2 elements, 0x8 bytes (sizeof)
/*0x218*/     VOID*        FlsBitmap;
/*0x21C*/     ULONG32      FlsBitmapBits[4];
/*0x22C*/     ULONG32      FlsHighIndex;
/*0x230*/     VOID*        WerRegistrationData;
/*0x234*/     VOID*        WerShipAssertPtr;
          }PEB, *PPEB;
Return to structures/enums list.
Return to O.S. version list.

(c) MoonSols 2010.