PageRenderTime 55ms CodeModel.GetById 19ms RepoModel.GetById 0ms app.codeStats 0ms

/python/helpers/pydev/pydevd_attach_to_process/winappdbg/win32/peb_teb.py

http://github.com/JetBrains/intellij-community
Python | 3435 lines | 1692 code | 72 blank | 1671 comment | 47 complexity | 6d56e5b1c3a1d599fb5dd8695c77f236 MD5 | raw file
Possible License(s): BSD-3-Clause, Apache-2.0, MPL-2.0-no-copyleft-exception, MIT, EPL-1.0, AGPL-1.0

Large files files are truncated, but you can click here to view the full file

    

  1. #!/usr/bin/env python
    2. 

  2. # -*- coding: utf-8 -*-
    3. 

  3. 

  4. # Copyright (c) 2009-2014, Mario Vilas
    5. 

  5. # All rights reserved.
    6. 

  6. #
    7. 

  7. # Redistribution and use in source and binary forms, with or without
    8. 

  8. # modification, are permitted provided that the following conditions are met:
    9. 

  9. #
    10. 

  10. #     * Redistributions of source code must retain the above copyright notice,
    11. 

  11. #       this list of conditions and the following disclaimer.
    12. 

  12. #     * Redistributions in binary form must reproduce the above copyright
    13. 

  13. #       notice,this list of conditions and the following disclaimer in the
    14. 

  14. #       documentation and/or other materials provided with the distribution.
    15. 

  15. #     * Neither the name of the copyright holder nor the names of its
    16. 

  16. #       contributors may be used to endorse or promote products derived from
    17. 

  17. #       this software without specific prior written permission.
    18. 

  18. #
    19. 

  19. # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
    20. 

  20. # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
    21. 

  21. # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    22. 

  22. # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
    23. 

  23. # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
    24. 

  24. # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    25. 

  25. # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
    26. 

  26. # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
    27. 

  27. # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    28. 

  28. # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
    29. 

  29. # POSSIBILITY OF SUCH DAMAGE.
    30. 

  30. 

  31. """
    32. 

  32. PEB and TEB structures, constants and data types.
    33. 

  33. """
    34. 

    35. 

  35. __revision__ = "$Id$"
    36. 

  36. 

  37. from winappdbg.win32.defines import *
    38. 

  38. from winappdbg.win32.version import os
    39. 

  39. 

  40. #==============================================================================
    41. 

  41. # This is used later on to calculate the list of exported symbols.
    42. 

  42. _all = None
    43. 

  43. _all = set(vars().keys())
    44. 

  44. #==============================================================================
    45. 

  45. 

  46. #--- PEB and TEB structures, constants and data types -------------------------
    47. 

  47. 

  48. # From http://www.nirsoft.net/kernel_struct/vista/CLIENT_ID.html
    49. 

  49. #
    50. 

  50. # typedef struct _CLIENT_ID
    51. 

  51. # {
    52. 

  52. #     PVOID UniqueProcess;
    53. 

  53. #     PVOID UniqueThread;
    54. 

  54. # } CLIENT_ID, *PCLIENT_ID;
    55. 

  55. class CLIENT_ID(Structure):
    56. 

  56.     _fields_ = [
    57. 

  57.         ("UniqueProcess",   PVOID),
    58. 

  58.         ("UniqueThread",    PVOID),
    59. 

  59. ]
    60. 

  60. 

  61. # From MSDN:
    62. 

  62. #
    63. 

  63. # typedef struct _LDR_DATA_TABLE_ENTRY {
    64. 

  64. #     BYTE Reserved1[2];
    65. 

  65. #     LIST_ENTRY InMemoryOrderLinks;
    66. 

  66. #     PVOID Reserved2[2];
    67. 

  67. #     PVOID DllBase;
    68. 

  68. #     PVOID EntryPoint;
    69. 

  69. #     PVOID Reserved3;
    70. 

  70. #     UNICODE_STRING FullDllName;
    71. 

  71. #     BYTE Reserved4[8];
    72. 

  72. #     PVOID Reserved5[3];
    73. 

  73. #     union {
    74. 

  74. #         ULONG CheckSum;
    75. 

  75. #         PVOID Reserved6;
    76. 

  76. #     };
    77. 

  77. #     ULONG TimeDateStamp;
    78. 

  78. # } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
    79. 

  79. ##class LDR_DATA_TABLE_ENTRY(Structure):
    80. 

  80. ##    _fields_ = [
    81. 

  81. ##        ("Reserved1",           BYTE * 2),
    82. 

  82. ##        ("InMemoryOrderLinks",  LIST_ENTRY),
    83. 

  83. ##        ("Reserved2",           PVOID * 2),
    84. 

  84. ##        ("DllBase",             PVOID),
    85. 

  85. ##        ("EntryPoint",          PVOID),
    86. 

  86. ##        ("Reserved3",           PVOID),
    87. 

  87. ##        ("FullDllName",           UNICODE_STRING),
    88. 

  88. ##        ("Reserved4",           BYTE * 8),
    89. 

  89. ##        ("Reserved5",           PVOID * 3),
    90. 

  90. ##        ("CheckSum",            ULONG),
    91. 

  91. ##        ("TimeDateStamp",       ULONG),
    92. 

  92. ##]
    93. 

  93. 

  94. # From MSDN:
    95. 

  95. #
    96. 

  96. # typedef struct _PEB_LDR_DATA {
    97. 

  97. #   BYTE         Reserved1[8];
    98. 

  98. #   PVOID        Reserved2[3];
    99. 

  99. #   LIST_ENTRY   InMemoryOrderModuleList;
    100. 

  100. # } PEB_LDR_DATA,
    101. 

  101. #  *PPEB_LDR_DATA;
    102. 

  102. ##class PEB_LDR_DATA(Structure):
    103. 

  103. ##    _fields_ = [
    104. 

  104. ##        ("Reserved1",               BYTE),
    105. 

  105. ##        ("Reserved2",               PVOID),
    106. 

  106. ##        ("InMemoryOrderModuleList", LIST_ENTRY),
    107. 

  107. ##]
    108. 

  108. 

  109. # From http://undocumented.ntinternals.net/UserMode/Structures/RTL_USER_PROCESS_PARAMETERS.html
    110. 

  110. # typedef struct _RTL_USER_PROCESS_PARAMETERS {
    111. 

  111. #   ULONG                   MaximumLength;
    112. 

  112. #   ULONG                   Length;
    113. 

  113. #   ULONG                   Flags;
    114. 

  114. #   ULONG                   DebugFlags;
    115. 

  115. #   PVOID                   ConsoleHandle;
    116. 

  116. #   ULONG                   ConsoleFlags;
    117. 

  117. #   HANDLE                  StdInputHandle;
    118. 

  118. #   HANDLE                  StdOutputHandle;
    119. 

  119. #   HANDLE                  StdErrorHandle;
    120. 

  120. #   UNICODE_STRING          CurrentDirectoryPath;
    121. 

  121. #   HANDLE                  CurrentDirectoryHandle;
    122. 

  122. #   UNICODE_STRING          DllPath;
    123. 

  123. #   UNICODE_STRING          ImagePathName;
    124. 

  124. #   UNICODE_STRING          CommandLine;
    125. 

  125. #   PVOID                   Environment;
    126. 

  126. #   ULONG                   StartingPositionLeft;
    127. 

  127. #   ULONG                   StartingPositionTop;
    128. 

  128. #   ULONG                   Width;
    129. 

  129. #   ULONG                   Height;
    130. 

  130. #   ULONG                   CharWidth;
    131. 

  131. #   ULONG                   CharHeight;
    132. 

  132. #   ULONG                   ConsoleTextAttributes;
    133. 

  133. #   ULONG                   WindowFlags;
    134. 

  134. #   ULONG                   ShowWindowFlags;
    135. 

  135. #   UNICODE_STRING          WindowTitle;
    136. 

  136. #   UNICODE_STRING          DesktopName;
    137. 

  137. #   UNICODE_STRING          ShellInfo;
    138. 

  138. #   UNICODE_STRING          RuntimeData;
    139. 

  139. #   RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
    140. 

  140. # } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
    141. 

  141. 

  142. # kd> dt _RTL_USER_PROCESS_PARAMETERS
    143. 

  143. # ntdll!_RTL_USER_PROCESS_PARAMETERS
    144. 

  144. #    +0x000 MaximumLength    : Uint4B
    145. 

  145. #    +0x004 Length           : Uint4B
    146. 

  146. #    +0x008 Flags            : Uint4B
    147. 

  147. #    +0x00c DebugFlags       : Uint4B
    148. 

  148. #    +0x010 ConsoleHandle    : Ptr32 Void
    149. 

  149. #    +0x014 ConsoleFlags     : Uint4B
    150. 

  150. #    +0x018 StandardInput    : Ptr32 Void
    151. 

  151. #    +0x01c StandardOutput   : Ptr32 Void
    152. 

  152. #    +0x020 StandardError    : Ptr32 Void
    153. 

  153. #    +0x024 CurrentDirectory : _CURDIR
    154. 

  154. #    +0x030 DllPath          : _UNICODE_STRING
    155. 

  155. #    +0x038 ImagePathName    : _UNICODE_STRING
    156. 

  156. #    +0x040 CommandLine      : _UNICODE_STRING
    157. 

  157. #    +0x048 Environment      : Ptr32 Void
    158. 

  158. #    +0x04c StartingX        : Uint4B
    159. 

  159. #    +0x050 StartingY        : Uint4B
    160. 

  160. #    +0x054 CountX           : Uint4B
    161. 

  161. #    +0x058 CountY           : Uint4B
    162. 

  162. #    +0x05c CountCharsX      : Uint4B
    163. 

  163. #    +0x060 CountCharsY      : Uint4B
    164. 

  164. #    +0x064 FillAttribute    : Uint4B
    165. 

  165. #    +0x068 WindowFlags      : Uint4B
    166. 

  166. #    +0x06c ShowWindowFlags  : Uint4B
    167. 

  167. #    +0x070 WindowTitle      : _UNICODE_STRING
    168. 

  168. #    +0x078 DesktopInfo      : _UNICODE_STRING
    169. 

  169. #    +0x080 ShellInfo        : _UNICODE_STRING
    170. 

  170. #    +0x088 RuntimeData      : _UNICODE_STRING
    171. 

  171. #    +0x090 CurrentDirectores : [32] _RTL_DRIVE_LETTER_CURDIR
    172. 

  172. #    +0x290 EnvironmentSize  : Uint4B
    173. 

  173. ##class RTL_USER_PROCESS_PARAMETERS(Structure):
    174. 

  174. ##    _fields_ = [
    175. 

  175. ##        ("MaximumLength",           ULONG),
    176. 

  176. ##        ("Length",                  ULONG),
    177. 

  177. ##        ("Flags",                   ULONG),
    178. 

  178. ##        ("DebugFlags",              ULONG),
    179. 

  179. ##        ("ConsoleHandle",           PVOID),
    180. 

  180. ##        ("ConsoleFlags",            ULONG),
    181. 

  181. ##        ("StandardInput",           HANDLE),
    182. 

  182. ##        ("StandardOutput",          HANDLE),
    183. 

  183. ##        ("StandardError",           HANDLE),
    184. 

  184. ##        ("CurrentDirectory",        CURDIR),
    185. 

  185. ##        ("DllPath",                 UNICODE_STRING),
    186. 

  186. ##        ("ImagePathName",           UNICODE_STRING),
    187. 

  187. ##        ("CommandLine",             UNICODE_STRING),
    188. 

  188. ##        ("Environment",             PVOID),
    189. 

  189. ##        ("StartingX",               ULONG),
    190. 

  190. ##        ("StartingY",               ULONG),
    191. 

  191. ##        ("CountX",                  ULONG),
    192. 

  192. ##        ("CountY",                  ULONG),
    193. 

  193. ##        ("CountCharsX",             ULONG),
    194. 

  194. ##        ("CountCharsY",             ULONG),
    195. 

  195. ##        ("FillAttribute",           ULONG),
    196. 

  196. ##        ("WindowFlags",             ULONG),
    197. 

  197. ##        ("ShowWindowFlags",         ULONG),
    198. 

  198. ##        ("WindowTitle",             UNICODE_STRING),
    199. 

  199. ##        ("DesktopInfo",             UNICODE_STRING),
    200. 

  200. ##        ("ShellInfo",               UNICODE_STRING),
    201. 

  201. ##        ("RuntimeData",             UNICODE_STRING),
    202. 

  202. ##        ("CurrentDirectores",       RTL_DRIVE_LETTER_CURDIR * 32), # typo here?
    203. 

  203. ##
    204. 

  204. ##        # Windows 2008 and Vista
    205. 

  205. ##        ("EnvironmentSize",         ULONG),
    206. 

  206. ##]
    207. 

  207. ##    @property
    208. 

  208. ##    def CurrentDirectories(self):
    209. 

  209. ##        return self.CurrentDirectores
    210. 

  210. 

  211. # From MSDN:
    212. 

  212. #
    213. 

  213. # typedef struct _RTL_USER_PROCESS_PARAMETERS {
    214. 

  214. #   BYTE             Reserved1[16];
    215. 

  215. #   PVOID            Reserved2[10];
    216. 

  216. #   UNICODE_STRING   ImagePathName;
    217. 

  217. #   UNICODE_STRING   CommandLine;
    218. 

  218. # } RTL_USER_PROCESS_PARAMETERS,
    219. 

  219. #  *PRTL_USER_PROCESS_PARAMETERS;
    220. 

  220. class RTL_USER_PROCESS_PARAMETERS(Structure):
    221. 

  221.     _fields_ = [
    222. 

  222.         ("Reserved1",               BYTE * 16),
    223. 

  223.         ("Reserved2",               PVOID * 10),
    224. 

  224.         ("ImagePathName",           UNICODE_STRING),
    225. 

  225.         ("CommandLine",             UNICODE_STRING),
    226. 

  226.         ("Environment",             PVOID),             # undocumented!
    227. 

  227.         #
    228. 

  228.         # XXX TODO
    229. 

  229.         # This structure should be defined with all undocumented fields for
    230. 

  230.         # each version of Windows, just like it's being done for PEB and TEB.
    231. 

  231.         #
    232. 

  232. ]
    233. 

  233. 

  234. PPS_POST_PROCESS_INIT_ROUTINE = PVOID
    235. 

  235. 

  236. #from MSDN:
    237. 

  237. #
    238. 

  238. # typedef struct _PEB {
    239. 

  239. #     BYTE Reserved1[2];
    240. 

  240. #     BYTE BeingDebugged;
    241. 

  241. #     BYTE Reserved2[21];
    242. 

  242. #     PPEB_LDR_DATA LoaderData;
    243. 

  243. #     PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    244. 

  244. #     BYTE Reserved3[520];
    245. 

  245. #     PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
    246. 

  246. #     BYTE Reserved4[136];
    247. 

  247. #     ULONG SessionId;
    248. 

  248. # } PEB;
    249. 

  249. ##class PEB(Structure):
    250. 

  250. ##    _fields_ = [
    251. 

  251. ##        ("Reserved1",               BYTE * 2),
    252. 

  252. ##        ("BeingDebugged",           BYTE),
    253. 

  253. ##        ("Reserved2",               BYTE * 21),
    254. 

  254. ##        ("LoaderData",              PVOID,    # PPEB_LDR_DATA
    255. 

  255. ##        ("ProcessParameters",       PVOID,    # PRTL_USER_PROCESS_PARAMETERS
    256. 

  256. ##        ("Reserved3",               BYTE * 520),
    257. 

  257. ##        ("PostProcessInitRoutine",  PPS_POST_PROCESS_INIT_ROUTINE),
    258. 

  258. ##        ("Reserved4",               BYTE),
    259. 

  259. ##        ("SessionId",               ULONG),
    260. 

  260. ##]
    261. 

  261. 

  262. # from MSDN:
    263. 

  263. #
    264. 

  264. # typedef struct _TEB {
    265. 

  265. #   BYTE    Reserved1[1952];
    266. 

  266. #   PVOID   Reserved2[412];
    267. 

  267. #   PVOID   TlsSlots[64];
    268. 

  268. #   BYTE    Reserved3[8];
    269. 

  269. #   PVOID   Reserved4[26];
    270. 

  270. #   PVOID   ReservedForOle;
    271. 

  271. #   PVOID   Reserved5[4];
    272. 

  272. #   PVOID   TlsExpansionSlots;
    273. 

  273. # } TEB,
    274. 

  274. #  *PTEB;
    275. 

  275. ##class TEB(Structure):
    276. 

  276. ##    _fields_ = [
    277. 

  277. ##        ("Reserved1",           PVOID * 1952),
    278. 

  278. ##        ("Reserved2",           PVOID * 412),
    279. 

  279. ##        ("TlsSlots",            PVOID * 64),
    280. 

  280. ##        ("Reserved3",           BYTE  * 8),
    281. 

  281. ##        ("Reserved4",           PVOID * 26),
    282. 

  282. ##        ("ReservedForOle",      PVOID),
    283. 

  283. ##        ("Reserved5",           PVOID * 4),
    284. 

  284. ##        ("TlsExpansionSlots",   PVOID),
    285. 

  285. ##]
    286. 

  286. 

  287. # from http://undocumented.ntinternals.net/UserMode/Structures/LDR_MODULE.html
    288. 

  288. #
    289. 

  289. # typedef struct _LDR_MODULE {
    290. 

  290. #   LIST_ENTRY InLoadOrderModuleList;
    291. 

  291. #   LIST_ENTRY InMemoryOrderModuleList;
    292. 

  292. #   LIST_ENTRY InInitializationOrderModuleList;
    293. 

  293. #   PVOID BaseAddress;
    294. 

  294. #   PVOID EntryPoint;
    295. 

  295. #   ULONG SizeOfImage;
    296. 

  296. #   UNICODE_STRING FullDllName;
    297. 

  297. #   UNICODE_STRING BaseDllName;
    298. 

  298. #   ULONG Flags;
    299. 

  299. #   SHORT LoadCount;
    300. 

  300. #   SHORT TlsIndex;
    301. 

  301. #   LIST_ENTRY HashTableEntry;
    302. 

  302. #   ULONG TimeDateStamp;
    303. 

  303. # } LDR_MODULE, *PLDR_MODULE;
    304. 

  304. class LDR_MODULE(Structure):
    305. 

  305.     _fields_ = [
    306. 

  306.         ("InLoadOrderModuleList",           LIST_ENTRY),
    307. 

  307.         ("InMemoryOrderModuleList",         LIST_ENTRY),
    308. 

  308.         ("InInitializationOrderModuleList", LIST_ENTRY),
    309. 

  309.         ("BaseAddress",                     PVOID),
    310. 

  310.         ("EntryPoint",                      PVOID),
    311. 

  311.         ("SizeOfImage",                     ULONG),
    312. 

  312.         ("FullDllName",                     UNICODE_STRING),
    313. 

  313.         ("BaseDllName",                     UNICODE_STRING),
    314. 

  314.         ("Flags",                           ULONG),
    315. 

  315.         ("LoadCount",                       SHORT),
    316. 

  316.         ("TlsIndex",                        SHORT),
    317. 

  317.         ("HashTableEntry",                  LIST_ENTRY),
    318. 

  318.         ("TimeDateStamp",                   ULONG),
    319. 

  319. ]
    320. 

  320. 

  321. # from http://undocumented.ntinternals.net/UserMode/Structures/PEB_LDR_DATA.html
    322. 

  322. #
    323. 

  323. # typedef struct _PEB_LDR_DATA {
    324. 

  324. #   ULONG Length;
    325. 

  325. #   BOOLEAN Initialized;
    326. 

  326. #   PVOID SsHandle;
    327. 

  327. #   LIST_ENTRY InLoadOrderModuleList;
    328. 

  328. #   LIST_ENTRY InMemoryOrderModuleList;
    329. 

  329. #   LIST_ENTRY InInitializationOrderModuleList;
    330. 

  330. # } PEB_LDR_DATA, *PPEB_LDR_DATA;
    331. 

  331. class PEB_LDR_DATA(Structure):
    332. 

  332.     _fields_ = [
    333. 

  333.         ("Length",                          ULONG),
    334. 

  334.         ("Initialized",                     BOOLEAN),
    335. 

  335.         ("SsHandle",                        PVOID),
    336. 

  336.         ("InLoadOrderModuleList",           LIST_ENTRY),
    337. 

  337.         ("InMemoryOrderModuleList",         LIST_ENTRY),
    338. 

  338.         ("InInitializationOrderModuleList", LIST_ENTRY),
    339. 

  339. ]
    340. 

  340. 

  341. # From http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Process/PEB_FREE_BLOCK.html
    342. 

  342. #
    343. 

  343. # typedef struct _PEB_FREE_BLOCK {
    344. 

  344. #   PEB_FREE_BLOCK *Next;
    345. 

  345. #   ULONG Size;
    346. 

  346. # } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
    347. 

  347. class PEB_FREE_BLOCK(Structure):
    348. 

  348.     pass
    349. 

  349. 

  350. ##PPEB_FREE_BLOCK = POINTER(PEB_FREE_BLOCK)
    351. 

  351. PPEB_FREE_BLOCK = PVOID
    352. 

  352. 

  353. PEB_FREE_BLOCK._fields_ = [
    354. 

  354.         ("Next", PPEB_FREE_BLOCK),
    355. 

  355.         ("Size", ULONG),
    356. 

  356. ]
    357. 

  357. 

  358. # From http://undocumented.ntinternals.net/UserMode/Structures/RTL_DRIVE_LETTER_CURDIR.html
    359. 

  359. #
    360. 

  360. # typedef struct _RTL_DRIVE_LETTER_CURDIR {
    361. 

  361. #   USHORT Flags;
    362. 

  362. #   USHORT Length;
    363. 

  363. #   ULONG TimeStamp;
    364. 

  364. #   UNICODE_STRING DosPath;
    365. 

  365. # } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
    366. 

  366. class RTL_DRIVE_LETTER_CURDIR(Structure):
    367. 

  367.     _fields_ = [
    368. 

  368.         ("Flags",       USHORT),
    369. 

  369.         ("Length",      USHORT),
    370. 

  370.         ("TimeStamp",   ULONG),
    371. 

  371.         ("DosPath",     UNICODE_STRING),
    372. 

  372. ]
    373. 

  373. 

  374. # From http://www.nirsoft.net/kernel_struct/vista/CURDIR.html
    375. 

  375. #
    376. 

  376. # typedef struct _CURDIR
    377. 

  377. # {
    378. 

  378. #      UNICODE_STRING DosPath;
    379. 

  379. #      PVOID Handle;
    380. 

  380. # } CURDIR, *PCURDIR;
    381. 

  381. class CURDIR(Structure):
    382. 

  382.     _fields_ = [
    383. 

  383.         ("DosPath", UNICODE_STRING),
    384. 

  384.         ("Handle",  PVOID),
    385. 

  385. ]
    386. 

  386. 

  387. # From http://www.nirsoft.net/kernel_struct/vista/RTL_CRITICAL_SECTION_DEBUG.html
    388. 

  388. #
    389. 

  389. # typedef struct _RTL_CRITICAL_SECTION_DEBUG
    390. 

  390. # {
    391. 

  391. #      WORD Type;
    392. 

  392. #      WORD CreatorBackTraceIndex;
    393. 

  393. #      PRTL_CRITICAL_SECTION CriticalSection;
    394. 

  394. #      LIST_ENTRY ProcessLocksList;
    395. 

  395. #      ULONG EntryCount;
    396. 

  396. #      ULONG ContentionCount;
    397. 

  397. #      ULONG Flags;
    398. 

  398. #      WORD CreatorBackTraceIndexHigh;
    399. 

  399. #      WORD SpareUSHORT;
    400. 

  400. # } RTL_CRITICAL_SECTION_DEBUG, *PRTL_CRITICAL_SECTION_DEBUG;
    401. 

  401. #
    402. 

  402. # From http://www.nirsoft.net/kernel_struct/vista/RTL_CRITICAL_SECTION.html
    403. 

  403. #
    404. 

  404. # typedef struct _RTL_CRITICAL_SECTION
    405. 

  405. # {
    406. 

  406. #      PRTL_CRITICAL_SECTION_DEBUG DebugInfo;
    407. 

  407. #      LONG LockCount;
    408. 

  408. #      LONG RecursionCount;
    409. 

  409. #      PVOID OwningThread;
    410. 

  410. #      PVOID LockSemaphore;
    411. 

  411. #      ULONG SpinCount;
    412. 

  412. # } RTL_CRITICAL_SECTION, *PRTL_CRITICAL_SECTION;
    413. 

  413. #
    414. 

  414. class RTL_CRITICAL_SECTION(Structure):
    415. 

  415.     _fields_ = [
    416. 

  416.         ("DebugInfo",       PVOID),     # PRTL_CRITICAL_SECTION_DEBUG
    417. 

  417.         ("LockCount",       LONG),
    418. 

  418.         ("RecursionCount",  LONG),
    419. 

  419.         ("OwningThread",    PVOID),
    420. 

  420.         ("LockSemaphore",   PVOID),
    421. 

  421.         ("SpinCount",       ULONG),
    422. 

  422. ]
    423. 

  423. class RTL_CRITICAL_SECTION_DEBUG(Structure):
    424. 

  424.     _fields_ = [
    425. 

  425.         ("Type",                        WORD),
    426. 

  426.         ("CreatorBackTraceIndex",       WORD),
    427. 

  427.         ("CriticalSection",             PVOID),         # PRTL_CRITICAL_SECTION
    428. 

  428.         ("ProcessLocksList",            LIST_ENTRY),
    429. 

  429.         ("EntryCount",                  ULONG),
    430. 

  430.         ("ContentionCount",             ULONG),
    431. 

  431.         ("Flags",                       ULONG),
    432. 

  432.         ("CreatorBackTraceIndexHigh",   WORD),
    433. 

  433.         ("SpareUSHORT",                 WORD),
    434. 

  434. ]
    435. 

  435. PRTL_CRITICAL_SECTION       = POINTER(RTL_CRITICAL_SECTION)
    436. 

  436. PRTL_CRITICAL_SECTION_DEBUG = POINTER(RTL_CRITICAL_SECTION_DEBUG)
    437. 

  437. 

  438. PPEB_LDR_DATA                   = POINTER(PEB_LDR_DATA)
    439. 

  439. PRTL_USER_PROCESS_PARAMETERS    = POINTER(RTL_USER_PROCESS_PARAMETERS)
    440. 

  440. 

  441. PPEBLOCKROUTINE                 = PVOID
    442. 

  442. 

  443. # BitField
    444. 

  444. ImageUsesLargePages             = 1 << 0
    445. 

  445. IsProtectedProcess              = 1 << 1
    446. 

  446. IsLegacyProcess                 = 1 << 2
    447. 

  447. IsImageDynamicallyRelocated     = 1 << 3
    448. 

  448. SkipPatchingUser32Forwarders    = 1 << 4
    449. 

  449. 

  450. # CrossProcessFlags
    451. 

  451. ProcessInJob                    = 1 << 0
    452. 

  452. ProcessInitializing             = 1 << 1
    453. 

  453. ProcessUsingVEH                 = 1 << 2
    454. 

  454. ProcessUsingVCH                 = 1 << 3
    455. 

  455. ProcessUsingFTH                 = 1 << 4
    456. 

  456. 

  457. # TracingFlags
    458. 

  458. HeapTracingEnabled              = 1 << 0
    459. 

  459. CritSecTracingEnabled           = 1 << 1
    460. 

  460. 

  461. # NtGlobalFlags
    462. 

  462. FLG_VALID_BITS                  = 0x003FFFFF    # not a flag
    463. 

  463. FLG_STOP_ON_EXCEPTION           = 0x00000001
    464. 

  464. FLG_SHOW_LDR_SNAPS              = 0x00000002
    465. 

  465. FLG_DEBUG_INITIAL_COMMAND       = 0x00000004
    466. 

  466. FLG_STOP_ON_HUNG_GUI            = 0x00000008
    467. 

  467. FLG_HEAP_ENABLE_TAIL_CHECK      = 0x00000010
    468. 

  468. FLG_HEAP_ENABLE_FREE_CHECK      = 0x00000020
    469. 

  469. FLG_HEAP_VALIDATE_PARAMETERS    = 0x00000040
    470. 

  470. FLG_HEAP_VALIDATE_ALL           = 0x00000080
    471. 

  471. FLG_POOL_ENABLE_TAIL_CHECK      = 0x00000100
    472. 

  472. FLG_POOL_ENABLE_FREE_CHECK      = 0x00000200
    473. 

  473. FLG_POOL_ENABLE_TAGGING         = 0x00000400
    474. 

  474. FLG_HEAP_ENABLE_TAGGING         = 0x00000800
    475. 

  475. FLG_USER_STACK_TRACE_DB         = 0x00001000
    476. 

  476. FLG_KERNEL_STACK_TRACE_DB       = 0x00002000
    477. 

  477. FLG_MAINTAIN_OBJECT_TYPELIST    = 0x00004000
    478. 

  478. FLG_HEAP_ENABLE_TAG_BY_DLL      = 0x00008000
    479. 

  479. FLG_IGNORE_DEBUG_PRIV           = 0x00010000
    480. 

  480. FLG_ENABLE_CSRDEBUG             = 0x00020000
    481. 

  481. FLG_ENABLE_KDEBUG_SYMBOL_LOAD   = 0x00040000
    482. 

  482. FLG_DISABLE_PAGE_KERNEL_STACKS  = 0x00080000
    483. 

  483. FLG_HEAP_ENABLE_CALL_TRACING    = 0x00100000
    484. 

  484. FLG_HEAP_DISABLE_COALESCING     = 0x00200000
    485. 

  485. FLG_ENABLE_CLOSE_EXCEPTION      = 0x00400000
    486. 

  486. FLG_ENABLE_EXCEPTION_LOGGING    = 0x00800000
    487. 

  487. FLG_ENABLE_HANDLE_TYPE_TAGGING  = 0x01000000
    488. 

  488. FLG_HEAP_PAGE_ALLOCS            = 0x02000000
    489. 

  489. FLG_DEBUG_WINLOGON              = 0x04000000
    490. 

  490. FLG_ENABLE_DBGPRINT_BUFFERING   = 0x08000000
    491. 

  491. FLG_EARLY_CRITICAL_SECTION_EVT  = 0x10000000
    492. 

  492. FLG_DISABLE_DLL_VERIFICATION    = 0x80000000
    493. 

  493. 

  494. class _PEB_NT(Structure):
    495. 

  495.     _pack_   = 4
    496. 

  496.     _fields_ = [
    497. 

  497.         ("InheritedAddressSpace",               BOOLEAN),
    498. 

  498.         ("ReadImageFileExecOptions",            UCHAR),
    499. 

  499.         ("BeingDebugged",                       BOOLEAN),
    500. 

  500.         ("BitField",                            UCHAR),
    501. 

  501.         ("Mutant",                              HANDLE),
    502. 

  502.         ("ImageBaseAddress",                    PVOID),
    503. 

  503.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    504. 

  504.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    505. 

  505.         ("SubSystemData",                       PVOID),
    506. 

  506.         ("ProcessHeap",                         PVOID),
    507. 

  507.         ("FastPebLock",                         PVOID),
    508. 

  508.         ("FastPebLockRoutine",                  PVOID), # PPEBLOCKROUTINE
    509. 

  509.         ("FastPebUnlockRoutine",                PVOID), # PPEBLOCKROUTINE
    510. 

  510.         ("EnvironmentUpdateCount",              ULONG),
    511. 

  511.         ("KernelCallbackTable",                 PVOID), # Ptr32 Ptr32 Void
    512. 

  512.         ("EventLogSection",                     PVOID),
    513. 

  513.         ("EventLog",                            PVOID),
    514. 

  514.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    515. 

  515.         ("TlsExpansionCounter",                 ULONG),
    516. 

  516.         ("TlsBitmap",                           PVOID),
    517. 

  517.         ("TlsBitmapBits",                       ULONG * 2),
    518. 

  518.         ("ReadOnlySharedMemoryBase",            PVOID),
    519. 

  519.         ("ReadOnlySharedMemoryHeap",            PVOID),
    520. 

  520.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    521. 

  521.         ("AnsiCodePageData",                    PVOID),
    522. 

  522.         ("OemCodePageData",                     PVOID),
    523. 

  523.         ("UnicodeCaseTableData",                PVOID),
    524. 

  524.         ("NumberOfProcessors",                  ULONG),
    525. 

  525.         ("NtGlobalFlag",                        ULONG),
    526. 

  526.         ("Spare2",                              BYTE * 4),
    527. 

  527.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    528. 

  528.         ("HeapSegmentReserve",                  ULONG),
    529. 

  529.         ("HeapSegmentCommit",                   ULONG),
    530. 

  530.         ("HeapDeCommitTotalFreeThreshold",      ULONG),
    531. 

  531.         ("HeapDeCommitFreeBlockThreshold",      ULONG),
    532. 

  532.         ("NumberOfHeaps",                       ULONG),
    533. 

  533.         ("MaximumNumberOfHeaps",                ULONG),
    534. 

  534.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    535. 

  535.         ("GdiSharedHandleTable",                PVOID),
    536. 

  536.         ("ProcessStarterHelper",                PVOID),
    537. 

  537.         ("GdiDCAttributeList",                  PVOID),
    538. 

  538.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    539. 

  539.         ("OSMajorVersion",                      ULONG),
    540. 

  540.         ("OSMinorVersion",                      ULONG),
    541. 

  541.         ("OSBuildNumber",                       ULONG),
    542. 

  542.         ("OSPlatformId",                        ULONG),
    543. 

  543.         ("ImageSubSystem",                      ULONG),
    544. 

  544.         ("ImageSubSystemMajorVersion",          ULONG),
    545. 

  545.         ("ImageSubSystemMinorVersion",          ULONG),
    546. 

  546.         ("ImageProcessAffinityMask",            ULONG),
    547. 

  547.         ("GdiHandleBuffer",                     ULONG * 34),
    548. 

  548.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    549. 

  549.         ("TlsExpansionBitmap",                  ULONG),
    550. 

  550.         ("TlsExpansionBitmapBits",              BYTE * 128),
    551. 

  551.         ("SessionId",                           ULONG),
    552. 

  552.     ]
    553. 

  553. 

  554. # not really, but "dt _PEB" in w2k isn't working for me :(
    555. 

  555. _PEB_2000 = _PEB_NT
    556. 

  556. 

  557. #    +0x000 InheritedAddressSpace : UChar
    558. 

  558. #    +0x001 ReadImageFileExecOptions : UChar
    559. 

  559. #    +0x002 BeingDebugged    : UChar
    560. 

  560. #    +0x003 SpareBool        : UChar
    561. 

  561. #    +0x004 Mutant           : Ptr32 Void
    562. 

  562. #    +0x008 ImageBaseAddress : Ptr32 Void
    563. 

  563. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    564. 

  564. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    565. 

  565. #    +0x014 SubSystemData    : Ptr32 Void
    566. 

  566. #    +0x018 ProcessHeap      : Ptr32 Void
    567. 

  567. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    568. 

  568. #    +0x020 FastPebLockRoutine : Ptr32 Void
    569. 

  569. #    +0x024 FastPebUnlockRoutine : Ptr32 Void
    570. 

  570. #    +0x028 EnvironmentUpdateCount : Uint4B
    571. 

  571. #    +0x02c KernelCallbackTable : Ptr32 Void
    572. 

  572. #    +0x030 SystemReserved   : [1] Uint4B
    573. 

  573. #    +0x034 AtlThunkSListPtr32 : Uint4B
    574. 

  574. #    +0x038 FreeList         : Ptr32 _PEB_FREE_BLOCK
    575. 

  575. #    +0x03c TlsExpansionCounter : Uint4B
    576. 

  576. #    +0x040 TlsBitmap        : Ptr32 Void
    577. 

  577. #    +0x044 TlsBitmapBits    : [2] Uint4B
    578. 

  578. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    579. 

  579. #    +0x050 ReadOnlySharedMemoryHeap : Ptr32 Void
    580. 

  580. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    581. 

  581. #    +0x058 AnsiCodePageData : Ptr32 Void
    582. 

  582. #    +0x05c OemCodePageData  : Ptr32 Void
    583. 

  583. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    584. 

  584. #    +0x064 NumberOfProcessors : Uint4B
    585. 

  585. #    +0x068 NtGlobalFlag     : Uint4B
    586. 

  586. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    587. 

  587. #    +0x078 HeapSegmentReserve : Uint4B
    588. 

  588. #    +0x07c HeapSegmentCommit : Uint4B
    589. 

  589. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    590. 

  590. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    591. 

  591. #    +0x088 NumberOfHeaps    : Uint4B
    592. 

  592. #    +0x08c MaximumNumberOfHeaps : Uint4B
    593. 

  593. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    594. 

  594. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    595. 

  595. #    +0x098 ProcessStarterHelper : Ptr32 Void
    596. 

  596. #    +0x09c GdiDCAttributeList : Uint4B
    597. 

  597. #    +0x0a0 LoaderLock       : Ptr32 Void
    598. 

  598. #    +0x0a4 OSMajorVersion   : Uint4B
    599. 

  599. #    +0x0a8 OSMinorVersion   : Uint4B
    600. 

  600. #    +0x0ac OSBuildNumber    : Uint2B
    601. 

  601. #    +0x0ae OSCSDVersion     : Uint2B
    602. 

  602. #    +0x0b0 OSPlatformId     : Uint4B
    603. 

  603. #    +0x0b4 ImageSubsystem   : Uint4B
    604. 

  604. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    605. 

  605. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    606. 

  606. #    +0x0c0 ImageProcessAffinityMask : Uint4B
    607. 

  607. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    608. 

  608. #    +0x14c PostProcessInitRoutine : Ptr32     void
    609. 

  609. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    610. 

  610. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    611. 

  611. #    +0x1d4 SessionId        : Uint4B
    612. 

  612. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    613. 

  613. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    614. 

  614. #    +0x1e8 pShimData        : Ptr32 Void
    615. 

  615. #    +0x1ec AppCompatInfo    : Ptr32 Void
    616. 

  616. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    617. 

  617. #    +0x1f8 ActivationContextData : Ptr32 Void
    618. 

  618. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 Void
    619. 

  619. #    +0x200 SystemDefaultActivationContextData : Ptr32 Void
    620. 

  620. #    +0x204 SystemAssemblyStorageMap : Ptr32 Void
    621. 

  621. #    +0x208 MinimumStackCommit : Uint4B
    622. 

  622. class _PEB_XP(Structure):
    623. 

  623.     _pack_   = 8
    624. 

  624.     _fields_ = [
    625. 

  625.         ("InheritedAddressSpace",               BOOLEAN),
    626. 

  626.         ("ReadImageFileExecOptions",            UCHAR),
    627. 

  627.         ("BeingDebugged",                       BOOLEAN),
    628. 

  628.         ("SpareBool",                           UCHAR),
    629. 

  629.         ("Mutant",                              HANDLE),
    630. 

  630.         ("ImageBaseAddress",                    PVOID),
    631. 

  631.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    632. 

  632.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    633. 

  633.         ("SubSystemData",                       PVOID),
    634. 

  634.         ("ProcessHeap",                         PVOID),
    635. 

  635.         ("FastPebLock",                         PVOID),
    636. 

  636.         ("FastPebLockRoutine",                  PVOID),
    637. 

  637.         ("FastPebUnlockRoutine",                PVOID),
    638. 

  638.         ("EnvironmentUpdateCount",              DWORD),
    639. 

  639.         ("KernelCallbackTable",                 PVOID),
    640. 

  640.         ("SystemReserved",                      DWORD),
    641. 

  641.         ("AtlThunkSListPtr32",                  DWORD),
    642. 

  642.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    643. 

  643.         ("TlsExpansionCounter",                 DWORD),
    644. 

  644.         ("TlsBitmap",                           PVOID),
    645. 

  645.         ("TlsBitmapBits",                       DWORD * 2),
    646. 

  646.         ("ReadOnlySharedMemoryBase",            PVOID),
    647. 

  647.         ("ReadOnlySharedMemoryHeap",            PVOID),
    648. 

  648.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    649. 

  649.         ("AnsiCodePageData",                    PVOID),
    650. 

  650.         ("OemCodePageData",                     PVOID),
    651. 

  651.         ("UnicodeCaseTableData",                PVOID),
    652. 

  652.         ("NumberOfProcessors",                  DWORD),
    653. 

  653.         ("NtGlobalFlag",                        DWORD),
    654. 

  654.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    655. 

  655.         ("HeapSegmentReserve",                  DWORD),
    656. 

  656.         ("HeapSegmentCommit",                   DWORD),
    657. 

  657.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    658. 

  658.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    659. 

  659.         ("NumberOfHeaps",                       DWORD),
    660. 

  660.         ("MaximumNumberOfHeaps",                DWORD),
    661. 

  661.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    662. 

  662.         ("GdiSharedHandleTable",                PVOID),
    663. 

  663.         ("ProcessStarterHelper",                PVOID),
    664. 

  664.         ("GdiDCAttributeList",                  DWORD),
    665. 

  665.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    666. 

  666.         ("OSMajorVersion",                      DWORD),
    667. 

  667.         ("OSMinorVersion",                      DWORD),
    668. 

  668.         ("OSBuildNumber",                       WORD),
    669. 

  669.         ("OSCSDVersion",                        WORD),
    670. 

  670.         ("OSPlatformId",                        DWORD),
    671. 

  671.         ("ImageSubsystem",                      DWORD),
    672. 

  672.         ("ImageSubsystemMajorVersion",          DWORD),
    673. 

  673.         ("ImageSubsystemMinorVersion",          DWORD),
    674. 

  674.         ("ImageProcessAffinityMask",            DWORD),
    675. 

  675.         ("GdiHandleBuffer",                     DWORD * 34),
    676. 

  676.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    677. 

  677.         ("TlsExpansionBitmap",                  PVOID),
    678. 

  678.         ("TlsExpansionBitmapBits",              DWORD * 32),
    679. 

  679.         ("SessionId",                           DWORD),
    680. 

  680.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    681. 

  681.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    682. 

  682.         ("pShimData",                           PVOID),
    683. 

  683.         ("AppCompatInfo",                       PVOID),
    684. 

  684.         ("CSDVersion",                          UNICODE_STRING),
    685. 

  685.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    686. 

  686.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    687. 

  687.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    688. 

  688.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    689. 

  689.         ("MinimumStackCommit",                  DWORD),
    690. 

  690.     ]
    691. 

  691. 

  692. #    +0x000 InheritedAddressSpace : UChar
    693. 

  693. #    +0x001 ReadImageFileExecOptions : UChar
    694. 

  694. #    +0x002 BeingDebugged    : UChar
    695. 

  695. #    +0x003 BitField         : UChar
    696. 

  696. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    697. 

  697. #    +0x003 SpareBits        : Pos 1, 7 Bits
    698. 

  698. #    +0x008 Mutant           : Ptr64 Void
    699. 

  699. #    +0x010 ImageBaseAddress : Ptr64 Void
    700. 

  700. #    +0x018 Ldr              : Ptr64 _PEB_LDR_DATA
    701. 

  701. #    +0x020 ProcessParameters : Ptr64 _RTL_USER_PROCESS_PARAMETERS
    702. 

  702. #    +0x028 SubSystemData    : Ptr64 Void
    703. 

  703. #    +0x030 ProcessHeap      : Ptr64 Void
    704. 

  704. #    +0x038 FastPebLock      : Ptr64 _RTL_CRITICAL_SECTION
    705. 

  705. #    +0x040 AtlThunkSListPtr : Ptr64 Void
    706. 

  706. #    +0x048 SparePtr2        : Ptr64 Void
    707. 

  707. #    +0x050 EnvironmentUpdateCount : Uint4B
    708. 

  708. #    +0x058 KernelCallbackTable : Ptr64 Void
    709. 

  709. #    +0x060 SystemReserved   : [1] Uint4B
    710. 

  710. #    +0x064 SpareUlong       : Uint4B
    711. 

  711. #    +0x068 FreeList         : Ptr64 _PEB_FREE_BLOCK
    712. 

  712. #    +0x070 TlsExpansionCounter : Uint4B
    713. 

  713. #    +0x078 TlsBitmap        : Ptr64 Void
    714. 

  714. #    +0x080 TlsBitmapBits    : [2] Uint4B
    715. 

  715. #    +0x088 ReadOnlySharedMemoryBase : Ptr64 Void
    716. 

  716. #    +0x090 ReadOnlySharedMemoryHeap : Ptr64 Void
    717. 

  717. #    +0x098 ReadOnlyStaticServerData : Ptr64 Ptr64 Void
    718. 

  718. #    +0x0a0 AnsiCodePageData : Ptr64 Void
    719. 

  719. #    +0x0a8 OemCodePageData  : Ptr64 Void
    720. 

  720. #    +0x0b0 UnicodeCaseTableData : Ptr64 Void
    721. 

  721. #    +0x0b8 NumberOfProcessors : Uint4B
    722. 

  722. #    +0x0bc NtGlobalFlag     : Uint4B
    723. 

  723. #    +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER
    724. 

  724. #    +0x0c8 HeapSegmentReserve : Uint8B
    725. 

  725. #    +0x0d0 HeapSegmentCommit : Uint8B
    726. 

  726. #    +0x0d8 HeapDeCommitTotalFreeThreshold : Uint8B
    727. 

  727. #    +0x0e0 HeapDeCommitFreeBlockThreshold : Uint8B
    728. 

  728. #    +0x0e8 NumberOfHeaps    : Uint4B
    729. 

  729. #    +0x0ec MaximumNumberOfHeaps : Uint4B
    730. 

  730. #    +0x0f0 ProcessHeaps     : Ptr64 Ptr64 Void
    731. 

  731. #    +0x0f8 GdiSharedHandleTable : Ptr64 Void
    732. 

  732. #    +0x100 ProcessStarterHelper : Ptr64 Void
    733. 

  733. #    +0x108 GdiDCAttributeList : Uint4B
    734. 

  734. #    +0x110 LoaderLock       : Ptr64 _RTL_CRITICAL_SECTION
    735. 

  735. #    +0x118 OSMajorVersion   : Uint4B
    736. 

  736. #    +0x11c OSMinorVersion   : Uint4B
    737. 

  737. #    +0x120 OSBuildNumber    : Uint2B
    738. 

  738. #    +0x122 OSCSDVersion     : Uint2B
    739. 

  739. #    +0x124 OSPlatformId     : Uint4B
    740. 

  740. #    +0x128 ImageSubsystem   : Uint4B
    741. 

  741. #    +0x12c ImageSubsystemMajorVersion : Uint4B
    742. 

  742. #    +0x130 ImageSubsystemMinorVersion : Uint4B
    743. 

  743. #    +0x138 ImageProcessAffinityMask : Uint8B
    744. 

  744. #    +0x140 GdiHandleBuffer  : [60] Uint4B
    745. 

  745. #    +0x230 PostProcessInitRoutine : Ptr64     void
    746. 

  746. #    +0x238 TlsExpansionBitmap : Ptr64 Void
    747. 

  747. #    +0x240 TlsExpansionBitmapBits : [32] Uint4B
    748. 

  748. #    +0x2c0 SessionId        : Uint4B
    749. 

  749. #    +0x2c8 AppCompatFlags   : _ULARGE_INTEGER
    750. 

  750. #    +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER
    751. 

  751. #    +0x2d8 pShimData        : Ptr64 Void
    752. 

  752. #    +0x2e0 AppCompatInfo    : Ptr64 Void
    753. 

  753. #    +0x2e8 CSDVersion       : _UNICODE_STRING
    754. 

  754. #    +0x2f8 ActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    755. 

  755. #    +0x300 ProcessAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    756. 

  756. #    +0x308 SystemDefaultActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    757. 

  757. #    +0x310 SystemAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    758. 

  758. #    +0x318 MinimumStackCommit : Uint8B
    759. 

  759. #    +0x320 FlsCallback      : Ptr64 Ptr64 Void
    760. 

  760. #    +0x328 FlsListHead      : _LIST_ENTRY
    761. 

  761. #    +0x338 FlsBitmap        : Ptr64 Void
    762. 

  762. #    +0x340 FlsBitmapBits    : [4] Uint4B
    763. 

  763. #    +0x350 FlsHighIndex     : Uint4B
    764. 

  764. class _PEB_XP_64(Structure):
    765. 

  765.     _pack_   = 8
    766. 

  766.     _fields_ = [
    767. 

  767.         ("InheritedAddressSpace",               BOOLEAN),
    768. 

  768.         ("ReadImageFileExecOptions",            UCHAR),
    769. 

  769.         ("BeingDebugged",                       BOOLEAN),
    770. 

  770.         ("BitField",                            UCHAR),
    771. 

  771.         ("Mutant",                              HANDLE),
    772. 

  772.         ("ImageBaseAddress",                    PVOID),
    773. 

  773.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    774. 

  774.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    775. 

  775.         ("SubSystemData",                       PVOID),
    776. 

  776.         ("ProcessHeap",                         PVOID),
    777. 

  777.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    778. 

  778.         ("AtlThunkSListPtr",                    PVOID),
    779. 

  779.         ("SparePtr2",                           PVOID),
    780. 

  780.         ("EnvironmentUpdateCount",              DWORD),
    781. 

  781.         ("KernelCallbackTable",                 PVOID),
    782. 

  782.         ("SystemReserved",                      DWORD),
    783. 

  783.         ("SpareUlong",                          DWORD),
    784. 

  784.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    785. 

  785.         ("TlsExpansionCounter",                 DWORD),
    786. 

  786.         ("TlsBitmap",                           PVOID),
    787. 

  787.         ("TlsBitmapBits",                       DWORD * 2),
    788. 

  788.         ("ReadOnlySharedMemoryBase",            PVOID),
    789. 

  789.         ("ReadOnlySharedMemoryHeap",            PVOID),
    790. 

  790.         ("ReadOnlyStaticServerData",            PVOID), # Ptr64 Ptr64 Void
    791. 

  791.         ("AnsiCodePageData",                    PVOID),
    792. 

  792.         ("OemCodePageData",                     PVOID),
    793. 

  793.         ("UnicodeCaseTableData",                PVOID),
    794. 

  794.         ("NumberOfProcessors",                  DWORD),
    795. 

  795.         ("NtGlobalFlag",                        DWORD),
    796. 

  796.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    797. 

  797.         ("HeapSegmentReserve",                  QWORD),
    798. 

  798.         ("HeapSegmentCommit",                   QWORD),
    799. 

  799.         ("HeapDeCommitTotalFreeThreshold",      QWORD),
    800. 

  800.         ("HeapDeCommitFreeBlockThreshold",      QWORD),
    801. 

  801.         ("NumberOfHeaps",                       DWORD),
    802. 

  802.         ("MaximumNumberOfHeaps",                DWORD),
    803. 

  803.         ("ProcessHeaps",                        PVOID), # Ptr64 Ptr64 Void
    804. 

  804.         ("GdiSharedHandleTable",                PVOID),
    805. 

  805.         ("ProcessStarterHelper",                PVOID),
    806. 

  806.         ("GdiDCAttributeList",                  DWORD),
    807. 

  807.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    808. 

  808.         ("OSMajorVersion",                      DWORD),
    809. 

  809.         ("OSMinorVersion",                      DWORD),
    810. 

  810.         ("OSBuildNumber",                       WORD),
    811. 

  811.         ("OSCSDVersion",                        WORD),
    812. 

  812.         ("OSPlatformId",                        DWORD),
    813. 

  813.         ("ImageSubsystem",                      DWORD),
    814. 

  814.         ("ImageSubsystemMajorVersion",          DWORD),
    815. 

  815.         ("ImageSubsystemMinorVersion",          DWORD),
    816. 

  816.         ("ImageProcessAffinityMask",            QWORD),
    817. 

  817.         ("GdiHandleBuffer",                     DWORD * 60),
    818. 

  818.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    819. 

  819.         ("TlsExpansionBitmap",                  PVOID),
    820. 

  820.         ("TlsExpansionBitmapBits",              DWORD * 32),
    821. 

  821.         ("SessionId",                           DWORD),
    822. 

  822.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    823. 

  823.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    824. 

  824.         ("pShimData",                           PVOID),
    825. 

  825.         ("AppCompatInfo",                       PVOID),
    826. 

  826.         ("CSDVersion",                          UNICODE_STRING),
    827. 

  827.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    828. 

  828.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    829. 

  829.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    830. 

  830.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    831. 

  831.         ("MinimumStackCommit",                  QWORD),
    832. 

  832.         ("FlsCallback",                         PVOID), # Ptr64 Ptr64 Void
    833. 

  833.         ("FlsListHead",                         LIST_ENTRY),
    834. 

  834.         ("FlsBitmap",                           PVOID),
    835. 

  835.         ("FlsBitmapBits",                       DWORD * 4),
    836. 

  836.         ("FlsHighIndex",                        DWORD),
    837. 

  837.     ]
    838. 

  838. 

  839. #    +0x000 InheritedAddressSpace : UChar
    840. 

  840. #    +0x001 ReadImageFileExecOptions : UChar
    841. 

  841. #    +0x002 BeingDebugged    : UChar
    842. 

  842. #    +0x003 BitField         : UChar
    843. 

  843. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    844. 

  844. #    +0x003 SpareBits        : Pos 1, 7 Bits
    845. 

  845. #    +0x004 Mutant           : Ptr32 Void
    846. 

  846. #    +0x008 ImageBaseAddress : Ptr32 Void
    847. 

  847. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    848. 

  848. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    849. 

  849. #    +0x014 SubSystemData    : Ptr32 Void
    850. 

  850. #    +0x018 ProcessHeap      : Ptr32 Void
    851. 

  851. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    852. 

  852. #    +0x020 AtlThunkSListPtr : Ptr32 Void
    853. 

  853. #    +0x024 SparePtr2        : Ptr32 Void
    854. 

  854. #    +0x028 EnvironmentUpdateCount : Uint4B
    855. 

  855. #    +0x02c KernelCallbackTable : Ptr32 Void
    856. 

  856. #    +0x030 SystemReserved   : [1] Uint4B
    857. 

  857. #    +0x034 SpareUlong       : Uint4B
    858. 

  858. #    +0x038 FreeList         : Ptr32 _PEB_FREE_BLOCK
    859. 

  859. #    +0x03c TlsExpansionCounter : Uint4B
    860. 

  860. #    +0x040 TlsBitmap        : Ptr32 Void
    861. 

  861. #    +0x044 TlsBitmapBits    : [2] Uint4B
    862. 

  862. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    863. 

  863. #    +0x050 ReadOnlySharedMemoryHeap : Ptr32 Void
    864. 

  864. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    865. 

  865. #    +0x058 AnsiCodePageData : Ptr32 Void
    866. 

  866. #    +0x05c OemCodePageData  : Ptr32 Void
    867. 

  867. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    868. 

  868. #    +0x064 NumberOfProcessors : Uint4B
    869. 

  869. #    +0x068 NtGlobalFlag     : Uint4B
    870. 

  870. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    871. 

  871. #    +0x078 HeapSegmentReserve : Uint4B
    872. 

  872. #    +0x07c HeapSegmentCommit : Uint4B
    873. 

  873. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    874. 

  874. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    875. 

  875. #    +0x088 NumberOfHeaps    : Uint4B
    876. 

  876. #    +0x08c MaximumNumberOfHeaps : Uint4B
    877. 

  877. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    878. 

  878. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    879. 

  879. #    +0x098 ProcessStarterHelper : Ptr32 Void
    880. 

  880. #    +0x09c GdiDCAttributeList : Uint4B
    881. 

  881. #    +0x0a0 LoaderLock       : Ptr32 _RTL_CRITICAL_SECTION
    882. 

  882. #    +0x0a4 OSMajorVersion   : Uint4B
    883. 

  883. #    +0x0a8 OSMinorVersion   : Uint4B
    884. 

  884. #    +0x0ac OSBuildNumber    : Uint2B
    885. 

  885. #    +0x0ae OSCSDVersion     : Uint2B
    886. 

  886. #    +0x0b0 OSPlatformId     : Uint4B
    887. 

  887. #    +0x0b4 ImageSubsystem   : Uint4B
    888. 

  888. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    889. 

  889. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    890. 

  890. #    +0x0c0 ImageProcessAffinityMask : Uint4B
    891. 

  891. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    892. 

  892. #    +0x14c PostProcessInitRoutine : Ptr32     void
    893. 

  893. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    894. 

  894. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    895. 

  895. #    +0x1d4 SessionId        : Uint4B
    896. 

  896. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    897. 

  897. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    898. 

  898. #    +0x1e8 pShimData        : Ptr32 Void
    899. 

  899. #    +0x1ec AppCompatInfo    : Ptr32 Void
    900. 

  900. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    901. 

  901. #    +0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    902. 

  902. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    903. 

  903. #    +0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    904. 

  904. #    +0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    905. 

  905. #    +0x208 MinimumStackCommit : Uint4B
    906. 

  906. #    +0x20c FlsCallback      : Ptr32 Ptr32 Void
    907. 

  907. #    +0x210 FlsListHead      : _LIST_ENTRY
    908. 

  908. #    +0x218 FlsBitmap        : Ptr32 Void
    909. 

  909. #    +0x21c FlsBitmapBits    : [4] Uint4B
    910. 

  910. #    +0x22c FlsHighIndex     : Uint4B
    911. 

  911. class _PEB_2003(Structure):
    912. 

  912.     _pack_   = 8
    913. 

  913.     _fields_ = [
    914. 

  914.         ("InheritedAddressSpace",               BOOLEAN),
    915. 

  915.         ("ReadImageFileExecOptions",            UCHAR),
    916. 

  916.         ("BeingDebugged",                       BOOLEAN),
    917. 

  917.         ("BitField",                            UCHAR),
    918. 

  918.         ("Mutant",                              HANDLE),
    919. 

  919.         ("ImageBaseAddress",                    PVOID),
    920. 

  920.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    921. 

  921.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    922. 

  922.         ("SubSystemData",                       PVOID),
    923. 

  923.         ("ProcessHeap",                         PVOID),
    924. 

  924.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    925. 

  925.         ("AtlThunkSListPtr",                    PVOID),
    926. 

  926.         ("SparePtr2",                           PVOID),
    927. 

  927.         ("EnvironmentUpdateCount",              DWORD),
    928. 

  928.         ("KernelCallbackTable",                 PVOID),
    929. 

  929.         ("SystemReserved",                      DWORD),
    930. 

  930.         ("SpareUlong",                          DWORD),
    931. 

  931.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    932. 

  932.         ("TlsExpansionCounter",                 DWORD),
    933. 

  933.         ("TlsBitmap",                           PVOID),
    934. 

  934.         ("TlsBitmapBits",                       DWORD * 2),
    935. 

  935.         ("ReadOnlySharedMemoryBase",            PVOID),
    936. 

  936.         ("ReadOnlySharedMemoryHeap",            PVOID),
    937. 

  937.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    938. 

  938.         ("AnsiCodePageData",                    PVOID),
    939. 

  939.         ("OemCodePageData",                     PVOID),
    940. 

  940.         ("UnicodeCaseTableData",                PVOID),
    941. 

  941.         ("NumberOfProcessors",                  DWORD),
    942. 

  942.         ("NtGlobalFlag",                        DWORD),
    943. 

  943.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    944. 

  944.         ("HeapSegmentReserve",                  DWORD),
    945. 

  945.         ("HeapSegmentCommit",                   DWORD),
    946. 

  946.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    947. 

  947.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    948. 

  948.         ("NumberOfHeaps",                       DWORD),
    949. 

  949.         ("MaximumNumberOfHeaps",                DWORD),
    950. 

  950.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    951. 

  951.         ("GdiSharedHandleTable",                PVOID),
    952. 

  952.         ("ProcessStarterHelper",                PVOID),
    953. 

  953.         ("GdiDCAttributeList",                  DWORD),
    954. 

  954.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    955. 

  955.         ("OSMajorVersion",                      DWORD),
    956. 

  956.         ("OSMinorVersion",                      DWORD),
    957. 

  957.         ("OSBuildNumber",                       WORD),
    958. 

  958.         ("OSCSDVersion",                        WORD),
    959. 

  959.         ("OSPlatformId",                        DWORD),
    960. 

  960.         ("ImageSubsystem",                      DWORD),
    961. 

  961.         ("ImageSubsystemMajorVersion",          DWORD),
    962. 

  962.         ("ImageSubsystemMinorVersion",          DWORD),
    963. 

  963.         ("ImageProcessAffinityMask",            DWORD),
    964. 

  964.         ("GdiHandleBuffer",                     DWORD * 34),
    965. 

  965.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    966. 

  966.         ("TlsExpansionBitmap",                  PVOID),
    967. 

  967.         ("TlsExpansionBitmapBits",              DWORD * 32),
    968. 

  968.         ("SessionId",                           DWORD),
    969. 

  969.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    970. 

  970.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    971. 

  971.         ("pShimData",                           PVOID),
    972. 

  972.         ("AppCompatInfo",                       PVOID),
    973. 

  973.         ("CSDVersion",                          UNICODE_STRING),
    974. 

  974.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    975. 

  975.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    976. 

  976.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    977. 

  977.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    978. 

  978.         ("MinimumStackCommit",                  QWORD),
    979. 

  979.         ("FlsCallback",                         PVOID), # Ptr32 Ptr32 Void
    980. 

  980.         ("FlsListHead",                         LIST_ENTRY),
    981. 

  981.         ("FlsBitmap",                           PVOID),
    982. 

  982.         ("FlsBitmapBits",                       DWORD * 4),
    983. 

  983.         ("FlsHighIndex",                        DWORD),
    984. 

  984.     ]
    985. 

  985. 

  986. _PEB_2003_64    = _PEB_XP_64
    987. 

  987. _PEB_2003_R2    = _PEB_2003
    988. 

  988. _PEB_2003_R2_64 = _PEB_2003_64
    989. 

  989. 

  990. #    +0x000 InheritedAddressSpace : UChar
    991. 

  991. #    +0x001 ReadImageFileExecOptions : UChar
    992. 

  992. #    +0x002 BeingDebugged    : UChar
    993. 

  993. #    +0x003 BitField         : UChar
    994. 

  994. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    995. 

  995. #    +0x003 IsProtectedProcess : Pos 1, 1 Bit
    996. 

  996. #    +0x003 IsLegacyProcess  : Pos 2, 1 Bit
    997. 

  997. #    +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
    998. 

  998. #    +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
    999. 

  999. #    +0x003 SpareBits        : Pos 5, 3 Bits
    1000. 

  1000. #    +0x004 Mutant           : Ptr32 Void
    1001. 

  1001. #    +0x008 ImageBaseAddress : Ptr32 Void
    1002. 

  1002. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    1003. 

  1003. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    1004. 

  1004. #    +0x014 SubSystemData    : Ptr32 Void
    1005. 

  1005. #    +0x018 ProcessHeap      : Ptr32 Void
    1006. 

  1006. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    1007. 

  1007. #    +0x020 AtlThunkSListPtr : Ptr32 Void
    1008. 

  1008. #    +0x024 IFEOKey          : Ptr32 Void
    1009. 

  1009. #    +0x028 CrossProcessFlags : Uint4B
    1010. 

  1010. #    +0x028 ProcessInJob     : Pos 0, 1 Bit
    1011. 

  1011. #    +0x028 ProcessInitializing : Pos 1, 1 Bit
    1012. 

  1012. #    +0x028 ProcessUsingVEH  : Pos 2, 1 Bit
    1013. 

  1013. #    +0x028 ProcessUsingVCH  : Pos 3, 1 Bit
    1014. 

  1014. #    +0x028 ReservedBits0    : Pos 4, 28 Bits
    1015. 

  1015. #    +0x02c KernelCallbackTable : Ptr32 Void
    1016. 

  1016. #    +0x02c UserSharedInfoPtr : Ptr32 Void
    1017. 

  1017. #    +0x030 SystemReserved   : [1] Uint4B
    1018. 

  1018. #    +0x034 SpareUlong       : Uint4B
    1019. 

  1019. #    +0x038 SparePebPtr0     : Uint4B
    1020. 

  1020. #    +0x03c TlsExpansionCounter : Uint4B
    1021. 

  1021. #    +0x040 TlsBitmap        : Ptr32 Void
    1022. 

  1022. #    +0x044 TlsBitmapBits    : [2] Uint4B
    1023. 

  1023. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    1024. 

  1024. #    +0x050 HotpatchInformation : Ptr32 Void
    1025. 

  1025. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    1026. 

  1026. #    +0x058 AnsiCodePageData : Ptr32 Void
    1027. 

  1027. #    +0x05c OemCodePageData  : Ptr32 Void
    1028. 

  1028. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    1029. 

  1029. #    +0x064 NumberOfProcessors : Uint4B
    1030. 

  1030. #    +0x068 NtGlobalFlag     : Uint4B
    1031. 

  1031. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    1032. 

  1032. #    +0x078 HeapSegmentReserve : Uint4B
    1033. 

  1033. #    +0x07c HeapSegmentCommit : Uint4B
    1034. 

  1034. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    1035. 

  1035. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    1036. 

  1036. #    +0x088 NumberOfHeaps    : Uint4B
    1037. 

  1037. #    +0x08c MaximumNumberOfHeaps : Uint4B
    1038. 

  1038. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    1039. 

  1039. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    1040. 

  1040. #    +0x098 ProcessStarterHelper : Ptr32 Void
    1041. 

  1041. #    +0x09c GdiDCAttributeList : Uint4B
    1042. 

  1042. #    +0x0a0 LoaderLock       : Ptr32 _RTL_CRITICAL_SECTION
    1043. 

  1043. #    +0x0a4 OSMajorVersion   : Uint4B
    1044. 

  1044. #    +0x0a8 OSMinorVersion   : Uint4B
    1045. 

  1045. #    +0x0ac OSBuildNumber    : Uint2B
    1046. 

  1046. #    +0x0ae OSCSDVersion     : Uint2B
    1047. 

  1047. #    +0x0b0 OSPlatformId     : Uint4B
    1048. 

  1048. #    +0x0b4 ImageSubsystem   : Uint4B
    1049. 

  1049. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    1050. 

  1050. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    1051. 

  1051. #    +0x0c0 ActiveProcessAffinityMask : Uint4B
    1052. 

  1052. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    1053. 

  1053. #    +0x14c PostProcessInitRoutine : Ptr32     void
    1054. 

  1054. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    1055. 

  1055. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    1056. 

  1056. #    +0x1d4 SessionId        : Uint4B
    1057. 

  1057. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    1058. 

  1058. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    1059. 

  1059. #    +0x1e8 pShimData        : Ptr32 Void
    1060. 

  1060. #    +0x1ec AppCompatInfo    : Ptr32 Void
    1061. 

  1061. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    1062. 

  1062. #    +0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1063. 

  1063. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1064. 

  1064. #    +0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1065. 

  1065. #    +0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1066. 

  1066. #    +0x208 MinimumStackCommit : Uint4B
    1067. 

  1067. #    +0x20c FlsCallback      : Ptr32 _FLS_CALLBACK_INFO
    1068. 

  1068. #    +0x210 FlsListHead      : _LIST_ENTRY
    1069. 

  1069. #    +0x218 FlsBitmap        : Ptr32 Void
    1070. 

  1070. #    +0x21c FlsBitmapBits    : [4] Uint4B
    1071. 

  1071. #    +0x22c FlsHighIndex     : Uint4B
    1072. 

  1072. #    +0x230 WerRegistrationData : Ptr32 Void
    1073. 

  1073. #    +0x234 WerShipAssertPtr : Ptr32 Void
    1074. 

  1074. class _PEB_2008(Structure):
    1075. 

  1075.     _pack_   = 8
    1076. 

  1076.     _fields_ = [
    1077. 

  1077.         ("InheritedAddressSpace",               BOOLEAN),
    1078. 

  1078.         ("ReadImageFileExecOptions",            UCHAR),
    1079. 

  1079.         ("BeingDebugged",                       BOOLEAN),
    1080. 

  1080.         ("BitField",                            UCHAR),
    1081. 

  1081.         ("Mutant",                              HANDLE),
    1082. 

  1082.         ("ImageBaseAddress",                    PVOID),
    1083. 

  1083.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    1084. 

  1084.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    1085. 

  1085.         ("SubSystemData",                       PVOID),
    1086. 

  1086.         ("ProcessHeap",                         PVOID),
    1087. 

  1087.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    1088. 

  1088.         ("AtlThunkSListPtr",                    PVOID),
    1089. 

  1089.         ("IFEOKey",                             PVOID),
    1090. 

  1090.         ("CrossProcessFlags",                   DWORD),
    1091. 

  1091.         ("KernelCallbackTable",                 PVOID),
    1092. 

  1092.         ("SystemReserved",                      DWORD),
    1093. 

  1093.         ("SpareUlong",                          DWORD),
    1094. 

  1094.         ("SparePebPtr0",                        PVOID),
    1095. 

  1095.         ("TlsExpansionCounter",                 DWORD),
    1096. 

  1096.         ("TlsBitmap",                           PVOID),
    1097. 

  1097.         ("TlsBitmapBits",                       DWORD * 2),
    1098. 

  1098.         ("ReadOnlySharedMemoryBase",            PVOID),
    1099. 

  1099.         ("HotpatchInformation",                 PVOID),
    1100. 

  1100.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    1101. 

  1101.         ("AnsiCodePageData",                    PVOID),
    1102. 

  1102.         ("OemCodePageData",                     PVOID),
    1103. 

  1103.         ("UnicodeCaseTableData",                PVOID),
    1104. 

  1104.         ("NumberOfProcessors",                  DWORD),
    1105. 

  1105.         ("NtGlobalFlag",                        DWORD),
    1106. 

  1106.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    1107. 

  1107.         ("HeapSegmentReserve",                  DWORD),
    1108. 

  1108.         ("HeapSegmentCommit",                   DWORD),
    1109. 

  1109.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    1110. 

  1110.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    1111. 

  1111.         ("NumberOfHeaps",                       DWORD),
    1112. 

  1112.         ("MaximumNumberOfHeaps",                DWORD),
    1113. 

  1113.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    1114. 

  1114.         ("GdiSharedHandleTable",                PVOID),
    1115. 

  1115.         ("ProcessStarterHelper",                PVOID),
    1116. 

  1116.         ("GdiDCAttributeList",                  DWORD),
    1117. 

  1117.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    1118. 

  1118.       …
    1119.

Large files files are truncated, but you can click here to view the full file