PageRenderTime 46ms CodeModel.GetById 9ms RepoModel.GetById 0ms app.codeStats 1ms

/python/helpers/pydev/pydevd_attach_to_process/winappdbg/win32/peb_teb.py

http://github.com/JetBrains/intellij-community
Python | 3435 lines | 1692 code | 72 blank | 1671 comment | 47 complexity | 6d56e5b1c3a1d599fb5dd8695c77f236 MD5 | raw file
Possible License(s): BSD-3-Clause, Apache-2.0, MPL-2.0-no-copyleft-exception, MIT, EPL-1.0, AGPL-1.0 
    

  1. #!/usr/bin/env python
    2. 

  2. # -*- coding: utf-8 -*-
    3. 

  3. 

  4. # Copyright (c) 2009-2014, Mario Vilas
    5. 

  5. # All rights reserved.
    6. 

  6. #
    7. 

  7. # Redistribution and use in source and binary forms, with or without
    8. 

  8. # modification, are permitted provided that the following conditions are met:
    9. 

  9. #
    10. 

  10. #     * Redistributions of source code must retain the above copyright notice,
    11. 

  11. #       this list of conditions and the following disclaimer.
    12. 

  12. #     * Redistributions in binary form must reproduce the above copyright
    13. 

  13. #       notice,this list of conditions and the following disclaimer in the
    14. 

  14. #       documentation and/or other materials provided with the distribution.
    15. 

  15. #     * Neither the name of the copyright holder nor the names of its
    16. 

  16. #       contributors may be used to endorse or promote products derived from
    17. 

  17. #       this software without specific prior written permission.
    18. 

  18. #
    19. 

  19. # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
    20. 

  20. # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
    21. 

  21. # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    22. 

  22. # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
    23. 

  23. # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
    24. 

  24. # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    25. 

  25. # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
    26. 

  26. # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
    27. 

  27. # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    28. 

  28. # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
    29. 

  29. # POSSIBILITY OF SUCH DAMAGE.
    30. 

  30. 

  31. """
    32. 

  32. PEB and TEB structures, constants and data types.
    33. 

  33. """
    34. 

    35. 

  35. __revision__ = "$Id$"
    36. 

  36. 

  37. from winappdbg.win32.defines import *
    38. 

  38. from winappdbg.win32.version import os
    39. 

  39. 

  40. #==============================================================================
    41. 

  41. # This is used later on to calculate the list of exported symbols.
    42. 

  42. _all = None
    43. 

  43. _all = set(vars().keys())
    44. 

  44. #==============================================================================
    45. 

  45. 

  46. #--- PEB and TEB structures, constants and data types -------------------------
    47. 

  47. 

  48. # From http://www.nirsoft.net/kernel_struct/vista/CLIENT_ID.html
    49. 

  49. #
    50. 

  50. # typedef struct _CLIENT_ID
    51. 

  51. # {
    52. 

  52. #     PVOID UniqueProcess;
    53. 

  53. #     PVOID UniqueThread;
    54. 

  54. # } CLIENT_ID, *PCLIENT_ID;
    55. 

  55. class CLIENT_ID(Structure):
    56. 

  56.     _fields_ = [
    57. 

  57.         ("UniqueProcess",   PVOID),
    58. 

  58.         ("UniqueThread",    PVOID),
    59. 

  59. ]
    60. 

  60. 

  61. # From MSDN:
    62. 

  62. #
    63. 

  63. # typedef struct _LDR_DATA_TABLE_ENTRY {
    64. 

  64. #     BYTE Reserved1[2];
    65. 

  65. #     LIST_ENTRY InMemoryOrderLinks;
    66. 

  66. #     PVOID Reserved2[2];
    67. 

  67. #     PVOID DllBase;
    68. 

  68. #     PVOID EntryPoint;
    69. 

  69. #     PVOID Reserved3;
    70. 

  70. #     UNICODE_STRING FullDllName;
    71. 

  71. #     BYTE Reserved4[8];
    72. 

  72. #     PVOID Reserved5[3];
    73. 

  73. #     union {
    74. 

  74. #         ULONG CheckSum;
    75. 

  75. #         PVOID Reserved6;
    76. 

  76. #     };
    77. 

  77. #     ULONG TimeDateStamp;
    78. 

  78. # } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
    79. 

  79. ##class LDR_DATA_TABLE_ENTRY(Structure):
    80. 

  80. ##    _fields_ = [
    81. 

  81. ##        ("Reserved1",           BYTE * 2),
    82. 

  82. ##        ("InMemoryOrderLinks",  LIST_ENTRY),
    83. 

  83. ##        ("Reserved2",           PVOID * 2),
    84. 

  84. ##        ("DllBase",             PVOID),
    85. 

  85. ##        ("EntryPoint",          PVOID),
    86. 

  86. ##        ("Reserved3",           PVOID),
    87. 

  87. ##        ("FullDllName",           UNICODE_STRING),
    88. 

  88. ##        ("Reserved4",           BYTE * 8),
    89. 

  89. ##        ("Reserved5",           PVOID * 3),
    90. 

  90. ##        ("CheckSum",            ULONG),
    91. 

  91. ##        ("TimeDateStamp",       ULONG),
    92. 

  92. ##]
    93. 

  93. 

  94. # From MSDN:
    95. 

  95. #
    96. 

  96. # typedef struct _PEB_LDR_DATA {
    97. 

  97. #   BYTE         Reserved1[8];
    98. 

  98. #   PVOID        Reserved2[3];
    99. 

  99. #   LIST_ENTRY   InMemoryOrderModuleList;
    100. 

  100. # } PEB_LDR_DATA,
    101. 

  101. #  *PPEB_LDR_DATA;
    102. 

  102. ##class PEB_LDR_DATA(Structure):
    103. 

  103. ##    _fields_ = [
    104. 

  104. ##        ("Reserved1",               BYTE),
    105. 

  105. ##        ("Reserved2",               PVOID),
    106. 

  106. ##        ("InMemoryOrderModuleList", LIST_ENTRY),
    107. 

  107. ##]
    108. 

  108. 

  109. # From http://undocumented.ntinternals.net/UserMode/Structures/RTL_USER_PROCESS_PARAMETERS.html
    110. 

  110. # typedef struct _RTL_USER_PROCESS_PARAMETERS {
    111. 

  111. #   ULONG                   MaximumLength;
    112. 

  112. #   ULONG                   Length;
    113. 

  113. #   ULONG                   Flags;
    114. 

  114. #   ULONG                   DebugFlags;
    115. 

  115. #   PVOID                   ConsoleHandle;
    116. 

  116. #   ULONG                   ConsoleFlags;
    117. 

  117. #   HANDLE                  StdInputHandle;
    118. 

  118. #   HANDLE                  StdOutputHandle;
    119. 

  119. #   HANDLE                  StdErrorHandle;
    120. 

  120. #   UNICODE_STRING          CurrentDirectoryPath;
    121. 

  121. #   HANDLE                  CurrentDirectoryHandle;
    122. 

  122. #   UNICODE_STRING          DllPath;
    123. 

  123. #   UNICODE_STRING          ImagePathName;
    124. 

  124. #   UNICODE_STRING          CommandLine;
    125. 

  125. #   PVOID                   Environment;
    126. 

  126. #   ULONG                   StartingPositionLeft;
    127. 

  127. #   ULONG                   StartingPositionTop;
    128. 

  128. #   ULONG                   Width;
    129. 

  129. #   ULONG                   Height;
    130. 

  130. #   ULONG                   CharWidth;
    131. 

  131. #   ULONG                   CharHeight;
    132. 

  132. #   ULONG                   ConsoleTextAttributes;
    133. 

  133. #   ULONG                   WindowFlags;
    134. 

  134. #   ULONG                   ShowWindowFlags;
    135. 

  135. #   UNICODE_STRING          WindowTitle;
    136. 

  136. #   UNICODE_STRING          DesktopName;
    137. 

  137. #   UNICODE_STRING          ShellInfo;
    138. 

  138. #   UNICODE_STRING          RuntimeData;
    139. 

  139. #   RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
    140. 

  140. # } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
    141. 

  141. 

  142. # kd> dt _RTL_USER_PROCESS_PARAMETERS
    143. 

  143. # ntdll!_RTL_USER_PROCESS_PARAMETERS
    144. 

  144. #    +0x000 MaximumLength    : Uint4B
    145. 

  145. #    +0x004 Length           : Uint4B
    146. 

  146. #    +0x008 Flags            : Uint4B
    147. 

  147. #    +0x00c DebugFlags       : Uint4B
    148. 

  148. #    +0x010 ConsoleHandle    : Ptr32 Void
    149. 

  149. #    +0x014 ConsoleFlags     : Uint4B
    150. 

  150. #    +0x018 StandardInput    : Ptr32 Void
    151. 

  151. #    +0x01c StandardOutput   : Ptr32 Void
    152. 

  152. #    +0x020 StandardError    : Ptr32 Void
    153. 

  153. #    +0x024 CurrentDirectory : _CURDIR
    154. 

  154. #    +0x030 DllPath          : _UNICODE_STRING
    155. 

  155. #    +0x038 ImagePathName    : _UNICODE_STRING
    156. 

  156. #    +0x040 CommandLine      : _UNICODE_STRING
    157. 

  157. #    +0x048 Environment      : Ptr32 Void
    158. 

  158. #    +0x04c StartingX        : Uint4B
    159. 

  159. #    +0x050 StartingY        : Uint4B
    160. 

  160. #    +0x054 CountX           : Uint4B
    161. 

  161. #    +0x058 CountY           : Uint4B
    162. 

  162. #    +0x05c CountCharsX      : Uint4B
    163. 

  163. #    +0x060 CountCharsY      : Uint4B
    164. 

  164. #    +0x064 FillAttribute    : Uint4B
    165. 

  165. #    +0x068 WindowFlags      : Uint4B
    166. 

  166. #    +0x06c ShowWindowFlags  : Uint4B
    167. 

  167. #    +0x070 WindowTitle      : _UNICODE_STRING
    168. 

  168. #    +0x078 DesktopInfo      : _UNICODE_STRING
    169. 

  169. #    +0x080 ShellInfo        : _UNICODE_STRING
    170. 

  170. #    +0x088 RuntimeData      : _UNICODE_STRING
    171. 

  171. #    +0x090 CurrentDirectores : [32] _RTL_DRIVE_LETTER_CURDIR
    172. 

  172. #    +0x290 EnvironmentSize  : Uint4B
    173. 

  173. ##class RTL_USER_PROCESS_PARAMETERS(Structure):
    174. 

  174. ##    _fields_ = [
    175. 

  175. ##        ("MaximumLength",           ULONG),
    176. 

  176. ##        ("Length",                  ULONG),
    177. 

  177. ##        ("Flags",                   ULONG),
    178. 

  178. ##        ("DebugFlags",              ULONG),
    179. 

  179. ##        ("ConsoleHandle",           PVOID),
    180. 

  180. ##        ("ConsoleFlags",            ULONG),
    181. 

  181. ##        ("StandardInput",           HANDLE),
    182. 

  182. ##        ("StandardOutput",          HANDLE),
    183. 

  183. ##        ("StandardError",           HANDLE),
    184. 

  184. ##        ("CurrentDirectory",        CURDIR),
    185. 

  185. ##        ("DllPath",                 UNICODE_STRING),
    186. 

  186. ##        ("ImagePathName",           UNICODE_STRING),
    187. 

  187. ##        ("CommandLine",             UNICODE_STRING),
    188. 

  188. ##        ("Environment",             PVOID),
    189. 

  189. ##        ("StartingX",               ULONG),
    190. 

  190. ##        ("StartingY",               ULONG),
    191. 

  191. ##        ("CountX",                  ULONG),
    192. 

  192. ##        ("CountY",                  ULONG),
    193. 

  193. ##        ("CountCharsX",             ULONG),
    194. 

  194. ##        ("CountCharsY",             ULONG),
    195. 

  195. ##        ("FillAttribute",           ULONG),
    196. 

  196. ##        ("WindowFlags",             ULONG),
    197. 

  197. ##        ("ShowWindowFlags",         ULONG),
    198. 

  198. ##        ("WindowTitle",             UNICODE_STRING),
    199. 

  199. ##        ("DesktopInfo",             UNICODE_STRING),
    200. 

  200. ##        ("ShellInfo",               UNICODE_STRING),
    201. 

  201. ##        ("RuntimeData",             UNICODE_STRING),
    202. 

  202. ##        ("CurrentDirectores",       RTL_DRIVE_LETTER_CURDIR * 32), # typo here?
    203. 

  203. ##
    204. 

  204. ##        # Windows 2008 and Vista
    205. 

  205. ##        ("EnvironmentSize",         ULONG),
    206. 

  206. ##]
    207. 

  207. ##    @property
    208. 

  208. ##    def CurrentDirectories(self):
    209. 

  209. ##        return self.CurrentDirectores
    210. 

  210. 

  211. # From MSDN:
    212. 

  212. #
    213. 

  213. # typedef struct _RTL_USER_PROCESS_PARAMETERS {
    214. 

  214. #   BYTE             Reserved1[16];
    215. 

  215. #   PVOID            Reserved2[10];
    216. 

  216. #   UNICODE_STRING   ImagePathName;
    217. 

  217. #   UNICODE_STRING   CommandLine;
    218. 

  218. # } RTL_USER_PROCESS_PARAMETERS,
    219. 

  219. #  *PRTL_USER_PROCESS_PARAMETERS;
    220. 

  220. class RTL_USER_PROCESS_PARAMETERS(Structure):
    221. 

  221.     _fields_ = [
    222. 

  222.         ("Reserved1",               BYTE * 16),
    223. 

  223.         ("Reserved2",               PVOID * 10),
    224. 

  224.         ("ImagePathName",           UNICODE_STRING),
    225. 

  225.         ("CommandLine",             UNICODE_STRING),
    226. 

  226.         ("Environment",             PVOID),             # undocumented!
    227. 

  227.         #
    228. 

  228.         # XXX TODO
    229. 

  229.         # This structure should be defined with all undocumented fields for
    230. 

  230.         # each version of Windows, just like it's being done for PEB and TEB.
    231. 

  231.         #
    232. 

  232. ]
    233. 

  233. 

  234. PPS_POST_PROCESS_INIT_ROUTINE = PVOID
    235. 

  235. 

  236. #from MSDN:
    237. 

  237. #
    238. 

  238. # typedef struct _PEB {
    239. 

  239. #     BYTE Reserved1[2];
    240. 

  240. #     BYTE BeingDebugged;
    241. 

  241. #     BYTE Reserved2[21];
    242. 

  242. #     PPEB_LDR_DATA LoaderData;
    243. 

  243. #     PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    244. 

  244. #     BYTE Reserved3[520];
    245. 

  245. #     PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
    246. 

  246. #     BYTE Reserved4[136];
    247. 

  247. #     ULONG SessionId;
    248. 

  248. # } PEB;
    249. 

  249. ##class PEB(Structure):
    250. 

  250. ##    _fields_ = [
    251. 

  251. ##        ("Reserved1",               BYTE * 2),
    252. 

  252. ##        ("BeingDebugged",           BYTE),
    253. 

  253. ##        ("Reserved2",               BYTE * 21),
    254. 

  254. ##        ("LoaderData",              PVOID,    # PPEB_LDR_DATA
    255. 

  255. ##        ("ProcessParameters",       PVOID,    # PRTL_USER_PROCESS_PARAMETERS
    256. 

  256. ##        ("Reserved3",               BYTE * 520),
    257. 

  257. ##        ("PostProcessInitRoutine",  PPS_POST_PROCESS_INIT_ROUTINE),
    258. 

  258. ##        ("Reserved4",               BYTE),
    259. 

  259. ##        ("SessionId",               ULONG),
    260. 

  260. ##]
    261. 

  261. 

  262. # from MSDN:
    263. 

  263. #
    264. 

  264. # typedef struct _TEB {
    265. 

  265. #   BYTE    Reserved1[1952];
    266. 

  266. #   PVOID   Reserved2[412];
    267. 

  267. #   PVOID   TlsSlots[64];
    268. 

  268. #   BYTE    Reserved3[8];
    269. 

  269. #   PVOID   Reserved4[26];
    270. 

  270. #   PVOID   ReservedForOle;
    271. 

  271. #   PVOID   Reserved5[4];
    272. 

  272. #   PVOID   TlsExpansionSlots;
    273. 

  273. # } TEB,
    274. 

  274. #  *PTEB;
    275. 

  275. ##class TEB(Structure):
    276. 

  276. ##    _fields_ = [
    277. 

  277. ##        ("Reserved1",           PVOID * 1952),
    278. 

  278. ##        ("Reserved2",           PVOID * 412),
    279. 

  279. ##        ("TlsSlots",            PVOID * 64),
    280. 

  280. ##        ("Reserved3",           BYTE  * 8),
    281. 

  281. ##        ("Reserved4",           PVOID * 26),
    282. 

  282. ##        ("ReservedForOle",      PVOID),
    283. 

  283. ##        ("Reserved5",           PVOID * 4),
    284. 

  284. ##        ("TlsExpansionSlots",   PVOID),
    285. 

  285. ##]
    286. 

  286. 

  287. # from http://undocumented.ntinternals.net/UserMode/Structures/LDR_MODULE.html
    288. 

  288. #
    289. 

  289. # typedef struct _LDR_MODULE {
    290. 

  290. #   LIST_ENTRY InLoadOrderModuleList;
    291. 

  291. #   LIST_ENTRY InMemoryOrderModuleList;
    292. 

  292. #   LIST_ENTRY InInitializationOrderModuleList;
    293. 

  293. #   PVOID BaseAddress;
    294. 

  294. #   PVOID EntryPoint;
    295. 

  295. #   ULONG SizeOfImage;
    296. 

  296. #   UNICODE_STRING FullDllName;
    297. 

  297. #   UNICODE_STRING BaseDllName;
    298. 

  298. #   ULONG Flags;
    299. 

  299. #   SHORT LoadCount;
    300. 

  300. #   SHORT TlsIndex;
    301. 

  301. #   LIST_ENTRY HashTableEntry;
    302. 

  302. #   ULONG TimeDateStamp;
    303. 

  303. # } LDR_MODULE, *PLDR_MODULE;
    304. 

  304. class LDR_MODULE(Structure):
    305. 

  305.     _fields_ = [
    306. 

  306.         ("InLoadOrderModuleList",           LIST_ENTRY),
    307. 

  307.         ("InMemoryOrderModuleList",         LIST_ENTRY),
    308. 

  308.         ("InInitializationOrderModuleList", LIST_ENTRY),
    309. 

  309.         ("BaseAddress",                     PVOID),
    310. 

  310.         ("EntryPoint",                      PVOID),
    311. 

  311.         ("SizeOfImage",                     ULONG),
    312. 

  312.         ("FullDllName",                     UNICODE_STRING),
    313. 

  313.         ("BaseDllName",                     UNICODE_STRING),
    314. 

  314.         ("Flags",                           ULONG),
    315. 

  315.         ("LoadCount",                       SHORT),
    316. 

  316.         ("TlsIndex",                        SHORT),
    317. 

  317.         ("HashTableEntry",                  LIST_ENTRY),
    318. 

  318.         ("TimeDateStamp",                   ULONG),
    319. 

  319. ]
    320. 

  320. 

  321. # from http://undocumented.ntinternals.net/UserMode/Structures/PEB_LDR_DATA.html
    322. 

  322. #
    323. 

  323. # typedef struct _PEB_LDR_DATA {
    324. 

  324. #   ULONG Length;
    325. 

  325. #   BOOLEAN Initialized;
    326. 

  326. #   PVOID SsHandle;
    327. 

  327. #   LIST_ENTRY InLoadOrderModuleList;
    328. 

  328. #   LIST_ENTRY InMemoryOrderModuleList;
    329. 

  329. #   LIST_ENTRY InInitializationOrderModuleList;
    330. 

  330. # } PEB_LDR_DATA, *PPEB_LDR_DATA;
    331. 

  331. class PEB_LDR_DATA(Structure):
    332. 

  332.     _fields_ = [
    333. 

  333.         ("Length",                          ULONG),
    334. 

  334.         ("Initialized",                     BOOLEAN),
    335. 

  335.         ("SsHandle",                        PVOID),
    336. 

  336.         ("InLoadOrderModuleList",           LIST_ENTRY),
    337. 

  337.         ("InMemoryOrderModuleList",         LIST_ENTRY),
    338. 

  338.         ("InInitializationOrderModuleList", LIST_ENTRY),
    339. 

  339. ]
    340. 

  340. 

  341. # From http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Process/PEB_FREE_BLOCK.html
    342. 

  342. #
    343. 

  343. # typedef struct _PEB_FREE_BLOCK {
    344. 

  344. #   PEB_FREE_BLOCK *Next;
    345. 

  345. #   ULONG Size;
    346. 

  346. # } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
    347. 

  347. class PEB_FREE_BLOCK(Structure):
    348. 

  348.     pass
    349. 

  349. 

  350. ##PPEB_FREE_BLOCK = POINTER(PEB_FREE_BLOCK)
    351. 

  351. PPEB_FREE_BLOCK = PVOID
    352. 

  352. 

  353. PEB_FREE_BLOCK._fields_ = [
    354. 

  354.         ("Next", PPEB_FREE_BLOCK),
    355. 

  355.         ("Size", ULONG),
    356. 

  356. ]
    357. 

  357. 

  358. # From http://undocumented.ntinternals.net/UserMode/Structures/RTL_DRIVE_LETTER_CURDIR.html
    359. 

  359. #
    360. 

  360. # typedef struct _RTL_DRIVE_LETTER_CURDIR {
    361. 

  361. #   USHORT Flags;
    362. 

  362. #   USHORT Length;
    363. 

  363. #   ULONG TimeStamp;
    364. 

  364. #   UNICODE_STRING DosPath;
    365. 

  365. # } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
    366. 

  366. class RTL_DRIVE_LETTER_CURDIR(Structure):
    367. 

  367.     _fields_ = [
    368. 

  368.         ("Flags",       USHORT),
    369. 

  369.         ("Length",      USHORT),
    370. 

  370.         ("TimeStamp",   ULONG),
    371. 

  371.         ("DosPath",     UNICODE_STRING),
    372. 

  372. ]
    373. 

  373. 

  374. # From http://www.nirsoft.net/kernel_struct/vista/CURDIR.html
    375. 

  375. #
    376. 

  376. # typedef struct _CURDIR
    377. 

  377. # {
    378. 

  378. #      UNICODE_STRING DosPath;
    379. 

  379. #      PVOID Handle;
    380. 

  380. # } CURDIR, *PCURDIR;
    381. 

  381. class CURDIR(Structure):
    382. 

  382.     _fields_ = [
    383. 

  383.         ("DosPath", UNICODE_STRING),
    384. 

  384.         ("Handle",  PVOID),
    385. 

  385. ]
    386. 

  386. 

  387. # From http://www.nirsoft.net/kernel_struct/vista/RTL_CRITICAL_SECTION_DEBUG.html
    388. 

  388. #
    389. 

  389. # typedef struct _RTL_CRITICAL_SECTION_DEBUG
    390. 

  390. # {
    391. 

  391. #      WORD Type;
    392. 

  392. #      WORD CreatorBackTraceIndex;
    393. 

  393. #      PRTL_CRITICAL_SECTION CriticalSection;
    394. 

  394. #      LIST_ENTRY ProcessLocksList;
    395. 

  395. #      ULONG EntryCount;
    396. 

  396. #      ULONG ContentionCount;
    397. 

  397. #      ULONG Flags;
    398. 

  398. #      WORD CreatorBackTraceIndexHigh;
    399. 

  399. #      WORD SpareUSHORT;
    400. 

  400. # } RTL_CRITICAL_SECTION_DEBUG, *PRTL_CRITICAL_SECTION_DEBUG;
    401. 

  401. #
    402. 

  402. # From http://www.nirsoft.net/kernel_struct/vista/RTL_CRITICAL_SECTION.html
    403. 

  403. #
    404. 

  404. # typedef struct _RTL_CRITICAL_SECTION
    405. 

  405. # {
    406. 

  406. #      PRTL_CRITICAL_SECTION_DEBUG DebugInfo;
    407. 

  407. #      LONG LockCount;
    408. 

  408. #      LONG RecursionCount;
    409. 

  409. #      PVOID OwningThread;
    410. 

  410. #      PVOID LockSemaphore;
    411. 

  411. #      ULONG SpinCount;
    412. 

  412. # } RTL_CRITICAL_SECTION, *PRTL_CRITICAL_SECTION;
    413. 

  413. #
    414. 

  414. class RTL_CRITICAL_SECTION(Structure):
    415. 

  415.     _fields_ = [
    416. 

  416.         ("DebugInfo",       PVOID),     # PRTL_CRITICAL_SECTION_DEBUG
    417. 

  417.         ("LockCount",       LONG),
    418. 

  418.         ("RecursionCount",  LONG),
    419. 

  419.         ("OwningThread",    PVOID),
    420. 

  420.         ("LockSemaphore",   PVOID),
    421. 

  421.         ("SpinCount",       ULONG),
    422. 

  422. ]
    423. 

  423. class RTL_CRITICAL_SECTION_DEBUG(Structure):
    424. 

  424.     _fields_ = [
    425. 

  425.         ("Type",                        WORD),
    426. 

  426.         ("CreatorBackTraceIndex",       WORD),
    427. 

  427.         ("CriticalSection",             PVOID),         # PRTL_CRITICAL_SECTION
    428. 

  428.         ("ProcessLocksList",            LIST_ENTRY),
    429. 

  429.         ("EntryCount",                  ULONG),
    430. 

  430.         ("ContentionCount",             ULONG),
    431. 

  431.         ("Flags",                       ULONG),
    432. 

  432.         ("CreatorBackTraceIndexHigh",   WORD),
    433. 

  433.         ("SpareUSHORT",                 WORD),
    434. 

  434. ]
    435. 

  435. PRTL_CRITICAL_SECTION       = POINTER(RTL_CRITICAL_SECTION)
    436. 

  436. PRTL_CRITICAL_SECTION_DEBUG = POINTER(RTL_CRITICAL_SECTION_DEBUG)
    437. 

  437. 

  438. PPEB_LDR_DATA                   = POINTER(PEB_LDR_DATA)
    439. 

  439. PRTL_USER_PROCESS_PARAMETERS    = POINTER(RTL_USER_PROCESS_PARAMETERS)
    440. 

  440. 

  441. PPEBLOCKROUTINE                 = PVOID
    442. 

  442. 

  443. # BitField
    444. 

  444. ImageUsesLargePages             = 1 << 0
    445. 

  445. IsProtectedProcess              = 1 << 1
    446. 

  446. IsLegacyProcess                 = 1 << 2
    447. 

  447. IsImageDynamicallyRelocated     = 1 << 3
    448. 

  448. SkipPatchingUser32Forwarders    = 1 << 4
    449. 

  449. 

  450. # CrossProcessFlags
    451. 

  451. ProcessInJob                    = 1 << 0
    452. 

  452. ProcessInitializing             = 1 << 1
    453. 

  453. ProcessUsingVEH                 = 1 << 2
    454. 

  454. ProcessUsingVCH                 = 1 << 3
    455. 

  455. ProcessUsingFTH                 = 1 << 4
    456. 

  456. 

  457. # TracingFlags
    458. 

  458. HeapTracingEnabled              = 1 << 0
    459. 

  459. CritSecTracingEnabled           = 1 << 1
    460. 

  460. 

  461. # NtGlobalFlags
    462. 

  462. FLG_VALID_BITS                  = 0x003FFFFF    # not a flag
    463. 

  463. FLG_STOP_ON_EXCEPTION           = 0x00000001
    464. 

  464. FLG_SHOW_LDR_SNAPS              = 0x00000002
    465. 

  465. FLG_DEBUG_INITIAL_COMMAND       = 0x00000004
    466. 

  466. FLG_STOP_ON_HUNG_GUI            = 0x00000008
    467. 

  467. FLG_HEAP_ENABLE_TAIL_CHECK      = 0x00000010
    468. 

  468. FLG_HEAP_ENABLE_FREE_CHECK      = 0x00000020
    469. 

  469. FLG_HEAP_VALIDATE_PARAMETERS    = 0x00000040
    470. 

  470. FLG_HEAP_VALIDATE_ALL           = 0x00000080
    471. 

  471. FLG_POOL_ENABLE_TAIL_CHECK      = 0x00000100
    472. 

  472. FLG_POOL_ENABLE_FREE_CHECK      = 0x00000200
    473. 

  473. FLG_POOL_ENABLE_TAGGING         = 0x00000400
    474. 

  474. FLG_HEAP_ENABLE_TAGGING         = 0x00000800
    475. 

  475. FLG_USER_STACK_TRACE_DB         = 0x00001000
    476. 

  476. FLG_KERNEL_STACK_TRACE_DB       = 0x00002000
    477. 

  477. FLG_MAINTAIN_OBJECT_TYPELIST    = 0x00004000
    478. 

  478. FLG_HEAP_ENABLE_TAG_BY_DLL      = 0x00008000
    479. 

  479. FLG_IGNORE_DEBUG_PRIV           = 0x00010000
    480. 

  480. FLG_ENABLE_CSRDEBUG             = 0x00020000
    481. 

  481. FLG_ENABLE_KDEBUG_SYMBOL_LOAD   = 0x00040000
    482. 

  482. FLG_DISABLE_PAGE_KERNEL_STACKS  = 0x00080000
    483. 

  483. FLG_HEAP_ENABLE_CALL_TRACING    = 0x00100000
    484. 

  484. FLG_HEAP_DISABLE_COALESCING     = 0x00200000
    485. 

  485. FLG_ENABLE_CLOSE_EXCEPTION      = 0x00400000
    486. 

  486. FLG_ENABLE_EXCEPTION_LOGGING    = 0x00800000
    487. 

  487. FLG_ENABLE_HANDLE_TYPE_TAGGING  = 0x01000000
    488. 

  488. FLG_HEAP_PAGE_ALLOCS            = 0x02000000
    489. 

  489. FLG_DEBUG_WINLOGON              = 0x04000000
    490. 

  490. FLG_ENABLE_DBGPRINT_BUFFERING   = 0x08000000
    491. 

  491. FLG_EARLY_CRITICAL_SECTION_EVT  = 0x10000000
    492. 

  492. FLG_DISABLE_DLL_VERIFICATION    = 0x80000000
    493. 

  493. 

  494. class _PEB_NT(Structure):
    495. 

  495.     _pack_   = 4
    496. 

  496.     _fields_ = [
    497. 

  497.         ("InheritedAddressSpace",               BOOLEAN),
    498. 

  498.         ("ReadImageFileExecOptions",            UCHAR),
    499. 

  499.         ("BeingDebugged",                       BOOLEAN),
    500. 

  500.         ("BitField",                            UCHAR),
    501. 

  501.         ("Mutant",                              HANDLE),
    502. 

  502.         ("ImageBaseAddress",                    PVOID),
    503. 

  503.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    504. 

  504.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    505. 

  505.         ("SubSystemData",                       PVOID),
    506. 

  506.         ("ProcessHeap",                         PVOID),
    507. 

  507.         ("FastPebLock",                         PVOID),
    508. 

  508.         ("FastPebLockRoutine",                  PVOID), # PPEBLOCKROUTINE
    509. 

  509.         ("FastPebUnlockRoutine",                PVOID), # PPEBLOCKROUTINE
    510. 

  510.         ("EnvironmentUpdateCount",              ULONG),
    511. 

  511.         ("KernelCallbackTable",                 PVOID), # Ptr32 Ptr32 Void
    512. 

  512.         ("EventLogSection",                     PVOID),
    513. 

  513.         ("EventLog",                            PVOID),
    514. 

  514.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    515. 

  515.         ("TlsExpansionCounter",                 ULONG),
    516. 

  516.         ("TlsBitmap",                           PVOID),
    517. 

  517.         ("TlsBitmapBits",                       ULONG * 2),
    518. 

  518.         ("ReadOnlySharedMemoryBase",            PVOID),
    519. 

  519.         ("ReadOnlySharedMemoryHeap",            PVOID),
    520. 

  520.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    521. 

  521.         ("AnsiCodePageData",                    PVOID),
    522. 

  522.         ("OemCodePageData",                     PVOID),
    523. 

  523.         ("UnicodeCaseTableData",                PVOID),
    524. 

  524.         ("NumberOfProcessors",                  ULONG),
    525. 

  525.         ("NtGlobalFlag",                        ULONG),
    526. 

  526.         ("Spare2",                              BYTE * 4),
    527. 

  527.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    528. 

  528.         ("HeapSegmentReserve",                  ULONG),
    529. 

  529.         ("HeapSegmentCommit",                   ULONG),
    530. 

  530.         ("HeapDeCommitTotalFreeThreshold",      ULONG),
    531. 

  531.         ("HeapDeCommitFreeBlockThreshold",      ULONG),
    532. 

  532.         ("NumberOfHeaps",                       ULONG),
    533. 

  533.         ("MaximumNumberOfHeaps",                ULONG),
    534. 

  534.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    535. 

  535.         ("GdiSharedHandleTable",                PVOID),
    536. 

  536.         ("ProcessStarterHelper",                PVOID),
    537. 

  537.         ("GdiDCAttributeList",                  PVOID),
    538. 

  538.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    539. 

  539.         ("OSMajorVersion",                      ULONG),
    540. 

  540.         ("OSMinorVersion",                      ULONG),
    541. 

  541.         ("OSBuildNumber",                       ULONG),
    542. 

  542.         ("OSPlatformId",                        ULONG),
    543. 

  543.         ("ImageSubSystem",                      ULONG),
    544. 

  544.         ("ImageSubSystemMajorVersion",          ULONG),
    545. 

  545.         ("ImageSubSystemMinorVersion",          ULONG),
    546. 

  546.         ("ImageProcessAffinityMask",            ULONG),
    547. 

  547.         ("GdiHandleBuffer",                     ULONG * 34),
    548. 

  548.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    549. 

  549.         ("TlsExpansionBitmap",                  ULONG),
    550. 

  550.         ("TlsExpansionBitmapBits",              BYTE * 128),
    551. 

  551.         ("SessionId",                           ULONG),
    552. 

  552.     ]
    553. 

  553. 

  554. # not really, but "dt _PEB" in w2k isn't working for me :(
    555. 

  555. _PEB_2000 = _PEB_NT
    556. 

  556. 

  557. #    +0x000 InheritedAddressSpace : UChar
    558. 

  558. #    +0x001 ReadImageFileExecOptions : UChar
    559. 

  559. #    +0x002 BeingDebugged    : UChar
    560. 

  560. #    +0x003 SpareBool        : UChar
    561. 

  561. #    +0x004 Mutant           : Ptr32 Void
    562. 

  562. #    +0x008 ImageBaseAddress : Ptr32 Void
    563. 

  563. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    564. 

  564. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    565. 

  565. #    +0x014 SubSystemData    : Ptr32 Void
    566. 

  566. #    +0x018 ProcessHeap      : Ptr32 Void
    567. 

  567. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    568. 

  568. #    +0x020 FastPebLockRoutine : Ptr32 Void
    569. 

  569. #    +0x024 FastPebUnlockRoutine : Ptr32 Void
    570. 

  570. #    +0x028 EnvironmentUpdateCount : Uint4B
    571. 

  571. #    +0x02c KernelCallbackTable : Ptr32 Void
    572. 

  572. #    +0x030 SystemReserved   : [1] Uint4B
    573. 

  573. #    +0x034 AtlThunkSListPtr32 : Uint4B
    574. 

  574. #    +0x038 FreeList         : Ptr32 _PEB_FREE_BLOCK
    575. 

  575. #    +0x03c TlsExpansionCounter : Uint4B
    576. 

  576. #    +0x040 TlsBitmap        : Ptr32 Void
    577. 

  577. #    +0x044 TlsBitmapBits    : [2] Uint4B
    578. 

  578. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    579. 

  579. #    +0x050 ReadOnlySharedMemoryHeap : Ptr32 Void
    580. 

  580. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    581. 

  581. #    +0x058 AnsiCodePageData : Ptr32 Void
    582. 

  582. #    +0x05c OemCodePageData  : Ptr32 Void
    583. 

  583. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    584. 

  584. #    +0x064 NumberOfProcessors : Uint4B
    585. 

  585. #    +0x068 NtGlobalFlag     : Uint4B
    586. 

  586. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    587. 

  587. #    +0x078 HeapSegmentReserve : Uint4B
    588. 

  588. #    +0x07c HeapSegmentCommit : Uint4B
    589. 

  589. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    590. 

  590. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    591. 

  591. #    +0x088 NumberOfHeaps    : Uint4B
    592. 

  592. #    +0x08c MaximumNumberOfHeaps : Uint4B
    593. 

  593. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    594. 

  594. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    595. 

  595. #    +0x098 ProcessStarterHelper : Ptr32 Void
    596. 

  596. #    +0x09c GdiDCAttributeList : Uint4B
    597. 

  597. #    +0x0a0 LoaderLock       : Ptr32 Void
    598. 

  598. #    +0x0a4 OSMajorVersion   : Uint4B
    599. 

  599. #    +0x0a8 OSMinorVersion   : Uint4B
    600. 

  600. #    +0x0ac OSBuildNumber    : Uint2B
    601. 

  601. #    +0x0ae OSCSDVersion     : Uint2B
    602. 

  602. #    +0x0b0 OSPlatformId     : Uint4B
    603. 

  603. #    +0x0b4 ImageSubsystem   : Uint4B
    604. 

  604. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    605. 

  605. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    606. 

  606. #    +0x0c0 ImageProcessAffinityMask : Uint4B
    607. 

  607. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    608. 

  608. #    +0x14c PostProcessInitRoutine : Ptr32     void
    609. 

  609. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    610. 

  610. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    611. 

  611. #    +0x1d4 SessionId        : Uint4B
    612. 

  612. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    613. 

  613. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    614. 

  614. #    +0x1e8 pShimData        : Ptr32 Void
    615. 

  615. #    +0x1ec AppCompatInfo    : Ptr32 Void
    616. 

  616. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    617. 

  617. #    +0x1f8 ActivationContextData : Ptr32 Void
    618. 

  618. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 Void
    619. 

  619. #    +0x200 SystemDefaultActivationContextData : Ptr32 Void
    620. 

  620. #    +0x204 SystemAssemblyStorageMap : Ptr32 Void
    621. 

  621. #    +0x208 MinimumStackCommit : Uint4B
    622. 

  622. class _PEB_XP(Structure):
    623. 

  623.     _pack_   = 8
    624. 

  624.     _fields_ = [
    625. 

  625.         ("InheritedAddressSpace",               BOOLEAN),
    626. 

  626.         ("ReadImageFileExecOptions",            UCHAR),
    627. 

  627.         ("BeingDebugged",                       BOOLEAN),
    628. 

  628.         ("SpareBool",                           UCHAR),
    629. 

  629.         ("Mutant",                              HANDLE),
    630. 

  630.         ("ImageBaseAddress",                    PVOID),
    631. 

  631.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    632. 

  632.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    633. 

  633.         ("SubSystemData",                       PVOID),
    634. 

  634.         ("ProcessHeap",                         PVOID),
    635. 

  635.         ("FastPebLock",                         PVOID),
    636. 

  636.         ("FastPebLockRoutine",                  PVOID),
    637. 

  637.         ("FastPebUnlockRoutine",                PVOID),
    638. 

  638.         ("EnvironmentUpdateCount",              DWORD),
    639. 

  639.         ("KernelCallbackTable",                 PVOID),
    640. 

  640.         ("SystemReserved",                      DWORD),
    641. 

  641.         ("AtlThunkSListPtr32",                  DWORD),
    642. 

  642.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    643. 

  643.         ("TlsExpansionCounter",                 DWORD),
    644. 

  644.         ("TlsBitmap",                           PVOID),
    645. 

  645.         ("TlsBitmapBits",                       DWORD * 2),
    646. 

  646.         ("ReadOnlySharedMemoryBase",            PVOID),
    647. 

  647.         ("ReadOnlySharedMemoryHeap",            PVOID),
    648. 

  648.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    649. 

  649.         ("AnsiCodePageData",                    PVOID),
    650. 

  650.         ("OemCodePageData",                     PVOID),
    651. 

  651.         ("UnicodeCaseTableData",                PVOID),
    652. 

  652.         ("NumberOfProcessors",                  DWORD),
    653. 

  653.         ("NtGlobalFlag",                        DWORD),
    654. 

  654.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    655. 

  655.         ("HeapSegmentReserve",                  DWORD),
    656. 

  656.         ("HeapSegmentCommit",                   DWORD),
    657. 

  657.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    658. 

  658.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    659. 

  659.         ("NumberOfHeaps",                       DWORD),
    660. 

  660.         ("MaximumNumberOfHeaps",                DWORD),
    661. 

  661.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    662. 

  662.         ("GdiSharedHandleTable",                PVOID),
    663. 

  663.         ("ProcessStarterHelper",                PVOID),
    664. 

  664.         ("GdiDCAttributeList",                  DWORD),
    665. 

  665.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    666. 

  666.         ("OSMajorVersion",                      DWORD),
    667. 

  667.         ("OSMinorVersion",                      DWORD),
    668. 

  668.         ("OSBuildNumber",                       WORD),
    669. 

  669.         ("OSCSDVersion",                        WORD),
    670. 

  670.         ("OSPlatformId",                        DWORD),
    671. 

  671.         ("ImageSubsystem",                      DWORD),
    672. 

  672.         ("ImageSubsystemMajorVersion",          DWORD),
    673. 

  673.         ("ImageSubsystemMinorVersion",          DWORD),
    674. 

  674.         ("ImageProcessAffinityMask",            DWORD),
    675. 

  675.         ("GdiHandleBuffer",                     DWORD * 34),
    676. 

  676.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    677. 

  677.         ("TlsExpansionBitmap",                  PVOID),
    678. 

  678.         ("TlsExpansionBitmapBits",              DWORD * 32),
    679. 

  679.         ("SessionId",                           DWORD),
    680. 

  680.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    681. 

  681.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    682. 

  682.         ("pShimData",                           PVOID),
    683. 

  683.         ("AppCompatInfo",                       PVOID),
    684. 

  684.         ("CSDVersion",                          UNICODE_STRING),
    685. 

  685.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    686. 

  686.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    687. 

  687.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    688. 

  688.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    689. 

  689.         ("MinimumStackCommit",                  DWORD),
    690. 

  690.     ]
    691. 

  691. 

  692. #    +0x000 InheritedAddressSpace : UChar
    693. 

  693. #    +0x001 ReadImageFileExecOptions : UChar
    694. 

  694. #    +0x002 BeingDebugged    : UChar
    695. 

  695. #    +0x003 BitField         : UChar
    696. 

  696. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    697. 

  697. #    +0x003 SpareBits        : Pos 1, 7 Bits
    698. 

  698. #    +0x008 Mutant           : Ptr64 Void
    699. 

  699. #    +0x010 ImageBaseAddress : Ptr64 Void
    700. 

  700. #    +0x018 Ldr              : Ptr64 _PEB_LDR_DATA
    701. 

  701. #    +0x020 ProcessParameters : Ptr64 _RTL_USER_PROCESS_PARAMETERS
    702. 

  702. #    +0x028 SubSystemData    : Ptr64 Void
    703. 

  703. #    +0x030 ProcessHeap      : Ptr64 Void
    704. 

  704. #    +0x038 FastPebLock      : Ptr64 _RTL_CRITICAL_SECTION
    705. 

  705. #    +0x040 AtlThunkSListPtr : Ptr64 Void
    706. 

  706. #    +0x048 SparePtr2        : Ptr64 Void
    707. 

  707. #    +0x050 EnvironmentUpdateCount : Uint4B
    708. 

  708. #    +0x058 KernelCallbackTable : Ptr64 Void
    709. 

  709. #    +0x060 SystemReserved   : [1] Uint4B
    710. 

  710. #    +0x064 SpareUlong       : Uint4B
    711. 

  711. #    +0x068 FreeList         : Ptr64 _PEB_FREE_BLOCK
    712. 

  712. #    +0x070 TlsExpansionCounter : Uint4B
    713. 

  713. #    +0x078 TlsBitmap        : Ptr64 Void
    714. 

  714. #    +0x080 TlsBitmapBits    : [2] Uint4B
    715. 

  715. #    +0x088 ReadOnlySharedMemoryBase : Ptr64 Void
    716. 

  716. #    +0x090 ReadOnlySharedMemoryHeap : Ptr64 Void
    717. 

  717. #    +0x098 ReadOnlyStaticServerData : Ptr64 Ptr64 Void
    718. 

  718. #    +0x0a0 AnsiCodePageData : Ptr64 Void
    719. 

  719. #    +0x0a8 OemCodePageData  : Ptr64 Void
    720. 

  720. #    +0x0b0 UnicodeCaseTableData : Ptr64 Void
    721. 

  721. #    +0x0b8 NumberOfProcessors : Uint4B
    722. 

  722. #    +0x0bc NtGlobalFlag     : Uint4B
    723. 

  723. #    +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER
    724. 

  724. #    +0x0c8 HeapSegmentReserve : Uint8B
    725. 

  725. #    +0x0d0 HeapSegmentCommit : Uint8B
    726. 

  726. #    +0x0d8 HeapDeCommitTotalFreeThreshold : Uint8B
    727. 

  727. #    +0x0e0 HeapDeCommitFreeBlockThreshold : Uint8B
    728. 

  728. #    +0x0e8 NumberOfHeaps    : Uint4B
    729. 

  729. #    +0x0ec MaximumNumberOfHeaps : Uint4B
    730. 

  730. #    +0x0f0 ProcessHeaps     : Ptr64 Ptr64 Void
    731. 

  731. #    +0x0f8 GdiSharedHandleTable : Ptr64 Void
    732. 

  732. #    +0x100 ProcessStarterHelper : Ptr64 Void
    733. 

  733. #    +0x108 GdiDCAttributeList : Uint4B
    734. 

  734. #    +0x110 LoaderLock       : Ptr64 _RTL_CRITICAL_SECTION
    735. 

  735. #    +0x118 OSMajorVersion   : Uint4B
    736. 

  736. #    +0x11c OSMinorVersion   : Uint4B
    737. 

  737. #    +0x120 OSBuildNumber    : Uint2B
    738. 

  738. #    +0x122 OSCSDVersion     : Uint2B
    739. 

  739. #    +0x124 OSPlatformId     : Uint4B
    740. 

  740. #    +0x128 ImageSubsystem   : Uint4B
    741. 

  741. #    +0x12c ImageSubsystemMajorVersion : Uint4B
    742. 

  742. #    +0x130 ImageSubsystemMinorVersion : Uint4B
    743. 

  743. #    +0x138 ImageProcessAffinityMask : Uint8B
    744. 

  744. #    +0x140 GdiHandleBuffer  : [60] Uint4B
    745. 

  745. #    +0x230 PostProcessInitRoutine : Ptr64     void
    746. 

  746. #    +0x238 TlsExpansionBitmap : Ptr64 Void
    747. 

  747. #    +0x240 TlsExpansionBitmapBits : [32] Uint4B
    748. 

  748. #    +0x2c0 SessionId        : Uint4B
    749. 

  749. #    +0x2c8 AppCompatFlags   : _ULARGE_INTEGER
    750. 

  750. #    +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER
    751. 

  751. #    +0x2d8 pShimData        : Ptr64 Void
    752. 

  752. #    +0x2e0 AppCompatInfo    : Ptr64 Void
    753. 

  753. #    +0x2e8 CSDVersion       : _UNICODE_STRING
    754. 

  754. #    +0x2f8 ActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    755. 

  755. #    +0x300 ProcessAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    756. 

  756. #    +0x308 SystemDefaultActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    757. 

  757. #    +0x310 SystemAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    758. 

  758. #    +0x318 MinimumStackCommit : Uint8B
    759. 

  759. #    +0x320 FlsCallback      : Ptr64 Ptr64 Void
    760. 

  760. #    +0x328 FlsListHead      : _LIST_ENTRY
    761. 

  761. #    +0x338 FlsBitmap        : Ptr64 Void
    762. 

  762. #    +0x340 FlsBitmapBits    : [4] Uint4B
    763. 

  763. #    +0x350 FlsHighIndex     : Uint4B
    764. 

  764. class _PEB_XP_64(Structure):
    765. 

  765.     _pack_   = 8
    766. 

  766.     _fields_ = [
    767. 

  767.         ("InheritedAddressSpace",               BOOLEAN),
    768. 

  768.         ("ReadImageFileExecOptions",            UCHAR),
    769. 

  769.         ("BeingDebugged",                       BOOLEAN),
    770. 

  770.         ("BitField",                            UCHAR),
    771. 

  771.         ("Mutant",                              HANDLE),
    772. 

  772.         ("ImageBaseAddress",                    PVOID),
    773. 

  773.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    774. 

  774.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    775. 

  775.         ("SubSystemData",                       PVOID),
    776. 

  776.         ("ProcessHeap",                         PVOID),
    777. 

  777.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    778. 

  778.         ("AtlThunkSListPtr",                    PVOID),
    779. 

  779.         ("SparePtr2",                           PVOID),
    780. 

  780.         ("EnvironmentUpdateCount",              DWORD),
    781. 

  781.         ("KernelCallbackTable",                 PVOID),
    782. 

  782.         ("SystemReserved",                      DWORD),
    783. 

  783.         ("SpareUlong",                          DWORD),
    784. 

  784.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    785. 

  785.         ("TlsExpansionCounter",                 DWORD),
    786. 

  786.         ("TlsBitmap",                           PVOID),
    787. 

  787.         ("TlsBitmapBits",                       DWORD * 2),
    788. 

  788.         ("ReadOnlySharedMemoryBase",            PVOID),
    789. 

  789.         ("ReadOnlySharedMemoryHeap",            PVOID),
    790. 

  790.         ("ReadOnlyStaticServerData",            PVOID), # Ptr64 Ptr64 Void
    791. 

  791.         ("AnsiCodePageData",                    PVOID),
    792. 

  792.         ("OemCodePageData",                     PVOID),
    793. 

  793.         ("UnicodeCaseTableData",                PVOID),
    794. 

  794.         ("NumberOfProcessors",                  DWORD),
    795. 

  795.         ("NtGlobalFlag",                        DWORD),
    796. 

  796.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    797. 

  797.         ("HeapSegmentReserve",                  QWORD),
    798. 

  798.         ("HeapSegmentCommit",                   QWORD),
    799. 

  799.         ("HeapDeCommitTotalFreeThreshold",      QWORD),
    800. 

  800.         ("HeapDeCommitFreeBlockThreshold",      QWORD),
    801. 

  801.         ("NumberOfHeaps",                       DWORD),
    802. 

  802.         ("MaximumNumberOfHeaps",                DWORD),
    803. 

  803.         ("ProcessHeaps",                        PVOID), # Ptr64 Ptr64 Void
    804. 

  804.         ("GdiSharedHandleTable",                PVOID),
    805. 

  805.         ("ProcessStarterHelper",                PVOID),
    806. 

  806.         ("GdiDCAttributeList",                  DWORD),
    807. 

  807.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    808. 

  808.         ("OSMajorVersion",                      DWORD),
    809. 

  809.         ("OSMinorVersion",                      DWORD),
    810. 

  810.         ("OSBuildNumber",                       WORD),
    811. 

  811.         ("OSCSDVersion",                        WORD),
    812. 

  812.         ("OSPlatformId",                        DWORD),
    813. 

  813.         ("ImageSubsystem",                      DWORD),
    814. 

  814.         ("ImageSubsystemMajorVersion",          DWORD),
    815. 

  815.         ("ImageSubsystemMinorVersion",          DWORD),
    816. 

  816.         ("ImageProcessAffinityMask",            QWORD),
    817. 

  817.         ("GdiHandleBuffer",                     DWORD * 60),
    818. 

  818.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    819. 

  819.         ("TlsExpansionBitmap",                  PVOID),
    820. 

  820.         ("TlsExpansionBitmapBits",              DWORD * 32),
    821. 

  821.         ("SessionId",                           DWORD),
    822. 

  822.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    823. 

  823.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    824. 

  824.         ("pShimData",                           PVOID),
    825. 

  825.         ("AppCompatInfo",                       PVOID),
    826. 

  826.         ("CSDVersion",                          UNICODE_STRING),
    827. 

  827.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    828. 

  828.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    829. 

  829.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    830. 

  830.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    831. 

  831.         ("MinimumStackCommit",                  QWORD),
    832. 

  832.         ("FlsCallback",                         PVOID), # Ptr64 Ptr64 Void
    833. 

  833.         ("FlsListHead",                         LIST_ENTRY),
    834. 

  834.         ("FlsBitmap",                           PVOID),
    835. 

  835.         ("FlsBitmapBits",                       DWORD * 4),
    836. 

  836.         ("FlsHighIndex",                        DWORD),
    837. 

  837.     ]
    838. 

  838. 

  839. #    +0x000 InheritedAddressSpace : UChar
    840. 

  840. #    +0x001 ReadImageFileExecOptions : UChar
    841. 

  841. #    +0x002 BeingDebugged    : UChar
    842. 

  842. #    +0x003 BitField         : UChar
    843. 

  843. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    844. 

  844. #    +0x003 SpareBits        : Pos 1, 7 Bits
    845. 

  845. #    +0x004 Mutant           : Ptr32 Void
    846. 

  846. #    +0x008 ImageBaseAddress : Ptr32 Void
    847. 

  847. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    848. 

  848. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    849. 

  849. #    +0x014 SubSystemData    : Ptr32 Void
    850. 

  850. #    +0x018 ProcessHeap      : Ptr32 Void
    851. 

  851. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    852. 

  852. #    +0x020 AtlThunkSListPtr : Ptr32 Void
    853. 

  853. #    +0x024 SparePtr2        : Ptr32 Void
    854. 

  854. #    +0x028 EnvironmentUpdateCount : Uint4B
    855. 

  855. #    +0x02c KernelCallbackTable : Ptr32 Void
    856. 

  856. #    +0x030 SystemReserved   : [1] Uint4B
    857. 

  857. #    +0x034 SpareUlong       : Uint4B
    858. 

  858. #    +0x038 FreeList         : Ptr32 _PEB_FREE_BLOCK
    859. 

  859. #    +0x03c TlsExpansionCounter : Uint4B
    860. 

  860. #    +0x040 TlsBitmap        : Ptr32 Void
    861. 

  861. #    +0x044 TlsBitmapBits    : [2] Uint4B
    862. 

  862. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    863. 

  863. #    +0x050 ReadOnlySharedMemoryHeap : Ptr32 Void
    864. 

  864. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    865. 

  865. #    +0x058 AnsiCodePageData : Ptr32 Void
    866. 

  866. #    +0x05c OemCodePageData  : Ptr32 Void
    867. 

  867. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    868. 

  868. #    +0x064 NumberOfProcessors : Uint4B
    869. 

  869. #    +0x068 NtGlobalFlag     : Uint4B
    870. 

  870. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    871. 

  871. #    +0x078 HeapSegmentReserve : Uint4B
    872. 

  872. #    +0x07c HeapSegmentCommit : Uint4B
    873. 

  873. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    874. 

  874. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    875. 

  875. #    +0x088 NumberOfHeaps    : Uint4B
    876. 

  876. #    +0x08c MaximumNumberOfHeaps : Uint4B
    877. 

  877. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    878. 

  878. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    879. 

  879. #    +0x098 ProcessStarterHelper : Ptr32 Void
    880. 

  880. #    +0x09c GdiDCAttributeList : Uint4B
    881. 

  881. #    +0x0a0 LoaderLock       : Ptr32 _RTL_CRITICAL_SECTION
    882. 

  882. #    +0x0a4 OSMajorVersion   : Uint4B
    883. 

  883. #    +0x0a8 OSMinorVersion   : Uint4B
    884. 

  884. #    +0x0ac OSBuildNumber    : Uint2B
    885. 

  885. #    +0x0ae OSCSDVersion     : Uint2B
    886. 

  886. #    +0x0b0 OSPlatformId     : Uint4B
    887. 

  887. #    +0x0b4 ImageSubsystem   : Uint4B
    888. 

  888. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    889. 

  889. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    890. 

  890. #    +0x0c0 ImageProcessAffinityMask : Uint4B
    891. 

  891. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    892. 

  892. #    +0x14c PostProcessInitRoutine : Ptr32     void
    893. 

  893. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    894. 

  894. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    895. 

  895. #    +0x1d4 SessionId        : Uint4B
    896. 

  896. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    897. 

  897. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    898. 

  898. #    +0x1e8 pShimData        : Ptr32 Void
    899. 

  899. #    +0x1ec AppCompatInfo    : Ptr32 Void
    900. 

  900. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    901. 

  901. #    +0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    902. 

  902. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    903. 

  903. #    +0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    904. 

  904. #    +0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    905. 

  905. #    +0x208 MinimumStackCommit : Uint4B
    906. 

  906. #    +0x20c FlsCallback      : Ptr32 Ptr32 Void
    907. 

  907. #    +0x210 FlsListHead      : _LIST_ENTRY
    908. 

  908. #    +0x218 FlsBitmap        : Ptr32 Void
    909. 

  909. #    +0x21c FlsBitmapBits    : [4] Uint4B
    910. 

  910. #    +0x22c FlsHighIndex     : Uint4B
    911. 

  911. class _PEB_2003(Structure):
    912. 

  912.     _pack_   = 8
    913. 

  913.     _fields_ = [
    914. 

  914.         ("InheritedAddressSpace",               BOOLEAN),
    915. 

  915.         ("ReadImageFileExecOptions",            UCHAR),
    916. 

  916.         ("BeingDebugged",                       BOOLEAN),
    917. 

  917.         ("BitField",                            UCHAR),
    918. 

  918.         ("Mutant",                              HANDLE),
    919. 

  919.         ("ImageBaseAddress",                    PVOID),
    920. 

  920.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    921. 

  921.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    922. 

  922.         ("SubSystemData",                       PVOID),
    923. 

  923.         ("ProcessHeap",                         PVOID),
    924. 

  924.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    925. 

  925.         ("AtlThunkSListPtr",                    PVOID),
    926. 

  926.         ("SparePtr2",                           PVOID),
    927. 

  927.         ("EnvironmentUpdateCount",              DWORD),
    928. 

  928.         ("KernelCallbackTable",                 PVOID),
    929. 

  929.         ("SystemReserved",                      DWORD),
    930. 

  930.         ("SpareUlong",                          DWORD),
    931. 

  931.         ("FreeList",                            PVOID), # PPEB_FREE_BLOCK
    932. 

  932.         ("TlsExpansionCounter",                 DWORD),
    933. 

  933.         ("TlsBitmap",                           PVOID),
    934. 

  934.         ("TlsBitmapBits",                       DWORD * 2),
    935. 

  935.         ("ReadOnlySharedMemoryBase",            PVOID),
    936. 

  936.         ("ReadOnlySharedMemoryHeap",            PVOID),
    937. 

  937.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    938. 

  938.         ("AnsiCodePageData",                    PVOID),
    939. 

  939.         ("OemCodePageData",                     PVOID),
    940. 

  940.         ("UnicodeCaseTableData",                PVOID),
    941. 

  941.         ("NumberOfProcessors",                  DWORD),
    942. 

  942.         ("NtGlobalFlag",                        DWORD),
    943. 

  943.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    944. 

  944.         ("HeapSegmentReserve",                  DWORD),
    945. 

  945.         ("HeapSegmentCommit",                   DWORD),
    946. 

  946.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    947. 

  947.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    948. 

  948.         ("NumberOfHeaps",                       DWORD),
    949. 

  949.         ("MaximumNumberOfHeaps",                DWORD),
    950. 

  950.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    951. 

  951.         ("GdiSharedHandleTable",                PVOID),
    952. 

  952.         ("ProcessStarterHelper",                PVOID),
    953. 

  953.         ("GdiDCAttributeList",                  DWORD),
    954. 

  954.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    955. 

  955.         ("OSMajorVersion",                      DWORD),
    956. 

  956.         ("OSMinorVersion",                      DWORD),
    957. 

  957.         ("OSBuildNumber",                       WORD),
    958. 

  958.         ("OSCSDVersion",                        WORD),
    959. 

  959.         ("OSPlatformId",                        DWORD),
    960. 

  960.         ("ImageSubsystem",                      DWORD),
    961. 

  961.         ("ImageSubsystemMajorVersion",          DWORD),
    962. 

  962.         ("ImageSubsystemMinorVersion",          DWORD),
    963. 

  963.         ("ImageProcessAffinityMask",            DWORD),
    964. 

  964.         ("GdiHandleBuffer",                     DWORD * 34),
    965. 

  965.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    966. 

  966.         ("TlsExpansionBitmap",                  PVOID),
    967. 

  967.         ("TlsExpansionBitmapBits",              DWORD * 32),
    968. 

  968.         ("SessionId",                           DWORD),
    969. 

  969.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    970. 

  970.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    971. 

  971.         ("pShimData",                           PVOID),
    972. 

  972.         ("AppCompatInfo",                       PVOID),
    973. 

  973.         ("CSDVersion",                          UNICODE_STRING),
    974. 

  974.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    975. 

  975.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    976. 

  976.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    977. 

  977.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    978. 

  978.         ("MinimumStackCommit",                  QWORD),
    979. 

  979.         ("FlsCallback",                         PVOID), # Ptr32 Ptr32 Void
    980. 

  980.         ("FlsListHead",                         LIST_ENTRY),
    981. 

  981.         ("FlsBitmap",                           PVOID),
    982. 

  982.         ("FlsBitmapBits",                       DWORD * 4),
    983. 

  983.         ("FlsHighIndex",                        DWORD),
    984. 

  984.     ]
    985. 

  985. 

  986. _PEB_2003_64    = _PEB_XP_64
    987. 

  987. _PEB_2003_R2    = _PEB_2003
    988. 

  988. _PEB_2003_R2_64 = _PEB_2003_64
    989. 

  989. 

  990. #    +0x000 InheritedAddressSpace : UChar
    991. 

  991. #    +0x001 ReadImageFileExecOptions : UChar
    992. 

  992. #    +0x002 BeingDebugged    : UChar
    993. 

  993. #    +0x003 BitField         : UChar
    994. 

  994. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    995. 

  995. #    +0x003 IsProtectedProcess : Pos 1, 1 Bit
    996. 

  996. #    +0x003 IsLegacyProcess  : Pos 2, 1 Bit
    997. 

  997. #    +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
    998. 

  998. #    +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
    999. 

  999. #    +0x003 SpareBits        : Pos 5, 3 Bits
    1000. 

  1000. #    +0x004 Mutant           : Ptr32 Void
    1001. 

  1001. #    +0x008 ImageBaseAddress : Ptr32 Void
    1002. 

  1002. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    1003. 

  1003. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    1004. 

  1004. #    +0x014 SubSystemData    : Ptr32 Void
    1005. 

  1005. #    +0x018 ProcessHeap      : Ptr32 Void
    1006. 

  1006. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    1007. 

  1007. #    +0x020 AtlThunkSListPtr : Ptr32 Void
    1008. 

  1008. #    +0x024 IFEOKey          : Ptr32 Void
    1009. 

  1009. #    +0x028 CrossProcessFlags : Uint4B
    1010. 

  1010. #    +0x028 ProcessInJob     : Pos 0, 1 Bit
    1011. 

  1011. #    +0x028 ProcessInitializing : Pos 1, 1 Bit
    1012. 

  1012. #    +0x028 ProcessUsingVEH  : Pos 2, 1 Bit
    1013. 

  1013. #    +0x028 ProcessUsingVCH  : Pos 3, 1 Bit
    1014. 

  1014. #    +0x028 ReservedBits0    : Pos 4, 28 Bits
    1015. 

  1015. #    +0x02c KernelCallbackTable : Ptr32 Void
    1016. 

  1016. #    +0x02c UserSharedInfoPtr : Ptr32 Void
    1017. 

  1017. #    +0x030 SystemReserved   : [1] Uint4B
    1018. 

  1018. #    +0x034 SpareUlong       : Uint4B
    1019. 

  1019. #    +0x038 SparePebPtr0     : Uint4B
    1020. 

  1020. #    +0x03c TlsExpansionCounter : Uint4B
    1021. 

  1021. #    +0x040 TlsBitmap        : Ptr32 Void
    1022. 

  1022. #    +0x044 TlsBitmapBits    : [2] Uint4B
    1023. 

  1023. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    1024. 

  1024. #    +0x050 HotpatchInformation : Ptr32 Void
    1025. 

  1025. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    1026. 

  1026. #    +0x058 AnsiCodePageData : Ptr32 Void
    1027. 

  1027. #    +0x05c OemCodePageData  : Ptr32 Void
    1028. 

  1028. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    1029. 

  1029. #    +0x064 NumberOfProcessors : Uint4B
    1030. 

  1030. #    +0x068 NtGlobalFlag     : Uint4B
    1031. 

  1031. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    1032. 

  1032. #    +0x078 HeapSegmentReserve : Uint4B
    1033. 

  1033. #    +0x07c HeapSegmentCommit : Uint4B
    1034. 

  1034. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    1035. 

  1035. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    1036. 

  1036. #    +0x088 NumberOfHeaps    : Uint4B
    1037. 

  1037. #    +0x08c MaximumNumberOfHeaps : Uint4B
    1038. 

  1038. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    1039. 

  1039. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    1040. 

  1040. #    +0x098 ProcessStarterHelper : Ptr32 Void
    1041. 

  1041. #    +0x09c GdiDCAttributeList : Uint4B
    1042. 

  1042. #    +0x0a0 LoaderLock       : Ptr32 _RTL_CRITICAL_SECTION
    1043. 

  1043. #    +0x0a4 OSMajorVersion   : Uint4B
    1044. 

  1044. #    +0x0a8 OSMinorVersion   : Uint4B
    1045. 

  1045. #    +0x0ac OSBuildNumber    : Uint2B
    1046. 

  1046. #    +0x0ae OSCSDVersion     : Uint2B
    1047. 

  1047. #    +0x0b0 OSPlatformId     : Uint4B
    1048. 

  1048. #    +0x0b4 ImageSubsystem   : Uint4B
    1049. 

  1049. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    1050. 

  1050. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    1051. 

  1051. #    +0x0c0 ActiveProcessAffinityMask : Uint4B
    1052. 

  1052. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    1053. 

  1053. #    +0x14c PostProcessInitRoutine : Ptr32     void
    1054. 

  1054. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    1055. 

  1055. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    1056. 

  1056. #    +0x1d4 SessionId        : Uint4B
    1057. 

  1057. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    1058. 

  1058. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    1059. 

  1059. #    +0x1e8 pShimData        : Ptr32 Void
    1060. 

  1060. #    +0x1ec AppCompatInfo    : Ptr32 Void
    1061. 

  1061. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    1062. 

  1062. #    +0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1063. 

  1063. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1064. 

  1064. #    +0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1065. 

  1065. #    +0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1066. 

  1066. #    +0x208 MinimumStackCommit : Uint4B
    1067. 

  1067. #    +0x20c FlsCallback      : Ptr32 _FLS_CALLBACK_INFO
    1068. 

  1068. #    +0x210 FlsListHead      : _LIST_ENTRY
    1069. 

  1069. #    +0x218 FlsBitmap        : Ptr32 Void
    1070. 

  1070. #    +0x21c FlsBitmapBits    : [4] Uint4B
    1071. 

  1071. #    +0x22c FlsHighIndex     : Uint4B
    1072. 

  1072. #    +0x230 WerRegistrationData : Ptr32 Void
    1073. 

  1073. #    +0x234 WerShipAssertPtr : Ptr32 Void
    1074. 

  1074. class _PEB_2008(Structure):
    1075. 

  1075.     _pack_   = 8
    1076. 

  1076.     _fields_ = [
    1077. 

  1077.         ("InheritedAddressSpace",               BOOLEAN),
    1078. 

  1078.         ("ReadImageFileExecOptions",            UCHAR),
    1079. 

  1079.         ("BeingDebugged",                       BOOLEAN),
    1080. 

  1080.         ("BitField",                            UCHAR),
    1081. 

  1081.         ("Mutant",                              HANDLE),
    1082. 

  1082.         ("ImageBaseAddress",                    PVOID),
    1083. 

  1083.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    1084. 

  1084.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    1085. 

  1085.         ("SubSystemData",                       PVOID),
    1086. 

  1086.         ("ProcessHeap",                         PVOID),
    1087. 

  1087.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    1088. 

  1088.         ("AtlThunkSListPtr",                    PVOID),
    1089. 

  1089.         ("IFEOKey",                             PVOID),
    1090. 

  1090.         ("CrossProcessFlags",                   DWORD),
    1091. 

  1091.         ("KernelCallbackTable",                 PVOID),
    1092. 

  1092.         ("SystemReserved",                      DWORD),
    1093. 

  1093.         ("SpareUlong",                          DWORD),
    1094. 

  1094.         ("SparePebPtr0",                        PVOID),
    1095. 

  1095.         ("TlsExpansionCounter",                 DWORD),
    1096. 

  1096.         ("TlsBitmap",                           PVOID),
    1097. 

  1097.         ("TlsBitmapBits",                       DWORD * 2),
    1098. 

  1098.         ("ReadOnlySharedMemoryBase",            PVOID),
    1099. 

  1099.         ("HotpatchInformation",                 PVOID),
    1100. 

  1100.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    1101. 

  1101.         ("AnsiCodePageData",                    PVOID),
    1102. 

  1102.         ("OemCodePageData",                     PVOID),
    1103. 

  1103.         ("UnicodeCaseTableData",                PVOID),
    1104. 

  1104.         ("NumberOfProcessors",                  DWORD),
    1105. 

  1105.         ("NtGlobalFlag",                        DWORD),
    1106. 

  1106.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    1107. 

  1107.         ("HeapSegmentReserve",                  DWORD),
    1108. 

  1108.         ("HeapSegmentCommit",                   DWORD),
    1109. 

  1109.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    1110. 

  1110.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    1111. 

  1111.         ("NumberOfHeaps",                       DWORD),
    1112. 

  1112.         ("MaximumNumberOfHeaps",                DWORD),
    1113. 

  1113.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    1114. 

  1114.         ("GdiSharedHandleTable",                PVOID),
    1115. 

  1115.         ("ProcessStarterHelper",                PVOID),
    1116. 

  1116.         ("GdiDCAttributeList",                  DWORD),
    1117. 

  1117.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    1118. 

  1118.         ("OSMajorVersion",                      DWORD),
    1119. 

  1119.         ("OSMinorVersion",                      DWORD),
    1120. 

  1120.         ("OSBuildNumber",                       WORD),
    1121. 

  1121.         ("OSCSDVersion",                        WORD),
    1122. 

  1122.         ("OSPlatformId",                        DWORD),
    1123. 

  1123.         ("ImageSubsystem",                      DWORD),
    1124. 

  1124.         ("ImageSubsystemMajorVersion",          DWORD),
    1125. 

  1125.         ("ImageSubsystemMinorVersion",          DWORD),
    1126. 

  1126.         ("ActiveProcessAffinityMask",           DWORD),
    1127. 

  1127.         ("GdiHandleBuffer",                     DWORD * 34),
    1128. 

  1128.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    1129. 

  1129.         ("TlsExpansionBitmap",                  PVOID),
    1130. 

  1130.         ("TlsExpansionBitmapBits",              DWORD * 32),
    1131. 

  1131.         ("SessionId",                           DWORD),
    1132. 

  1132.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    1133. 

  1133.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    1134. 

  1134.         ("pShimData",                           PVOID),
    1135. 

  1135.         ("AppCompatInfo",                       PVOID),
    1136. 

  1136.         ("CSDVersion",                          UNICODE_STRING),
    1137. 

  1137.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    1138. 

  1138.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    1139. 

  1139.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    1140. 

  1140.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    1141. 

  1141.         ("MinimumStackCommit",                  DWORD),
    1142. 

  1142.         ("FlsCallback",                         PVOID), # PFLS_CALLBACK_INFO
    1143. 

  1143.         ("FlsListHead",                         LIST_ENTRY),
    1144. 

  1144.         ("FlsBitmap",                           PVOID),
    1145. 

  1145.         ("FlsBitmapBits",                       DWORD * 4),
    1146. 

  1146.         ("FlsHighIndex",                        DWORD),
    1147. 

  1147.         ("WerRegistrationData",                 PVOID),
    1148. 

  1148.         ("WerShipAssertPtr",                    PVOID),
    1149. 

  1149.     ]
    1150. 

  1150.     def __get_UserSharedInfoPtr(self):
    1151. 

  1151.         return self.KernelCallbackTable
    1152. 

  1152.     def __set_UserSharedInfoPtr(self, value):
    1153. 

  1153.         self.KernelCallbackTable = value
    1154. 

  1154.     UserSharedInfoPtr = property(__get_UserSharedInfoPtr, __set_UserSharedInfoPtr)
    1155. 

  1155. 

  1156. #    +0x000 InheritedAddressSpace : UChar
    1157. 

  1157. #    +0x001 ReadImageFileExecOptions : UChar
    1158. 

  1158. #    +0x002 BeingDebugged    : UChar
    1159. 

  1159. #    +0x003 BitField         : UChar
    1160. 

  1160. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    1161. 

  1161. #    +0x003 IsProtectedProcess : Pos 1, 1 Bit
    1162. 

  1162. #    +0x003 IsLegacyProcess  : Pos 2, 1 Bit
    1163. 

  1163. #    +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
    1164. 

  1164. #    +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
    1165. 

  1165. #    +0x003 SpareBits        : Pos 5, 3 Bits
    1166. 

  1166. #    +0x008 Mutant           : Ptr64 Void
    1167. 

  1167. #    +0x010 ImageBaseAddress : Ptr64 Void
    1168. 

  1168. #    +0x018 Ldr              : Ptr64 _PEB_LDR_DATA
    1169. 

  1169. #    +0x020 ProcessParameters : Ptr64 _RTL_USER_PROCESS_PARAMETERS
    1170. 

  1170. #    +0x028 SubSystemData    : Ptr64 Void
    1171. 

  1171. #    +0x030 ProcessHeap      : Ptr64 Void
    1172. 

  1172. #    +0x038 FastPebLock      : Ptr64 _RTL_CRITICAL_SECTION
    1173. 

  1173. #    +0x040 AtlThunkSListPtr : Ptr64 Void
    1174. 

  1174. #    +0x048 IFEOKey          : Ptr64 Void
    1175. 

  1175. #    +0x050 CrossProcessFlags : Uint4B
    1176. 

  1176. #    +0x050 ProcessInJob     : Pos 0, 1 Bit
    1177. 

  1177. #    +0x050 ProcessInitializing : Pos 1, 1 Bit
    1178. 

  1178. #    +0x050 ProcessUsingVEH  : Pos 2, 1 Bit
    1179. 

  1179. #    +0x050 ProcessUsingVCH  : Pos 3, 1 Bit
    1180. 

  1180. #    +0x050 ReservedBits0    : Pos 4, 28 Bits
    1181. 

  1181. #    +0x058 KernelCallbackTable : Ptr64 Void
    1182. 

  1182. #    +0x058 UserSharedInfoPtr : Ptr64 Void
    1183. 

  1183. #    +0x060 SystemReserved   : [1] Uint4B
    1184. 

  1184. #    +0x064 SpareUlong       : Uint4B
    1185. 

  1185. #    +0x068 SparePebPtr0     : Uint8B
    1186. 

  1186. #    +0x070 TlsExpansionCounter : Uint4B
    1187. 

  1187. #    +0x078 TlsBitmap        : Ptr64 Void
    1188. 

  1188. #    +0x080 TlsBitmapBits    : [2] Uint4B
    1189. 

  1189. #    +0x088 ReadOnlySharedMemoryBase : Ptr64 Void
    1190. 

  1190. #    +0x090 HotpatchInformation : Ptr64 Void
    1191. 

  1191. #    +0x098 ReadOnlyStaticServerData : Ptr64 Ptr64 Void
    1192. 

  1192. #    +0x0a0 AnsiCodePageData : Ptr64 Void
    1193. 

  1193. #    +0x0a8 OemCodePageData  : Ptr64 Void
    1194. 

  1194. #    +0x0b0 UnicodeCaseTableData : Ptr64 Void
    1195. 

  1195. #    +0x0b8 NumberOfProcessors : Uint4B
    1196. 

  1196. #    +0x0bc NtGlobalFlag     : Uint4B
    1197. 

  1197. #    +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER
    1198. 

  1198. #    +0x0c8 HeapSegmentReserve : Uint8B
    1199. 

  1199. #    +0x0d0 HeapSegmentCommit : Uint8B
    1200. 

  1200. #    +0x0d8 HeapDeCommitTotalFreeThreshold : Uint8B
    1201. 

  1201. #    +0x0e0 HeapDeCommitFreeBlockThreshold : Uint8B
    1202. 

  1202. #    +0x0e8 NumberOfHeaps    : Uint4B
    1203. 

  1203. #    +0x0ec MaximumNumberOfHeaps : Uint4B
    1204. 

  1204. #    +0x0f0 ProcessHeaps     : Ptr64 Ptr64 Void
    1205. 

  1205. #    +0x0f8 GdiSharedHandleTable : Ptr64 Void
    1206. 

  1206. #    +0x100 ProcessStarterHelper : Ptr64 Void
    1207. 

  1207. #    +0x108 GdiDCAttributeList : Uint4B
    1208. 

  1208. #    +0x110 LoaderLock       : Ptr64 _RTL_CRITICAL_SECTION
    1209. 

  1209. #    +0x118 OSMajorVersion   : Uint4B
    1210. 

  1210. #    +0x11c OSMinorVersion   : Uint4B
    1211. 

  1211. #    +0x120 OSBuildNumber    : Uint2B
    1212. 

  1212. #    +0x122 OSCSDVersion     : Uint2B
    1213. 

  1213. #    +0x124 OSPlatformId     : Uint4B
    1214. 

  1214. #    +0x128 ImageSubsystem   : Uint4B
    1215. 

  1215. #    +0x12c ImageSubsystemMajorVersion : Uint4B
    1216. 

  1216. #    +0x130 ImageSubsystemMinorVersion : Uint4B
    1217. 

  1217. #    +0x138 ActiveProcessAffinityMask : Uint8B
    1218. 

  1218. #    +0x140 GdiHandleBuffer  : [60] Uint4B
    1219. 

  1219. #    +0x230 PostProcessInitRoutine : Ptr64     void
    1220. 

  1220. #    +0x238 TlsExpansionBitmap : Ptr64 Void
    1221. 

  1221. #    +0x240 TlsExpansionBitmapBits : [32] Uint4B
    1222. 

  1222. #    +0x2c0 SessionId        : Uint4B
    1223. 

  1223. #    +0x2c8 AppCompatFlags   : _ULARGE_INTEGER
    1224. 

  1224. #    +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER
    1225. 

  1225. #    +0x2d8 pShimData        : Ptr64 Void
    1226. 

  1226. #    +0x2e0 AppCompatInfo    : Ptr64 Void
    1227. 

  1227. #    +0x2e8 CSDVersion       : _UNICODE_STRING
    1228. 

  1228. #    +0x2f8 ActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    1229. 

  1229. #    +0x300 ProcessAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    1230. 

  1230. #    +0x308 SystemDefaultActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    1231. 

  1231. #    +0x310 SystemAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    1232. 

  1232. #    +0x318 MinimumStackCommit : Uint8B
    1233. 

  1233. #    +0x320 FlsCallback      : Ptr64 _FLS_CALLBACK_INFO
    1234. 

  1234. #    +0x328 FlsListHead      : _LIST_ENTRY
    1235. 

  1235. #    +0x338 FlsBitmap        : Ptr64 Void
    1236. 

  1236. #    +0x340 FlsBitmapBits    : [4] Uint4B
    1237. 

  1237. #    +0x350 FlsHighIndex     : Uint4B
    1238. 

  1238. #    +0x358 WerRegistrationData : Ptr64 Void
    1239. 

  1239. #    +0x360 WerShipAssertPtr : Ptr64 Void
    1240. 

  1240. class _PEB_2008_64(Structure):
    1241. 

  1241.     _pack_   = 8
    1242. 

  1242.     _fields_ = [
    1243. 

  1243.         ("InheritedAddressSpace",               BOOLEAN),
    1244. 

  1244.         ("ReadImageFileExecOptions",            UCHAR),
    1245. 

  1245.         ("BeingDebugged",                       BOOLEAN),
    1246. 

  1246.         ("BitField",                            UCHAR),
    1247. 

  1247.         ("Mutant",                              HANDLE),
    1248. 

  1248.         ("ImageBaseAddress",                    PVOID),
    1249. 

  1249.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    1250. 

  1250.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    1251. 

  1251.         ("SubSystemData",                       PVOID),
    1252. 

  1252.         ("ProcessHeap",                         PVOID),
    1253. 

  1253.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    1254. 

  1254.         ("AtlThunkSListPtr",                    PVOID),
    1255. 

  1255.         ("IFEOKey",                             PVOID),
    1256. 

  1256.         ("CrossProcessFlags",                   DWORD),
    1257. 

  1257.         ("KernelCallbackTable",                 PVOID),
    1258. 

  1258.         ("SystemReserved",                      DWORD),
    1259. 

  1259.         ("SpareUlong",                          DWORD),
    1260. 

  1260.         ("SparePebPtr0",                        PVOID),
    1261. 

  1261.         ("TlsExpansionCounter",                 DWORD),
    1262. 

  1262.         ("TlsBitmap",                           PVOID),
    1263. 

  1263.         ("TlsBitmapBits",                       DWORD * 2),
    1264. 

  1264.         ("ReadOnlySharedMemoryBase",            PVOID),
    1265. 

  1265.         ("HotpatchInformation",                 PVOID),
    1266. 

  1266.         ("ReadOnlyStaticServerData",            PVOID), # Ptr64 Ptr64 Void
    1267. 

  1267.         ("AnsiCodePageData",                    PVOID),
    1268. 

  1268.         ("OemCodePageData",                     PVOID),
    1269. 

  1269.         ("UnicodeCaseTableData",                PVOID),
    1270. 

  1270.         ("NumberOfProcessors",                  DWORD),
    1271. 

  1271.         ("NtGlobalFlag",                        DWORD),
    1272. 

  1272.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    1273. 

  1273.         ("HeapSegmentReserve",                  QWORD),
    1274. 

  1274.         ("HeapSegmentCommit",                   QWORD),
    1275. 

  1275.         ("HeapDeCommitTotalFreeThreshold",      QWORD),
    1276. 

  1276.         ("HeapDeCommitFreeBlockThreshold",      QWORD),
    1277. 

  1277.         ("NumberOfHeaps",                       DWORD),
    1278. 

  1278.         ("MaximumNumberOfHeaps",                DWORD),
    1279. 

  1279.         ("ProcessHeaps",                        PVOID), # Ptr64 Ptr64 Void
    1280. 

  1280.         ("GdiSharedHandleTable",                PVOID),
    1281. 

  1281.         ("ProcessStarterHelper",                PVOID),
    1282. 

  1282.         ("GdiDCAttributeList",                  DWORD),
    1283. 

  1283.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    1284. 

  1284.         ("OSMajorVersion",                      DWORD),
    1285. 

  1285.         ("OSMinorVersion",                      DWORD),
    1286. 

  1286.         ("OSBuildNumber",                       WORD),
    1287. 

  1287.         ("OSCSDVersion",                        WORD),
    1288. 

  1288.         ("OSPlatformId",                        DWORD),
    1289. 

  1289.         ("ImageSubsystem",                      DWORD),
    1290. 

  1290.         ("ImageSubsystemMajorVersion",          DWORD),
    1291. 

  1291.         ("ImageSubsystemMinorVersion",          DWORD),
    1292. 

  1292.         ("ActiveProcessAffinityMask",           QWORD),
    1293. 

  1293.         ("GdiHandleBuffer",                     DWORD * 60),
    1294. 

  1294.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    1295. 

  1295.         ("TlsExpansionBitmap",                  PVOID),
    1296. 

  1296.         ("TlsExpansionBitmapBits",              DWORD * 32),
    1297. 

  1297.         ("SessionId",                           DWORD),
    1298. 

  1298.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    1299. 

  1299.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    1300. 

  1300.         ("pShimData",                           PVOID),
    1301. 

  1301.         ("AppCompatInfo",                       PVOID),
    1302. 

  1302.         ("CSDVersion",                          UNICODE_STRING),
    1303. 

  1303.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    1304. 

  1304.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    1305. 

  1305.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    1306. 

  1306.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    1307. 

  1307.         ("MinimumStackCommit",                  QWORD),
    1308. 

  1308.         ("FlsCallback",                         PVOID), # PFLS_CALLBACK_INFO
    1309. 

  1309.         ("FlsListHead",                         LIST_ENTRY),
    1310. 

  1310.         ("FlsBitmap",                           PVOID),
    1311. 

  1311.         ("FlsBitmapBits",                       DWORD * 4),
    1312. 

  1312.         ("FlsHighIndex",                        DWORD),
    1313. 

  1313.         ("WerRegistrationData",                 PVOID),
    1314. 

  1314.         ("WerShipAssertPtr",                    PVOID),
    1315. 

  1315.     ]
    1316. 

  1316.     def __get_UserSharedInfoPtr(self):
    1317. 

  1317.         return self.KernelCallbackTable
    1318. 

  1318.     def __set_UserSharedInfoPtr(self, value):
    1319. 

  1319.         self.KernelCallbackTable = value
    1320. 

  1320.     UserSharedInfoPtr = property(__get_UserSharedInfoPtr, __set_UserSharedInfoPtr)
    1321. 

  1321. 

  1322. #    +0x000 InheritedAddressSpace : UChar
    1323. 

  1323. #    +0x001 ReadImageFileExecOptions : UChar
    1324. 

  1324. #    +0x002 BeingDebugged    : UChar
    1325. 

  1325. #    +0x003 BitField         : UChar
    1326. 

  1326. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    1327. 

  1327. #    +0x003 IsProtectedProcess : Pos 1, 1 Bit
    1328. 

  1328. #    +0x003 IsLegacyProcess  : Pos 2, 1 Bit
    1329. 

  1329. #    +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
    1330. 

  1330. #    +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
    1331. 

  1331. #    +0x003 SpareBits        : Pos 5, 3 Bits
    1332. 

  1332. #    +0x004 Mutant           : Ptr32 Void
    1333. 

  1333. #    +0x008 ImageBaseAddress : Ptr32 Void
    1334. 

  1334. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    1335. 

  1335. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    1336. 

  1336. #    +0x014 SubSystemData    : Ptr32 Void
    1337. 

  1337. #    +0x018 ProcessHeap      : Ptr32 Void
    1338. 

  1338. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    1339. 

  1339. #    +0x020 AtlThunkSListPtr : Ptr32 Void
    1340. 

  1340. #    +0x024 IFEOKey          : Ptr32 Void
    1341. 

  1341. #    +0x028 CrossProcessFlags : Uint4B
    1342. 

  1342. #    +0x028 ProcessInJob     : Pos 0, 1 Bit
    1343. 

  1343. #    +0x028 ProcessInitializing : Pos 1, 1 Bit
    1344. 

  1344. #    +0x028 ProcessUsingVEH  : Pos 2, 1 Bit
    1345. 

  1345. #    +0x028 ProcessUsingVCH  : Pos 3, 1 Bit
    1346. 

  1346. #    +0x028 ProcessUsingFTH  : Pos 4, 1 Bit
    1347. 

  1347. #    +0x028 ReservedBits0    : Pos 5, 27 Bits
    1348. 

  1348. #    +0x02c KernelCallbackTable : Ptr32 Void
    1349. 

  1349. #    +0x02c UserSharedInfoPtr : Ptr32 Void
    1350. 

  1350. #    +0x030 SystemReserved   : [1] Uint4B
    1351. 

  1351. #    +0x034 AtlThunkSListPtr32 : Uint4B
    1352. 

  1352. #    +0x038 ApiSetMap        : Ptr32 Void
    1353. 

  1353. #    +0x03c TlsExpansionCounter : Uint4B
    1354. 

  1354. #    +0x040 TlsBitmap        : Ptr32 Void
    1355. 

  1355. #    +0x044 TlsBitmapBits    : [2] Uint4B
    1356. 

  1356. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    1357. 

  1357. #    +0x050 HotpatchInformation : Ptr32 Void
    1358. 

  1358. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    1359. 

  1359. #    +0x058 AnsiCodePageData : Ptr32 Void
    1360. 

  1360. #    +0x05c OemCodePageData  : Ptr32 Void
    1361. 

  1361. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    1362. 

  1362. #    +0x064 NumberOfProcessors : Uint4B
    1363. 

  1363. #    +0x068 NtGlobalFlag     : Uint4B
    1364. 

  1364. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    1365. 

  1365. #    +0x078 HeapSegmentReserve : Uint4B
    1366. 

  1366. #    +0x07c HeapSegmentCommit : Uint4B
    1367. 

  1367. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    1368. 

  1368. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    1369. 

  1369. #    +0x088 NumberOfHeaps    : Uint4B
    1370. 

  1370. #    +0x08c MaximumNumberOfHeaps : Uint4B
    1371. 

  1371. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    1372. 

  1372. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    1373. 

  1373. #    +0x098 ProcessStarterHelper : Ptr32 Void
    1374. 

  1374. #    +0x09c GdiDCAttributeList : Uint4B
    1375. 

  1375. #    +0x0a0 LoaderLock       : Ptr32 _RTL_CRITICAL_SECTION
    1376. 

  1376. #    +0x0a4 OSMajorVersion   : Uint4B
    1377. 

  1377. #    +0x0a8 OSMinorVersion   : Uint4B
    1378. 

  1378. #    +0x0ac OSBuildNumber    : Uint2B
    1379. 

  1379. #    +0x0ae OSCSDVersion     : Uint2B
    1380. 

  1380. #    +0x0b0 OSPlatformId     : Uint4B
    1381. 

  1381. #    +0x0b4 ImageSubsystem   : Uint4B
    1382. 

  1382. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    1383. 

  1383. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    1384. 

  1384. #    +0x0c0 ActiveProcessAffinityMask : Uint4B
    1385. 

  1385. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    1386. 

  1386. #    +0x14c PostProcessInitRoutine : Ptr32     void
    1387. 

  1387. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    1388. 

  1388. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    1389. 

  1389. #    +0x1d4 SessionId        : Uint4B
    1390. 

  1390. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    1391. 

  1391. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    1392. 

  1392. #    +0x1e8 pShimData        : Ptr32 Void
    1393. 

  1393. #    +0x1ec AppCompatInfo    : Ptr32 Void
    1394. 

  1394. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    1395. 

  1395. #    +0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1396. 

  1396. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1397. 

  1397. #    +0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1398. 

  1398. #    +0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1399. 

  1399. #    +0x208 MinimumStackCommit : Uint4B
    1400. 

  1400. #    +0x20c FlsCallback      : Ptr32 _FLS_CALLBACK_INFO
    1401. 

  1401. #    +0x210 FlsListHead      : _LIST_ENTRY
    1402. 

  1402. #    +0x218 FlsBitmap        : Ptr32 Void
    1403. 

  1403. #    +0x21c FlsBitmapBits    : [4] Uint4B
    1404. 

  1404. #    +0x22c FlsHighIndex     : Uint4B
    1405. 

  1405. #    +0x230 WerRegistrationData : Ptr32 Void
    1406. 

  1406. #    +0x234 WerShipAssertPtr : Ptr32 Void
    1407. 

  1407. #    +0x238 pContextData     : Ptr32 Void
    1408. 

  1408. #    +0x23c pImageHeaderHash : Ptr32 Void
    1409. 

  1409. #    +0x240 TracingFlags     : Uint4B
    1410. 

  1410. #    +0x240 HeapTracingEnabled : Pos 0, 1 Bit
    1411. 

  1411. #    +0x240 CritSecTracingEnabled : Pos 1, 1 Bit
    1412. 

  1412. #    +0x240 SpareTracingBits : Pos 2, 30 Bits
    1413. 

  1413. class _PEB_2008_R2(Structure):
    1414. 

  1414.     _pack_   = 8
    1415. 

  1415.     _fields_ = [
    1416. 

  1416.         ("InheritedAddressSpace",               BOOLEAN),
    1417. 

  1417.         ("ReadImageFileExecOptions",            UCHAR),
    1418. 

  1418.         ("BeingDebugged",                       BOOLEAN),
    1419. 

  1419.         ("BitField",                            UCHAR),
    1420. 

  1420.         ("Mutant",                              HANDLE),
    1421. 

  1421.         ("ImageBaseAddress",                    PVOID),
    1422. 

  1422.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    1423. 

  1423.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    1424. 

  1424.         ("SubSystemData",                       PVOID),
    1425. 

  1425.         ("ProcessHeap",                         PVOID),
    1426. 

  1426.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    1427. 

  1427.         ("AtlThunkSListPtr",                    PVOID),
    1428. 

  1428.         ("IFEOKey",                             PVOID),
    1429. 

  1429.         ("CrossProcessFlags",                   DWORD),
    1430. 

  1430.         ("KernelCallbackTable",                 PVOID),
    1431. 

  1431.         ("SystemReserved",                      DWORD),
    1432. 

  1432.         ("AtlThunkSListPtr32",                  PVOID),
    1433. 

  1433.         ("ApiSetMap",                           PVOID),
    1434. 

  1434.         ("TlsExpansionCounter",                 DWORD),
    1435. 

  1435.         ("TlsBitmap",                           PVOID),
    1436. 

  1436.         ("TlsBitmapBits",                       DWORD * 2),
    1437. 

  1437.         ("ReadOnlySharedMemoryBase",            PVOID),
    1438. 

  1438.         ("HotpatchInformation",                 PVOID),
    1439. 

  1439.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    1440. 

  1440.         ("AnsiCodePageData",                    PVOID),
    1441. 

  1441.         ("OemCodePageData",                     PVOID),
    1442. 

  1442.         ("UnicodeCaseTableData",                PVOID),
    1443. 

  1443.         ("NumberOfProcessors",                  DWORD),
    1444. 

  1444.         ("NtGlobalFlag",                        DWORD),
    1445. 

  1445.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    1446. 

  1446.         ("HeapSegmentReserve",                  DWORD),
    1447. 

  1447.         ("HeapSegmentCommit",                   DWORD),
    1448. 

  1448.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    1449. 

  1449.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    1450. 

  1450.         ("NumberOfHeaps",                       DWORD),
    1451. 

  1451.         ("MaximumNumberOfHeaps",                DWORD),
    1452. 

  1452.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    1453. 

  1453.         ("GdiSharedHandleTable",                PVOID),
    1454. 

  1454.         ("ProcessStarterHelper",                PVOID),
    1455. 

  1455.         ("GdiDCAttributeList",                  DWORD),
    1456. 

  1456.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    1457. 

  1457.         ("OSMajorVersion",                      DWORD),
    1458. 

  1458.         ("OSMinorVersion",                      DWORD),
    1459. 

  1459.         ("OSBuildNumber",                       WORD),
    1460. 

  1460.         ("OSCSDVersion",                        WORD),
    1461. 

  1461.         ("OSPlatformId",                        DWORD),
    1462. 

  1462.         ("ImageSubsystem",                      DWORD),
    1463. 

  1463.         ("ImageSubsystemMajorVersion",          DWORD),
    1464. 

  1464.         ("ImageSubsystemMinorVersion",          DWORD),
    1465. 

  1465.         ("ActiveProcessAffinityMask",           DWORD),
    1466. 

  1466.         ("GdiHandleBuffer",                     DWORD * 34),
    1467. 

  1467.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    1468. 

  1468.         ("TlsExpansionBitmap",                  PVOID),
    1469. 

  1469.         ("TlsExpansionBitmapBits",              DWORD * 32),
    1470. 

  1470.         ("SessionId",                           DWORD),
    1471. 

  1471.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    1472. 

  1472.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    1473. 

  1473.         ("pShimData",                           PVOID),
    1474. 

  1474.         ("AppCompatInfo",                       PVOID),
    1475. 

  1475.         ("CSDVersion",                          UNICODE_STRING),
    1476. 

  1476.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    1477. 

  1477.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    1478. 

  1478.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    1479. 

  1479.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    1480. 

  1480.         ("MinimumStackCommit",                  DWORD),
    1481. 

  1481.         ("FlsCallback",                         PVOID), # PFLS_CALLBACK_INFO
    1482. 

  1482.         ("FlsListHead",                         LIST_ENTRY),
    1483. 

  1483.         ("FlsBitmap",                           PVOID),
    1484. 

  1484.         ("FlsBitmapBits",                       DWORD * 4),
    1485. 

  1485.         ("FlsHighIndex",                        DWORD),
    1486. 

  1486.         ("WerRegistrationData",                 PVOID),
    1487. 

  1487.         ("WerShipAssertPtr",                    PVOID),
    1488. 

  1488.         ("pContextData",                        PVOID),
    1489. 

  1489.         ("pImageHeaderHash",                    PVOID),
    1490. 

  1490.         ("TracingFlags",                        DWORD),
    1491. 

  1491.     ]
    1492. 

  1492.     def __get_UserSharedInfoPtr(self):
    1493. 

  1493.         return self.KernelCallbackTable
    1494. 

  1494.     def __set_UserSharedInfoPtr(self, value):
    1495. 

  1495.         self.KernelCallbackTable = value
    1496. 

  1496.     UserSharedInfoPtr = property(__get_UserSharedInfoPtr, __set_UserSharedInfoPtr)
    1497. 

  1497. 

  1498. #    +0x000 InheritedAddressSpace : UChar
    1499. 

  1499. #    +0x001 ReadImageFileExecOptions : UChar
    1500. 

  1500. #    +0x002 BeingDebugged    : UChar
    1501. 

  1501. #    +0x003 BitField         : UChar
    1502. 

  1502. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    1503. 

  1503. #    +0x003 IsProtectedProcess : Pos 1, 1 Bit
    1504. 

  1504. #    +0x003 IsLegacyProcess  : Pos 2, 1 Bit
    1505. 

  1505. #    +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
    1506. 

  1506. #    +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
    1507. 

  1507. #    +0x003 SpareBits        : Pos 5, 3 Bits
    1508. 

  1508. #    +0x008 Mutant           : Ptr64 Void
    1509. 

  1509. #    +0x010 ImageBaseAddress : Ptr64 Void
    1510. 

  1510. #    +0x018 Ldr              : Ptr64 _PEB_LDR_DATA
    1511. 

  1511. #    +0x020 ProcessParameters : Ptr64 _RTL_USER_PROCESS_PARAMETERS
    1512. 

  1512. #    +0x028 SubSystemData    : Ptr64 Void
    1513. 

  1513. #    +0x030 ProcessHeap      : Ptr64 Void
    1514. 

  1514. #    +0x038 FastPebLock      : Ptr64 _RTL_CRITICAL_SECTION
    1515. 

  1515. #    +0x040 AtlThunkSListPtr : Ptr64 Void
    1516. 

  1516. #    +0x048 IFEOKey          : Ptr64 Void
    1517. 

  1517. #    +0x050 CrossProcessFlags : Uint4B
    1518. 

  1518. #    +0x050 ProcessInJob     : Pos 0, 1 Bit
    1519. 

  1519. #    +0x050 ProcessInitializing : Pos 1, 1 Bit
    1520. 

  1520. #    +0x050 ProcessUsingVEH  : Pos 2, 1 Bit
    1521. 

  1521. #    +0x050 ProcessUsingVCH  : Pos 3, 1 Bit
    1522. 

  1522. #    +0x050 ProcessUsingFTH  : Pos 4, 1 Bit
    1523. 

  1523. #    +0x050 ReservedBits0    : Pos 5, 27 Bits
    1524. 

  1524. #    +0x058 KernelCallbackTable : Ptr64 Void
    1525. 

  1525. #    +0x058 UserSharedInfoPtr : Ptr64 Void
    1526. 

  1526. #    +0x060 SystemReserved   : [1] Uint4B
    1527. 

  1527. #    +0x064 AtlThunkSListPtr32 : Uint4B
    1528. 

  1528. #    +0x068 ApiSetMap        : Ptr64 Void
    1529. 

  1529. #    +0x070 TlsExpansionCounter : Uint4B
    1530. 

  1530. #    +0x078 TlsBitmap        : Ptr64 Void
    1531. 

  1531. #    +0x080 TlsBitmapBits    : [2] Uint4B
    1532. 

  1532. #    +0x088 ReadOnlySharedMemoryBase : Ptr64 Void
    1533. 

  1533. #    +0x090 HotpatchInformation : Ptr64 Void
    1534. 

  1534. #    +0x098 ReadOnlyStaticServerData : Ptr64 Ptr64 Void
    1535. 

  1535. #    +0x0a0 AnsiCodePageData : Ptr64 Void
    1536. 

  1536. #    +0x0a8 OemCodePageData  : Ptr64 Void
    1537. 

  1537. #    +0x0b0 UnicodeCaseTableData : Ptr64 Void
    1538. 

  1538. #    +0x0b8 NumberOfProcessors : Uint4B
    1539. 

  1539. #    +0x0bc NtGlobalFlag     : Uint4B
    1540. 

  1540. #    +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER
    1541. 

  1541. #    +0x0c8 HeapSegmentReserve : Uint8B
    1542. 

  1542. #    +0x0d0 HeapSegmentCommit : Uint8B
    1543. 

  1543. #    +0x0d8 HeapDeCommitTotalFreeThreshold : Uint8B
    1544. 

  1544. #    +0x0e0 HeapDeCommitFreeBlockThreshold : Uint8B
    1545. 

  1545. #    +0x0e8 NumberOfHeaps    : Uint4B
    1546. 

  1546. #    +0x0ec MaximumNumberOfHeaps : Uint4B
    1547. 

  1547. #    +0x0f0 ProcessHeaps     : Ptr64 Ptr64 Void
    1548. 

  1548. #    +0x0f8 GdiSharedHandleTable : Ptr64 Void
    1549. 

  1549. #    +0x100 ProcessStarterHelper : Ptr64 Void
    1550. 

  1550. #    +0x108 GdiDCAttributeList : Uint4B
    1551. 

  1551. #    +0x110 LoaderLock       : Ptr64 _RTL_CRITICAL_SECTION
    1552. 

  1552. #    +0x118 OSMajorVersion   : Uint4B
    1553. 

  1553. #    +0x11c OSMinorVersion   : Uint4B
    1554. 

  1554. #    +0x120 OSBuildNumber    : Uint2B
    1555. 

  1555. #    +0x122 OSCSDVersion     : Uint2B
    1556. 

  1556. #    +0x124 OSPlatformId     : Uint4B
    1557. 

  1557. #    +0x128 ImageSubsystem   : Uint4B
    1558. 

  1558. #    +0x12c ImageSubsystemMajorVersion : Uint4B
    1559. 

  1559. #    +0x130 ImageSubsystemMinorVersion : Uint4B
    1560. 

  1560. #    +0x138 ActiveProcessAffinityMask : Uint8B
    1561. 

  1561. #    +0x140 GdiHandleBuffer  : [60] Uint4B
    1562. 

  1562. #    +0x230 PostProcessInitRoutine : Ptr64     void
    1563. 

  1563. #    +0x238 TlsExpansionBitmap : Ptr64 Void
    1564. 

  1564. #    +0x240 TlsExpansionBitmapBits : [32] Uint4B
    1565. 

  1565. #    +0x2c0 SessionId        : Uint4B
    1566. 

  1566. #    +0x2c8 AppCompatFlags   : _ULARGE_INTEGER
    1567. 

  1567. #    +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER
    1568. 

  1568. #    +0x2d8 pShimData        : Ptr64 Void
    1569. 

  1569. #    +0x2e0 AppCompatInfo    : Ptr64 Void
    1570. 

  1570. #    +0x2e8 CSDVersion       : _UNICODE_STRING
    1571. 

  1571. #    +0x2f8 ActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    1572. 

  1572. #    +0x300 ProcessAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    1573. 

  1573. #    +0x308 SystemDefaultActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
    1574. 

  1574. #    +0x310 SystemAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
    1575. 

  1575. #    +0x318 MinimumStackCommit : Uint8B
    1576. 

  1576. #    +0x320 FlsCallback      : Ptr64 _FLS_CALLBACK_INFO
    1577. 

  1577. #    +0x328 FlsListHead      : _LIST_ENTRY
    1578. 

  1578. #    +0x338 FlsBitmap        : Ptr64 Void
    1579. 

  1579. #    +0x340 FlsBitmapBits    : [4] Uint4B
    1580. 

  1580. #    +0x350 FlsHighIndex     : Uint4B
    1581. 

  1581. #    +0x358 WerRegistrationData : Ptr64 Void
    1582. 

  1582. #    +0x360 WerShipAssertPtr : Ptr64 Void
    1583. 

  1583. #    +0x368 pContextData     : Ptr64 Void
    1584. 

  1584. #    +0x370 pImageHeaderHash : Ptr64 Void
    1585. 

  1585. #    +0x378 TracingFlags     : Uint4B
    1586. 

  1586. #    +0x378 HeapTracingEnabled : Pos 0, 1 Bit
    1587. 

  1587. #    +0x378 CritSecTracingEnabled : Pos 1, 1 Bit
    1588. 

  1588. #    +0x378 SpareTracingBits : Pos 2, 30 Bits
    1589. 

  1589. class _PEB_2008_R2_64(Structure):
    1590. 

  1590.     _pack_   = 8
    1591. 

  1591.     _fields_ = [
    1592. 

  1592.         ("InheritedAddressSpace",               BOOLEAN),
    1593. 

  1593.         ("ReadImageFileExecOptions",            UCHAR),
    1594. 

  1594.         ("BeingDebugged",                       BOOLEAN),
    1595. 

  1595.         ("BitField",                            UCHAR),
    1596. 

  1596.         ("Mutant",                              HANDLE),
    1597. 

  1597.         ("ImageBaseAddress",                    PVOID),
    1598. 

  1598.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    1599. 

  1599.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    1600. 

  1600.         ("SubSystemData",                       PVOID),
    1601. 

  1601.         ("ProcessHeap",                         PVOID),
    1602. 

  1602.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    1603. 

  1603.         ("AtlThunkSListPtr",                    PVOID),
    1604. 

  1604.         ("IFEOKey",                             PVOID),
    1605. 

  1605.         ("CrossProcessFlags",                   DWORD),
    1606. 

  1606.         ("KernelCallbackTable",                 PVOID),
    1607. 

  1607.         ("SystemReserved",                      DWORD),
    1608. 

  1608.         ("AtlThunkSListPtr32",                  DWORD),
    1609. 

  1609.         ("ApiSetMap",                           PVOID),
    1610. 

  1610.         ("TlsExpansionCounter",                 DWORD),
    1611. 

  1611.         ("TlsBitmap",                           PVOID),
    1612. 

  1612.         ("TlsBitmapBits",                       DWORD * 2),
    1613. 

  1613.         ("ReadOnlySharedMemoryBase",            PVOID),
    1614. 

  1614.         ("HotpatchInformation",                 PVOID),
    1615. 

  1615.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    1616. 

  1616.         ("AnsiCodePageData",                    PVOID),
    1617. 

  1617.         ("OemCodePageData",                     PVOID),
    1618. 

  1618.         ("UnicodeCaseTableData",                PVOID),
    1619. 

  1619.         ("NumberOfProcessors",                  DWORD),
    1620. 

  1620.         ("NtGlobalFlag",                        DWORD),
    1621. 

  1621.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    1622. 

  1622.         ("HeapSegmentReserve",                  QWORD),
    1623. 

  1623.         ("HeapSegmentCommit",                   QWORD),
    1624. 

  1624.         ("HeapDeCommitTotalFreeThreshold",      QWORD),
    1625. 

  1625.         ("HeapDeCommitFreeBlockThreshold",      QWORD),
    1626. 

  1626.         ("NumberOfHeaps",                       DWORD),
    1627. 

  1627.         ("MaximumNumberOfHeaps",                DWORD),
    1628. 

  1628.         ("ProcessHeaps",                        PVOID), # Ptr64 Ptr64 Void
    1629. 

  1629.         ("GdiSharedHandleTable",                PVOID),
    1630. 

  1630.         ("ProcessStarterHelper",                PVOID),
    1631. 

  1631.         ("GdiDCAttributeList",                  DWORD),
    1632. 

  1632.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    1633. 

  1633.         ("OSMajorVersion",                      DWORD),
    1634. 

  1634.         ("OSMinorVersion",                      DWORD),
    1635. 

  1635.         ("OSBuildNumber",                       WORD),
    1636. 

  1636.         ("OSCSDVersion",                        WORD),
    1637. 

  1637.         ("OSPlatformId",                        DWORD),
    1638. 

  1638.         ("ImageSubsystem",                      DWORD),
    1639. 

  1639.         ("ImageSubsystemMajorVersion",          DWORD),
    1640. 

  1640.         ("ImageSubsystemMinorVersion",          DWORD),
    1641. 

  1641.         ("ActiveProcessAffinityMask",           QWORD),
    1642. 

  1642.         ("GdiHandleBuffer",                     DWORD * 60),
    1643. 

  1643.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    1644. 

  1644.         ("TlsExpansionBitmap",                  PVOID),
    1645. 

  1645.         ("TlsExpansionBitmapBits",              DWORD * 32),
    1646. 

  1646.         ("SessionId",                           DWORD),
    1647. 

  1647.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    1648. 

  1648.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    1649. 

  1649.         ("pShimData",                           PVOID),
    1650. 

  1650.         ("AppCompatInfo",                       PVOID),
    1651. 

  1651.         ("CSDVersion",                          UNICODE_STRING),
    1652. 

  1652.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    1653. 

  1653.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    1654. 

  1654.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    1655. 

  1655.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    1656. 

  1656.         ("MinimumStackCommit",                  QWORD),
    1657. 

  1657.         ("FlsCallback",                         PVOID), # PFLS_CALLBACK_INFO
    1658. 

  1658.         ("FlsListHead",                         LIST_ENTRY),
    1659. 

  1659.         ("FlsBitmap",                           PVOID),
    1660. 

  1660.         ("FlsBitmapBits",                       DWORD * 4),
    1661. 

  1661.         ("FlsHighIndex",                        DWORD),
    1662. 

  1662.         ("WerRegistrationData",                 PVOID),
    1663. 

  1663.         ("WerShipAssertPtr",                    PVOID),
    1664. 

  1664.         ("pContextData",                        PVOID),
    1665. 

  1665.         ("pImageHeaderHash",                    PVOID),
    1666. 

  1666.         ("TracingFlags",                        DWORD),
    1667. 

  1667.     ]
    1668. 

  1668.     def __get_UserSharedInfoPtr(self):
    1669. 

  1669.         return self.KernelCallbackTable
    1670. 

  1670.     def __set_UserSharedInfoPtr(self, value):
    1671. 

  1671.         self.KernelCallbackTable = value
    1672. 

  1672.     UserSharedInfoPtr = property(__get_UserSharedInfoPtr, __set_UserSharedInfoPtr)
    1673. 

  1673. 

  1674. _PEB_Vista      = _PEB_2008
    1675. 

  1675. _PEB_Vista_64   = _PEB_2008_64
    1676. 

  1676. _PEB_W7         = _PEB_2008_R2
    1677. 

  1677. _PEB_W7_64      = _PEB_2008_R2_64
    1678. 

  1678. 

  1679. #    +0x000 InheritedAddressSpace : UChar
    1680. 

  1680. #    +0x001 ReadImageFileExecOptions : UChar
    1681. 

  1681. #    +0x002 BeingDebugged    : UChar
    1682. 

  1682. #    +0x003 BitField         : UChar
    1683. 

  1683. #    +0x003 ImageUsesLargePages : Pos 0, 1 Bit
    1684. 

  1684. #    +0x003 IsProtectedProcess : Pos 1, 1 Bit
    1685. 

  1685. #    +0x003 IsLegacyProcess  : Pos 2, 1 Bit
    1686. 

  1686. #    +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
    1687. 

  1687. #    +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
    1688. 

  1688. #    +0x003 SpareBits        : Pos 5, 3 Bits
    1689. 

  1689. #    +0x004 Mutant           : Ptr32 Void
    1690. 

  1690. #    +0x008 ImageBaseAddress : Ptr32 Void
    1691. 

  1691. #    +0x00c Ldr              : Ptr32 _PEB_LDR_DATA
    1692. 

  1692. #    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
    1693. 

  1693. #    +0x014 SubSystemData    : Ptr32 Void
    1694. 

  1694. #    +0x018 ProcessHeap      : Ptr32 Void
    1695. 

  1695. #    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION
    1696. 

  1696. #    +0x020 AtlThunkSListPtr : Ptr32 Void
    1697. 

  1697. #    +0x024 IFEOKey          : Ptr32 Void
    1698. 

  1698. #    +0x028 CrossProcessFlags : Uint4B
    1699. 

  1699. #    +0x028 ProcessInJob     : Pos 0, 1 Bit
    1700. 

  1700. #    +0x028 ProcessInitializing : Pos 1, 1 Bit
    1701. 

  1701. #    +0x028 ProcessUsingVEH  : Pos 2, 1 Bit
    1702. 

  1702. #    +0x028 ProcessUsingVCH  : Pos 3, 1 Bit
    1703. 

  1703. #    +0x028 ProcessUsingFTH  : Pos 4, 1 Bit
    1704. 

  1704. #    +0x028 ReservedBits0    : Pos 5, 27 Bits
    1705. 

  1705. #    +0x02c KernelCallbackTable : Ptr32 Void
    1706. 

  1706. #    +0x02c UserSharedInfoPtr : Ptr32 Void
    1707. 

  1707. #    +0x030 SystemReserved   : [1] Uint4B
    1708. 

  1708. #    +0x034 TracingFlags     : Uint4B
    1709. 

  1709. #    +0x034 HeapTracingEnabled : Pos 0, 1 Bit
    1710. 

  1710. #    +0x034 CritSecTracingEnabled : Pos 1, 1 Bit
    1711. 

  1711. #    +0x034 SpareTracingBits : Pos 2, 30 Bits
    1712. 

  1712. #    +0x038 ApiSetMap        : Ptr32 Void
    1713. 

  1713. #    +0x03c TlsExpansionCounter : Uint4B
    1714. 

  1714. #    +0x040 TlsBitmap        : Ptr32 Void
    1715. 

  1715. #    +0x044 TlsBitmapBits    : [2] Uint4B
    1716. 

  1716. #    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void
    1717. 

  1717. #    +0x050 HotpatchInformation : Ptr32 Void
    1718. 

  1718. #    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
    1719. 

  1719. #    +0x058 AnsiCodePageData : Ptr32 Void
    1720. 

  1720. #    +0x05c OemCodePageData  : Ptr32 Void
    1721. 

  1721. #    +0x060 UnicodeCaseTableData : Ptr32 Void
    1722. 

  1722. #    +0x064 NumberOfProcessors : Uint4B
    1723. 

  1723. #    +0x068 NtGlobalFlag     : Uint4B
    1724. 

  1724. #    +0x070 CriticalSectionTimeout : _LARGE_INTEGER
    1725. 

  1725. #    +0x078 HeapSegmentReserve : Uint4B
    1726. 

  1726. #    +0x07c HeapSegmentCommit : Uint4B
    1727. 

  1727. #    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B
    1728. 

  1728. #    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B
    1729. 

  1729. #    +0x088 NumberOfHeaps    : Uint4B
    1730. 

  1730. #    +0x08c MaximumNumberOfHeaps : Uint4B
    1731. 

  1731. #    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void
    1732. 

  1732. #    +0x094 GdiSharedHandleTable : Ptr32 Void
    1733. 

  1733. #    +0x098 ProcessStarterHelper : Ptr32 Void
    1734. 

  1734. #    +0x09c GdiDCAttributeList : Uint4B
    1735. 

  1735. #    +0x0a0 LoaderLock       : Ptr32 _RTL_CRITICAL_SECTION
    1736. 

  1736. #    +0x0a4 OSMajorVersion   : Uint4B
    1737. 

  1737. #    +0x0a8 OSMinorVersion   : Uint4B
    1738. 

  1738. #    +0x0ac OSBuildNumber    : Uint2B
    1739. 

  1739. #    +0x0ae OSCSDVersion     : Uint2B
    1740. 

  1740. #    +0x0b0 OSPlatformId     : Uint4B
    1741. 

  1741. #    +0x0b4 ImageSubsystem   : Uint4B
    1742. 

  1742. #    +0x0b8 ImageSubsystemMajorVersion : Uint4B
    1743. 

  1743. #    +0x0bc ImageSubsystemMinorVersion : Uint4B
    1744. 

  1744. #    +0x0c0 ActiveProcessAffinityMask : Uint4B
    1745. 

  1745. #    +0x0c4 GdiHandleBuffer  : [34] Uint4B
    1746. 

  1746. #    +0x14c PostProcessInitRoutine : Ptr32     void
    1747. 

  1747. #    +0x150 TlsExpansionBitmap : Ptr32 Void
    1748. 

  1748. #    +0x154 TlsExpansionBitmapBits : [32] Uint4B
    1749. 

  1749. #    +0x1d4 SessionId        : Uint4B
    1750. 

  1750. #    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER
    1751. 

  1751. #    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
    1752. 

  1752. #    +0x1e8 pShimData        : Ptr32 Void
    1753. 

  1753. #    +0x1ec AppCompatInfo    : Ptr32 Void
    1754. 

  1754. #    +0x1f0 CSDVersion       : _UNICODE_STRING
    1755. 

  1755. #    +0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1756. 

  1756. #    +0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1757. 

  1757. #    +0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
    1758. 

  1758. #    +0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
    1759. 

  1759. #    +0x208 MinimumStackCommit : Uint4B
    1760. 

  1760. #    +0x20c FlsCallback      : Ptr32 _FLS_CALLBACK_INFO
    1761. 

  1761. #    +0x210 FlsListHead      : _LIST_ENTRY
    1762. 

  1762. #    +0x218 FlsBitmap        : Ptr32 Void
    1763. 

  1763. #    +0x21c FlsBitmapBits    : [4] Uint4B
    1764. 

  1764. #    +0x22c FlsHighIndex     : Uint4B
    1765. 

  1765. #    +0x230 WerRegistrationData : Ptr32 Void
    1766. 

  1766. #    +0x234 WerShipAssertPtr : Ptr32 Void
    1767. 

  1767. #    +0x238 pContextData     : Ptr32 Void
    1768. 

  1768. #    +0x23c pImageHeaderHash : Ptr32 Void
    1769. 

  1769. class _PEB_W7_Beta(Structure):
    1770. 

  1770.     """
    1771. 

  1771.     This definition of the PEB structure is only valid for the beta versions
    1772. 

  1772.     of Windows 7. For the final version of Windows 7 use L{_PEB_W7} instead.
    1773. 

  1773.     This structure is not chosen automatically.
    1774. 

  1774.     """
    1775. 

  1775.     _pack_   = 8
    1776. 

  1776.     _fields_ = [
    1777. 

  1777.         ("InheritedAddressSpace",               BOOLEAN),
    1778. 

  1778.         ("ReadImageFileExecOptions",            UCHAR),
    1779. 

  1779.         ("BeingDebugged",                       BOOLEAN),
    1780. 

  1780.         ("BitField",                            UCHAR),
    1781. 

  1781.         ("Mutant",                              HANDLE),
    1782. 

  1782.         ("ImageBaseAddress",                    PVOID),
    1783. 

  1783.         ("Ldr",                                 PVOID), # PPEB_LDR_DATA
    1784. 

  1784.         ("ProcessParameters",                   PVOID), # PRTL_USER_PROCESS_PARAMETERS
    1785. 

  1785.         ("SubSystemData",                       PVOID),
    1786. 

  1786.         ("ProcessHeap",                         PVOID),
    1787. 

  1787.         ("FastPebLock",                         PVOID), # PRTL_CRITICAL_SECTION
    1788. 

  1788.         ("AtlThunkSListPtr",                    PVOID),
    1789. 

  1789.         ("IFEOKey",                             PVOID),
    1790. 

  1790.         ("CrossProcessFlags",                   DWORD),
    1791. 

  1791.         ("KernelCallbackTable",                 PVOID),
    1792. 

  1792.         ("SystemReserved",                      DWORD),
    1793. 

  1793.         ("TracingFlags",                        DWORD),
    1794. 

  1794.         ("ApiSetMap",                           PVOID),
    1795. 

  1795.         ("TlsExpansionCounter",                 DWORD),
    1796. 

  1796.         ("TlsBitmap",                           PVOID),
    1797. 

  1797.         ("TlsBitmapBits",                       DWORD * 2),
    1798. 

  1798.         ("ReadOnlySharedMemoryBase",            PVOID),
    1799. 

  1799.         ("HotpatchInformation",                 PVOID),
    1800. 

  1800.         ("ReadOnlyStaticServerData",            PVOID), # Ptr32 Ptr32 Void
    1801. 

  1801.         ("AnsiCodePageData",                    PVOID),
    1802. 

  1802.         ("OemCodePageData",                     PVOID),
    1803. 

  1803.         ("UnicodeCaseTableData",                PVOID),
    1804. 

  1804.         ("NumberOfProcessors",                  DWORD),
    1805. 

  1805.         ("NtGlobalFlag",                        DWORD),
    1806. 

  1806.         ("CriticalSectionTimeout",              LONGLONG),  # LARGE_INTEGER
    1807. 

  1807.         ("HeapSegmentReserve",                  DWORD),
    1808. 

  1808.         ("HeapSegmentCommit",                   DWORD),
    1809. 

  1809.         ("HeapDeCommitTotalFreeThreshold",      DWORD),
    1810. 

  1810.         ("HeapDeCommitFreeBlockThreshold",      DWORD),
    1811. 

  1811.         ("NumberOfHeaps",                       DWORD),
    1812. 

  1812.         ("MaximumNumberOfHeaps",                DWORD),
    1813. 

  1813.         ("ProcessHeaps",                        PVOID), # Ptr32 Ptr32 Void
    1814. 

  1814.         ("GdiSharedHandleTable",                PVOID),
    1815. 

  1815.         ("ProcessStarterHelper",                PVOID),
    1816. 

  1816.         ("GdiDCAttributeList",                  DWORD),
    1817. 

  1817.         ("LoaderLock",                          PVOID), # PRTL_CRITICAL_SECTION
    1818. 

  1818.         ("OSMajorVersion",                      DWORD),
    1819. 

  1819.         ("OSMinorVersion",                      DWORD),
    1820. 

  1820.         ("OSBuildNumber",                       WORD),
    1821. 

  1821.         ("OSCSDVersion",                        WORD),
    1822. 

  1822.         ("OSPlatformId",                        DWORD),
    1823. 

  1823.         ("ImageSubsystem",                      DWORD),
    1824. 

  1824.         ("ImageSubsystemMajorVersion",          DWORD),
    1825. 

  1825.         ("ImageSubsystemMinorVersion",          DWORD),
    1826. 

  1826.         ("ActiveProcessAffinityMask",           DWORD),
    1827. 

  1827.         ("GdiHandleBuffer",                     DWORD * 34),
    1828. 

  1828.         ("PostProcessInitRoutine",              PPS_POST_PROCESS_INIT_ROUTINE),
    1829. 

  1829.         ("TlsExpansionBitmap",                  PVOID),
    1830. 

  1830.         ("TlsExpansionBitmapBits",              DWORD * 32),
    1831. 

  1831.         ("SessionId",                           DWORD),
    1832. 

  1832.         ("AppCompatFlags",                      ULONGLONG), # ULARGE_INTEGER
    1833. 

  1833.         ("AppCompatFlagsUser",                  ULONGLONG), # ULARGE_INTEGER
    1834. 

  1834.         ("pShimData",                           PVOID),
    1835. 

  1835.         ("AppCompatInfo",                       PVOID),
    1836. 

  1836.         ("CSDVersion",                          UNICODE_STRING),
    1837. 

  1837.         ("ActivationContextData",               PVOID), # ACTIVATION_CONTEXT_DATA
    1838. 

  1838.         ("ProcessAssemblyStorageMap",           PVOID), # ASSEMBLY_STORAGE_MAP
    1839. 

  1839.         ("SystemDefaultActivationContextData",  PVOID), # ACTIVATION_CONTEXT_DATA
    1840. 

  1840.         ("SystemAssemblyStorageMap",            PVOID), # ASSEMBLY_STORAGE_MAP
    1841. 

  1841.         ("MinimumStackCommit",                  DWORD),
    1842. 

  1842.         ("FlsCallback",                         PVOID), # PFLS_CALLBACK_INFO
    1843. 

  1843.         ("FlsListHead",                         LIST_ENTRY),
    1844. 

  1844.         ("FlsBitmap",                           PVOID),
    1845. 

  1845.         ("FlsBitmapBits",                       DWORD * 4),
    1846. 

  1846.         ("FlsHighIndex",                        DWORD),
    1847. 

  1847.         ("WerRegistrationData",                 PVOID),
    1848. 

  1848.         ("WerShipAssertPtr",                    PVOID),
    1849. 

  1849.         ("pContextData",                        PVOID),
    1850. 

  1850.         ("pImageHeaderHash",                    PVOID),
    1851. 

  1851.     ]
    1852. 

  1852.     def __get_UserSharedInfoPtr(self):
    1853. 

  1853.         return self.KernelCallbackTable
    1854. 

  1854.     def __set_UserSharedInfoPtr(self, value):
    1855. 

  1855.         self.KernelCallbackTable = value
    1856. 

  1856.     UserSharedInfoPtr = property(__get_UserSharedInfoPtr, __set_UserSharedInfoPtr)
    1857. 

  1857. 

  1858. # Use the correct PEB structure definition.
    1859. 

  1859. # Defaults to the latest Windows version.
    1860. 

  1860. class PEB(Structure):
    1861. 

  1861.     _pack_ = 8
    1862. 

  1862.     if os == 'Windows NT':
    1863. 

  1863.         _pack_   = _PEB_NT._pack_
    1864. 

  1864.         _fields_ = _PEB_NT._fields_
    1865. 

  1865.     elif os == 'Windows 2000':
    1866. 

  1866.         _pack_   = _PEB_2000._pack_
    1867. 

  1867.         _fields_ = _PEB_2000._fields_
    1868. 

  1868.     elif os == 'Windows XP':
    1869. 

  1869.         _fields_ = _PEB_XP._fields_
    1870. 

  1870.     elif os == 'Windows XP (64 bits)':
    1871. 

  1871.         _fields_ = _PEB_XP_64._fields_
    1872. 

  1872.     elif os == 'Windows 2003':
    1873. 

  1873.         _fields_ = _PEB_2003._fields_
    1874. 

  1874.     elif os == 'Windows 2003 (64 bits)':
    1875. 

  1875.         _fields_ = _PEB_2003_64._fields_
    1876. 

  1876.     elif os == 'Windows 2003 R2':
    1877. 

  1877.         _fields_ = _PEB_2003_R2._fields_
    1878. 

  1878.     elif os == 'Windows 2003 R2 (64 bits)':
    1879. 

  1879.         _fields_ = _PEB_2003_R2_64._fields_
    1880. 

  1880.     elif os == 'Windows 2008':
    1881. 

  1881.         _fields_ = _PEB_2008._fields_
    1882. 

  1882.     elif os == 'Windows 2008 (64 bits)':
    1883. 

  1883.         _fields_ = _PEB_2008_64._fields_
    1884. 

  1884.     elif os == 'Windows 2008 R2':
    1885. 

  1885.         _fields_ = _PEB_2008_R2._fields_
    1886. 

  1886.     elif os == 'Windows 2008 R2 (64 bits)':
    1887. 

  1887.         _fields_ = _PEB_2008_R2_64._fields_
    1888. 

  1888.     elif os == 'Windows Vista':
    1889. 

  1889.         _fields_ = _PEB_Vista._fields_
    1890. 

  1890.     elif os == 'Windows Vista (64 bits)':
    1891. 

  1891.         _fields_ = _PEB_Vista_64._fields_
    1892. 

  1892.     elif os == 'Windows 7':
    1893. 

  1893.         _fields_ = _PEB_W7._fields_
    1894. 

  1894.     elif os == 'Windows 7 (64 bits)':
    1895. 

  1895.         _fields_ = _PEB_W7_64._fields_
    1896. 

  1896.     elif sizeof(SIZE_T) == sizeof(DWORD):
    1897. 

  1897.         _fields_ = _PEB_W7._fields_
    1898. 

  1898.     else:
    1899. 

  1899.         _fields_ = _PEB_W7_64._fields_
    1900. 

  1900. PPEB = POINTER(PEB)
    1901. 

  1901. 

  1902. # PEB structure for WOW64 processes.
    1903. 

  1903. class PEB_32(Structure):
    1904. 

  1904.     _pack_ = 8
    1905. 

  1905.     if os == 'Windows NT':
    1906. 

  1906.         _pack_   = _PEB_NT._pack_
    1907. 

  1907.         _fields_ = _PEB_NT._fields_
    1908. 

  1908.     elif os == 'Windows 2000':
    1909. 

  1909.         _pack_   = _PEB_2000._pack_
    1910. 

  1910.         _fields_ = _PEB_2000._fields_
    1911. 

  1911.     elif os.startswith('Windows XP'):
    1912. 

  1912.         _fields_ = _PEB_XP._fields_
    1913. 

  1913.     elif os.startswith('Windows 2003 R2'):
    1914. 

  1914.         _fields_ = _PEB_2003_R2._fields_
    1915. 

  1915.     elif os.startswith('Windows 2003'):
    1916. 

  1916.         _fields_ = _PEB_2003._fields_
    1917. 

  1917.     elif os.startswith('Windows 2008 R2'):
    1918. 

  1918.         _fields_ = _PEB_2008_R2._fields_
    1919. 

  1919.     elif os.startswith('Windows 2008'):
    1920. 

  1920.         _fields_ = _PEB_2008._fields_
    1921. 

  1921.     elif os.startswith('Windows Vista'):
    1922. 

  1922.         _fields_ = _PEB_Vista._fields_
    1923. 

  1923.     else: #if os.startswith('Windows 7'):
    1924. 

  1924.         _fields_ = _PEB_W7._fields_
    1925. 

  1925. 

  1926. # from https://vmexplorer.svn.codeplex.com/svn/VMExplorer/src/Win32/Threads.cs
    1927. 

  1927. #
    1928. 

  1928. # [StructLayout (LayoutKind.Sequential, Size = 0x0C)]
    1929. 

  1929. # public struct Wx86ThreadState
    1930. 

  1930. # {
    1931. 

  1931. # 	public IntPtr  CallBx86Eip; // Ptr32 to Uint4B
    1932. 

  1932. # 	public IntPtr  DeallocationCpu; // Ptr32 to Void
    1933. 

  1933. # 	public Byte  UseKnownWx86Dll; // UChar
    1934. 

  1934. # 	public Byte  OleStubInvoked; // Char
    1935. 

  1935. # };
    1936. 

  1936. class Wx86ThreadState(Structure):
    1937. 

  1937.     _fields_ = [
    1938. 

  1938.         ("CallBx86Eip",             PVOID),
    1939. 

  1939.         ("DeallocationCpu",         PVOID),
    1940. 

  1940.         ("UseKnownWx86Dll",         UCHAR),
    1941. 

  1941.         ("OleStubInvoked",          CHAR),
    1942. 

  1942. ]
    1943. 

  1943. 

  1944. # ntdll!_RTL_ACTIVATION_CONTEXT_STACK_FRAME
    1945. 

  1945. #    +0x000 Previous         : Ptr64 _RTL_ACTIVATION_CONTEXT_STACK_FRAME
    1946. 

  1946. #    +0x008 ActivationContext : Ptr64 _ACTIVATION_CONTEXT
    1947. 

  1947. #    +0x010 Flags            : Uint4B
    1948. 

  1948. class RTL_ACTIVATION_CONTEXT_STACK_FRAME(Structure):
    1949. 

  1949.     _fields_ = [
    1950. 

  1950.         ("Previous",                    PVOID),
    1951. 

  1951.         ("ActivationContext",           PVOID),
    1952. 

  1952.         ("Flags",                       DWORD),
    1953. 

  1953. ]
    1954. 

  1954. 

  1955. # ntdll!_ACTIVATION_CONTEXT_STACK
    1956. 

  1956. #    +0x000 ActiveFrame      : Ptr64 _RTL_ACTIVATION_CONTEXT_STACK_FRAME
    1957. 

  1957. #    +0x008 FrameListCache   : _LIST_ENTRY
    1958. 

  1958. #    +0x018 Flags            : Uint4B
    1959. 

  1959. #    +0x01c NextCookieSequenceNumber : Uint4B
    1960. 

  1960. #    +0x020 StackId          : Uint4B
    1961. 

  1961. class ACTIVATION_CONTEXT_STACK(Structure):
    1962. 

  1962.     _fields_ = [
    1963. 

  1963.         ("ActiveFrame",                 PVOID),
    1964. 

  1964.         ("FrameListCache",              LIST_ENTRY),
    1965. 

  1965.         ("Flags",                       DWORD),
    1966. 

  1966.         ("NextCookieSequenceNumber",    DWORD),
    1967. 

  1967.         ("StackId",                     DWORD),
    1968. 

  1968. ]
    1969. 

  1969. 

  1970. # typedef struct _PROCESSOR_NUMBER {
    1971. 

  1971. #   WORD Group;
    1972. 

  1972. #   BYTE Number;
    1973. 

  1973. #   BYTE Reserved;
    1974. 

  1974. # }PROCESSOR_NUMBER, *PPROCESSOR_NUMBER;
    1975. 

  1975. class PROCESSOR_NUMBER(Structure):
    1976. 

  1976.     _fields_ = [
    1977. 

  1977.         ("Group",       WORD),
    1978. 

  1978.         ("Number",      BYTE),
    1979. 

  1979.         ("Reserved",    BYTE),
    1980. 

  1980. ]
    1981. 

  1981. 

  1982. # from http://www.nirsoft.net/kernel_struct/vista/NT_TIB.html
    1983. 

  1983. #
    1984. 

  1984. # typedef struct _NT_TIB
    1985. 

  1985. # {
    1986. 

  1986. #      PEXCEPTION_REGISTRATION_RECORD ExceptionList;
    1987. 

  1987. #      PVOID StackBase;
    1988. 

  1988. #      PVOID StackLimit;
    1989. 

  1989. #      PVOID SubSystemTib;
    1990. 

  1990. #      union
    1991. 

  1991. #      {
    1992. 

  1992. #           PVOID FiberData;
    1993. 

  1993. #           ULONG Version;
    1994. 

  1994. #      };
    1995. 

  1995. #      PVOID ArbitraryUserPointer;
    1996. 

  1996. #      PNT_TIB Self;
    1997. 

  1997. # } NT_TIB, *PNT_TIB;
    1998. 

  1998. class _NT_TIB_UNION(Union):
    1999. 

  1999.     _fields_ = [
    2000. 

  2000.         ("FiberData",   PVOID),
    2001. 

  2001.         ("Version",     ULONG),
    2002. 

  2002.     ]
    2003. 

  2003. class NT_TIB(Structure):
    2004. 

  2004.     _fields_ = [
    2005. 

  2005.         ("ExceptionList",           PVOID), # PEXCEPTION_REGISTRATION_RECORD
    2006. 

  2006.         ("StackBase",               PVOID),
    2007. 

  2007.         ("StackLimit",              PVOID),
    2008. 

  2008.         ("SubSystemTib",            PVOID),
    2009. 

  2009.         ("u",                       _NT_TIB_UNION),
    2010. 

  2010.         ("ArbitraryUserPointer",    PVOID),
    2011. 

  2011.         ("Self",                    PVOID), # PNTTIB
    2012. 

  2012.     ]
    2013. 

  2013. 

  2014.     def __get_FiberData(self):
    2015. 

  2015.         return self.u.FiberData
    2016. 

  2016.     def __set_FiberData(self, value):
    2017. 

  2017.         self.u.FiberData = value
    2018. 

  2018.     FiberData = property(__get_FiberData, __set_FiberData)
    2019. 

  2019. 

  2020.     def __get_Version(self):
    2021. 

  2021.         return self.u.Version
    2022. 

  2022.     def __set_Version(self, value):
    2023. 

  2023.         self.u.Version = value
    2024. 

  2024.     Version = property(__get_Version, __set_Version)
    2025. 

  2025. 

  2026. PNTTIB = POINTER(NT_TIB)
    2027. 

  2027. 

  2028. # From http://www.nirsoft.net/kernel_struct/vista/EXCEPTION_REGISTRATION_RECORD.html
    2029. 

  2029. #
    2030. 

  2030. # typedef struct _EXCEPTION_REGISTRATION_RECORD
    2031. 

  2031. # {
    2032. 

  2032. #      PEXCEPTION_REGISTRATION_RECORD Next;
    2033. 

  2033. #      PEXCEPTION_DISPOSITION Handler;
    2034. 

  2034. # } EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;
    2035. 

  2035. class EXCEPTION_REGISTRATION_RECORD(Structure):
    2036. 

  2036.     pass
    2037. 

  2037. 

  2038. EXCEPTION_DISPOSITION           = DWORD
    2039. 

  2039. ##PEXCEPTION_DISPOSITION          = POINTER(EXCEPTION_DISPOSITION)
    2040. 

  2040. ##PEXCEPTION_REGISTRATION_RECORD  = POINTER(EXCEPTION_REGISTRATION_RECORD)
    2041. 

  2041. PEXCEPTION_DISPOSITION          = PVOID
    2042. 

  2042. PEXCEPTION_REGISTRATION_RECORD  = PVOID
    2043. 

  2043. 

  2044. EXCEPTION_REGISTRATION_RECORD._fields_ = [
    2045. 

  2045.         ("Next",    PEXCEPTION_REGISTRATION_RECORD),
    2046. 

  2046.         ("Handler", PEXCEPTION_DISPOSITION),
    2047. 

  2047. ]
    2048. 

  2048. 

  2049. ##PPEB = POINTER(PEB)
    2050. 

  2050. PPEB = PVOID
    2051. 

  2051. 

  2052. # From http://www.nirsoft.net/kernel_struct/vista/GDI_TEB_BATCH.html
    2053. 

  2053. #
    2054. 

  2054. # typedef struct _GDI_TEB_BATCH
    2055. 

  2055. # {
    2056. 

  2056. #      ULONG Offset;
    2057. 

  2057. #      ULONG HDC;
    2058. 

  2058. #      ULONG Buffer[310];
    2059. 

  2059. # } GDI_TEB_BATCH, *PGDI_TEB_BATCH;
    2060. 

  2060. class GDI_TEB_BATCH(Structure):
    2061. 

  2061.     _fields_ = [
    2062. 

  2062.         ("Offset",  ULONG),
    2063. 

  2063.         ("HDC",     ULONG),
    2064. 

  2064.         ("Buffer",  ULONG * 310),
    2065. 

  2065. ]
    2066. 

  2066. 

  2067. # ntdll!_TEB_ACTIVE_FRAME_CONTEXT
    2068. 

  2068. #    +0x000 Flags            : Uint4B
    2069. 

  2069. #    +0x008 FrameName        : Ptr64 Char
    2070. 

  2070. class TEB_ACTIVE_FRAME_CONTEXT(Structure):
    2071. 

  2071.     _fields_ = [
    2072. 

  2072.         ("Flags",       DWORD),
    2073. 

  2073.         ("FrameName",   LPVOID),    # LPCHAR
    2074. 

  2074. ]
    2075. 

  2075. PTEB_ACTIVE_FRAME_CONTEXT = POINTER(TEB_ACTIVE_FRAME_CONTEXT)
    2076. 

  2076. 

  2077. # ntdll!_TEB_ACTIVE_FRAME
    2078. 

  2078. #    +0x000 Flags            : Uint4B
    2079. 

  2079. #    +0x008 Previous         : Ptr64 _TEB_ACTIVE_FRAME
    2080. 

  2080. #    +0x010 Context          : Ptr64 _TEB_ACTIVE_FRAME_CONTEXT
    2081. 

  2081. class TEB_ACTIVE_FRAME(Structure):
    2082. 

  2082.     _fields_ = [
    2083. 

  2083.         ("Flags",       DWORD),
    2084. 

  2084.         ("Previous",    LPVOID),    # PTEB_ACTIVE_FRAME
    2085. 

  2085.         ("Context",     LPVOID),    # PTEB_ACTIVE_FRAME_CONTEXT
    2086. 

  2086. ]
    2087. 

  2087. PTEB_ACTIVE_FRAME = POINTER(TEB_ACTIVE_FRAME)
    2088. 

  2088. 

  2089. # SameTebFlags
    2090. 

  2090. DbgSafeThunkCall        = 1 << 0
    2091. 

  2091. DbgInDebugPrint         = 1 << 1
    2092. 

  2092. DbgHasFiberData         = 1 << 2
    2093. 

  2093. DbgSkipThreadAttach     = 1 << 3
    2094. 

  2094. DbgWerInShipAssertCode  = 1 << 4
    2095. 

  2095. DbgRanProcessInit       = 1 << 5
    2096. 

  2096. DbgClonedThread         = 1 << 6
    2097. 

  2097. DbgSuppressDebugMsg     = 1 << 7
    2098. 

  2098. RtlDisableUserStackWalk = 1 << 8
    2099. 

  2099. RtlExceptionAttached    = 1 << 9
    2100. 

  2100. RtlInitialThread        = 1 << 10
    2101. 

  2101. 

  2102. # XXX This is quite wrong :P
    2103. 

  2103. class _TEB_NT(Structure):
    2104. 

  2104.     _pack_ = 4
    2105. 

  2105.     _fields_ = [
    2106. 

  2106.         ("NtTib",                           NT_TIB),
    2107. 

  2107.         ("EnvironmentPointer",              PVOID),
    2108. 

  2108.         ("ClientId",                        CLIENT_ID),
    2109. 

  2109.         ("ActiveRpcHandle",                 HANDLE),
    2110. 

  2110.         ("ThreadLocalStoragePointer",       PVOID),
    2111. 

  2111.         ("ProcessEnvironmentBlock",         PPEB),
    2112. 

  2112.         ("LastErrorValue",                  ULONG),
    2113. 

  2113.         ("CountOfOwnedCriticalSections",    ULONG),
    2114. 

  2114.         ("CsrClientThread",                 PVOID),
    2115. 

  2115.         ("Win32ThreadInfo",                 PVOID),
    2116. 

  2116.         ("User32Reserved",                  ULONG * 26),
    2117. 

  2117.         ("UserReserved",                    ULONG * 5),
    2118. 

  2118.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    2119. 

  2119.         ("CurrentLocale",                   ULONG),
    2120. 

  2120.         ("FpSoftwareStatusRegister",        ULONG),
    2121. 

  2121.         ("SystemReserved1",                 PVOID * 54),
    2122. 

  2122.         ("Spare1",                          PVOID),
    2123. 

  2123.         ("ExceptionCode",                   ULONG),
    2124. 

  2124.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    2125. 

  2125.         ("SpareBytes1",                     ULONG * 36),
    2126. 

  2126.         ("TxFsContext",                     ULONG),
    2127. 

  2127.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    2128. 

  2128.         ("RealClientId",                    CLIENT_ID),
    2129. 

  2129.         ("GdiCachedProcessHandle",          PVOID),
    2130. 

  2130.         ("GdiClientPID",                    ULONG),
    2131. 

  2131.         ("GdiClientTID",                    ULONG),
    2132. 

  2132.         ("GdiThreadLocalInfo",              PVOID),
    2133. 

  2133.         ("Win32ClientInfo",                 PVOID * 62),
    2134. 

  2134.         ("glDispatchTable",                 PVOID * 233),
    2135. 

  2135.         ("glReserved1",                     ULONG * 29),
    2136. 

  2136.         ("glReserved2",                     PVOID),
    2137. 

  2137.         ("glSectionInfo",                   PVOID),
    2138. 

  2138.         ("glSection",                       PVOID),
    2139. 

  2139.         ("glTable",                         PVOID),
    2140. 

  2140.         ("glCurrentRC",                     PVOID),
    2141. 

  2141.         ("glContext",                       PVOID),
    2142. 

  2142.         ("LastStatusValue",                 NTSTATUS),
    2143. 

  2143.         ("StaticUnicodeString",             UNICODE_STRING),
    2144. 

  2144.         ("StaticUnicodeBuffer",             WCHAR * 261),
    2145. 

  2145.         ("DeallocationStack",               PVOID),
    2146. 

  2146.         ("TlsSlots",                        PVOID * 64),
    2147. 

  2147.         ("TlsLinks",                        LIST_ENTRY),
    2148. 

  2148.         ("Vdm",                             PVOID),
    2149. 

  2149.         ("ReservedForNtRpc",                PVOID),
    2150. 

  2150.         ("DbgSsReserved",                   PVOID * 2),
    2151. 

  2151.         ("HardErrorDisabled",               ULONG),
    2152. 

  2152.         ("Instrumentation",                 PVOID * 9),
    2153. 

  2153.         ("ActivityId",                      GUID),
    2154. 

  2154.         ("SubProcessTag",                   PVOID),
    2155. 

  2155.         ("EtwLocalData",                    PVOID),
    2156. 

  2156.         ("EtwTraceData",                    PVOID),
    2157. 

  2157.         ("WinSockData",                     PVOID),
    2158. 

  2158.         ("GdiBatchCount",                   ULONG),
    2159. 

  2159.         ("SpareBool0",                      BOOLEAN),
    2160. 

  2160.         ("SpareBool1",                      BOOLEAN),
    2161. 

  2161.         ("SpareBool2",                      BOOLEAN),
    2162. 

  2162.         ("IdealProcessor",                  UCHAR),
    2163. 

  2163.         ("GuaranteedStackBytes",            ULONG),
    2164. 

  2164.         ("ReservedForPerf",                 PVOID),
    2165. 

  2165.         ("ReservedForOle",                  PVOID),
    2166. 

  2166.         ("WaitingOnLoaderLock",             ULONG),
    2167. 

  2167.         ("StackCommit",                     PVOID),
    2168. 

  2168.         ("StackCommitMax",                  PVOID),
    2169. 

  2169.         ("StackReserved",                   PVOID),
    2170. 

  2170. ]
    2171. 

  2171. 

  2172. # not really, but "dt _TEB" in w2k isn't working for me :(
    2173. 

  2173. _TEB_2000 = _TEB_NT
    2174. 

  2174. 

  2175. #    +0x000 NtTib            : _NT_TIB
    2176. 

  2176. #    +0x01c EnvironmentPointer : Ptr32 Void
    2177. 

  2177. #    +0x020 ClientId         : _CLIENT_ID
    2178. 

  2178. #    +0x028 ActiveRpcHandle  : Ptr32 Void
    2179. 

  2179. #    +0x02c ThreadLocalStoragePointer : Ptr32 Void
    2180. 

  2180. #    +0x030 ProcessEnvironmentBlock : Ptr32 _PEB
    2181. 

  2181. #    +0x034 LastErrorValue   : Uint4B
    2182. 

  2182. #    +0x038 CountOfOwnedCriticalSections : Uint4B
    2183. 

  2183. #    +0x03c CsrClientThread  : Ptr32 Void
    2184. 

  2184. #    +0x040 Win32ThreadInfo  : Ptr32 Void
    2185. 

  2185. #    +0x044 User32Reserved   : [26] Uint4B
    2186. 

  2186. #    +0x0ac UserReserved     : [5] Uint4B
    2187. 

  2187. #    +0x0c0 WOW32Reserved    : Ptr32 Void
    2188. 

  2188. #    +0x0c4 CurrentLocale    : Uint4B
    2189. 

  2189. #    +0x0c8 FpSoftwareStatusRegister : Uint4B
    2190. 

  2190. #    +0x0cc SystemReserved1  : [54] Ptr32 Void
    2191. 

  2191. #    +0x1a4 ExceptionCode    : Int4B
    2192. 

  2192. #    +0x1a8 ActivationContextStack : _ACTIVATION_CONTEXT_STACK
    2193. 

  2193. #    +0x1bc SpareBytes1      : [24] UChar
    2194. 

  2194. #    +0x1d4 GdiTebBatch      : _GDI_TEB_BATCH
    2195. 

  2195. #    +0x6b4 RealClientId     : _CLIENT_ID
    2196. 

  2196. #    +0x6bc GdiCachedProcessHandle : Ptr32 Void
    2197. 

  2197. #    +0x6c0 GdiClientPID     : Uint4B
    2198. 

  2198. #    +0x6c4 GdiClientTID     : Uint4B
    2199. 

  2199. #    +0x6c8 GdiThreadLocalInfo : Ptr32 Void
    2200. 

  2200. #    +0x6cc Win32ClientInfo  : [62] Uint4B
    2201. 

  2201. #    +0x7c4 glDispatchTable  : [233] Ptr32 Void
    2202. 

  2202. #    +0xb68 glReserved1      : [29] Uint4B
    2203. 

  2203. #    +0xbdc glReserved2      : Ptr32 Void
    2204. 

  2204. #    +0xbe0 glSectionInfo    : Ptr32 Void
    2205. 

  2205. #    +0xbe4 glSection        : Ptr32 Void
    2206. 

  2206. #    +0xbe8 glTable          : Ptr32 Void
    2207. 

  2207. #    +0xbec glCurrentRC      : Ptr32 Void
    2208. 

  2208. #    +0xbf0 glContext        : Ptr32 Void
    2209. 

  2209. #    +0xbf4 LastStatusValue  : Uint4B
    2210. 

  2210. #    +0xbf8 StaticUnicodeString : _UNICODE_STRING
    2211. 

  2211. #    +0xc00 StaticUnicodeBuffer : [261] Uint2B
    2212. 

  2212. #    +0xe0c DeallocationStack : Ptr32 Void
    2213. 

  2213. #    +0xe10 TlsSlots         : [64] Ptr32 Void
    2214. 

  2214. #    +0xf10 TlsLinks         : _LIST_ENTRY
    2215. 

  2215. #    +0xf18 Vdm              : Ptr32 Void
    2216. 

  2216. #    +0xf1c ReservedForNtRpc : Ptr32 Void
    2217. 

  2217. #    +0xf20 DbgSsReserved    : [2] Ptr32 Void
    2218. 

  2218. #    +0xf28 HardErrorsAreDisabled : Uint4B
    2219. 

  2219. #    +0xf2c Instrumentation  : [16] Ptr32 Void
    2220. 

  2220. #    +0xf6c WinSockData      : Ptr32 Void
    2221. 

  2221. #    +0xf70 GdiBatchCount    : Uint4B
    2222. 

  2222. #    +0xf74 InDbgPrint       : UChar
    2223. 

  2223. #    +0xf75 FreeStackOnTermination : UChar
    2224. 

  2224. #    +0xf76 HasFiberData     : UChar
    2225. 

  2225. #    +0xf77 IdealProcessor   : UChar
    2226. 

  2226. #    +0xf78 Spare3           : Uint4B
    2227. 

  2227. #    +0xf7c ReservedForPerf  : Ptr32 Void
    2228. 

  2228. #    +0xf80 ReservedForOle   : Ptr32 Void
    2229. 

  2229. #    +0xf84 WaitingOnLoaderLock : Uint4B
    2230. 

  2230. #    +0xf88 Wx86Thread       : _Wx86ThreadState
    2231. 

  2231. #    +0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void
    2232. 

  2232. #    +0xf98 ImpersonationLocale : Uint4B
    2233. 

  2233. #    +0xf9c IsImpersonating  : Uint4B
    2234. 

  2234. #    +0xfa0 NlsCache         : Ptr32 Void
    2235. 

  2235. #    +0xfa4 pShimData        : Ptr32 Void
    2236. 

  2236. #    +0xfa8 HeapVirtualAffinity : Uint4B
    2237. 

  2237. #    +0xfac CurrentTransactionHandle : Ptr32 Void
    2238. 

  2238. #    +0xfb0 ActiveFrame      : Ptr32 _TEB_ACTIVE_FRAME
    2239. 

  2239. #    +0xfb4 SafeThunkCall    : UChar
    2240. 

  2240. #    +0xfb5 BooleanSpare     : [3] UChar
    2241. 

  2241. class _TEB_XP(Structure):
    2242. 

  2242.     _pack_ = 8
    2243. 

  2243.     _fields_ = [
    2244. 

  2244.         ("NtTib",                           NT_TIB),
    2245. 

  2245.         ("EnvironmentPointer",              PVOID),
    2246. 

  2246.         ("ClientId",                        CLIENT_ID),
    2247. 

  2247.         ("ActiveRpcHandle",                 HANDLE),
    2248. 

  2248.         ("ThreadLocalStoragePointer",       PVOID),
    2249. 

  2249.         ("ProcessEnvironmentBlock",         PVOID), # PPEB
    2250. 

  2250.         ("LastErrorValue",                  DWORD),
    2251. 

  2251.         ("CountOfOwnedCriticalSections",    DWORD),
    2252. 

  2252.         ("CsrClientThread",                 PVOID),
    2253. 

  2253.         ("Win32ThreadInfo",                 PVOID),
    2254. 

  2254.         ("User32Reserved",                  DWORD * 26),
    2255. 

  2255.         ("UserReserved",                    DWORD * 5),
    2256. 

  2256.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    2257. 

  2257.         ("CurrentLocale",                   DWORD),
    2258. 

  2258.         ("FpSoftwareStatusRegister",        DWORD),
    2259. 

  2259.         ("SystemReserved1",                 PVOID * 54),
    2260. 

  2260.         ("ExceptionCode",                   SDWORD),
    2261. 

  2261.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    2262. 

  2262.         ("SpareBytes1",                     UCHAR * 24),
    2263. 

  2263.         ("TxFsContext",                     DWORD),
    2264. 

  2264.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    2265. 

  2265.         ("RealClientId",                    CLIENT_ID),
    2266. 

  2266.         ("GdiCachedProcessHandle",          HANDLE),
    2267. 

  2267.         ("GdiClientPID",                    DWORD),
    2268. 

  2268.         ("GdiClientTID",                    DWORD),
    2269. 

  2269.         ("GdiThreadLocalInfo",              PVOID),
    2270. 

  2270.         ("Win32ClientInfo",                 DWORD * 62),
    2271. 

  2271.         ("glDispatchTable",                 PVOID * 233),
    2272. 

  2272.         ("glReserved1",                     DWORD * 29),
    2273. 

  2273.         ("glReserved2",                     PVOID),
    2274. 

  2274.         ("glSectionInfo",                   PVOID),
    2275. 

  2275.         ("glSection",                       PVOID),
    2276. 

  2276.         ("glTable",                         PVOID),
    2277. 

  2277.         ("glCurrentRC",                     PVOID),
    2278. 

  2278.         ("glContext",                       PVOID),
    2279. 

  2279.         ("LastStatusValue",                 NTSTATUS),
    2280. 

  2280.         ("StaticUnicodeString",             UNICODE_STRING),
    2281. 

  2281.         ("StaticUnicodeBuffer",             WCHAR * 261),
    2282. 

  2282.         ("DeallocationStack",               PVOID),
    2283. 

  2283.         ("TlsSlots",                        PVOID * 64),
    2284. 

  2284.         ("TlsLinks",                        LIST_ENTRY),
    2285. 

  2285.         ("Vdm",                             PVOID),
    2286. 

  2286.         ("ReservedForNtRpc",                PVOID),
    2287. 

  2287.         ("DbgSsReserved",                   PVOID * 2),
    2288. 

  2288.         ("HardErrorsAreDisabled",           DWORD),
    2289. 

  2289.         ("Instrumentation",                 PVOID * 16),
    2290. 

  2290.         ("WinSockData",                     PVOID),
    2291. 

  2291.         ("GdiBatchCount",                   DWORD),
    2292. 

  2292.         ("InDbgPrint",                      BOOLEAN),
    2293. 

  2293.         ("FreeStackOnTermination",          BOOLEAN),
    2294. 

  2294.         ("HasFiberData",                    BOOLEAN),
    2295. 

  2295.         ("IdealProcessor",                  UCHAR),
    2296. 

  2296.         ("Spare3",                          DWORD),
    2297. 

  2297.         ("ReservedForPerf",                 PVOID),
    2298. 

  2298.         ("ReservedForOle",                  PVOID),
    2299. 

  2299.         ("WaitingOnLoaderLock",             DWORD),
    2300. 

  2300.         ("Wx86Thread",                      Wx86ThreadState),
    2301. 

  2301.         ("TlsExpansionSlots",               PVOID), # Ptr32 Ptr32 Void
    2302. 

  2302.         ("ImpersonationLocale",             DWORD),
    2303. 

  2303.         ("IsImpersonating",                 BOOL),
    2304. 

  2304.         ("NlsCache",                        PVOID),
    2305. 

  2305.         ("pShimData",                       PVOID),
    2306. 

  2306.         ("HeapVirtualAffinity",             DWORD),
    2307. 

  2307.         ("CurrentTransactionHandle",        HANDLE),
    2308. 

  2308.         ("ActiveFrame",                     PVOID), # PTEB_ACTIVE_FRAME
    2309. 

  2309.         ("SafeThunkCall",                   BOOLEAN),
    2310. 

  2310.         ("BooleanSpare",                    BOOLEAN * 3),
    2311. 

  2311. ]
    2312. 

  2312. 

  2313. #    +0x000 NtTib            : _NT_TIB
    2314. 

  2314. #    +0x038 EnvironmentPointer : Ptr64 Void
    2315. 

  2315. #    +0x040 ClientId         : _CLIENT_ID
    2316. 

  2316. #    +0x050 ActiveRpcHandle  : Ptr64 Void
    2317. 

  2317. #    +0x058 ThreadLocalStoragePointer : Ptr64 Void
    2318. 

  2318. #    +0x060 ProcessEnvironmentBlock : Ptr64 _PEB
    2319. 

  2319. #    +0x068 LastErrorValue   : Uint4B
    2320. 

  2320. #    +0x06c CountOfOwnedCriticalSections : Uint4B
    2321. 

  2321. #    +0x070 CsrClientThread  : Ptr64 Void
    2322. 

  2322. #    +0x078 Win32ThreadInfo  : Ptr64 Void
    2323. 

  2323. #    +0x080 User32Reserved   : [26] Uint4B
    2324. 

  2324. #    +0x0e8 UserReserved     : [5] Uint4B
    2325. 

  2325. #    +0x100 WOW32Reserved    : Ptr64 Void
    2326. 

  2326. #    +0x108 CurrentLocale    : Uint4B
    2327. 

  2327. #    +0x10c FpSoftwareStatusRegister : Uint4B
    2328. 

  2328. #    +0x110 SystemReserved1  : [54] Ptr64 Void
    2329. 

  2329. #    +0x2c0 ExceptionCode    : Int4B
    2330. 

  2330. #    +0x2c8 ActivationContextStackPointer : Ptr64 _ACTIVATION_CONTEXT_STACK
    2331. 

  2331. #    +0x2d0 SpareBytes1      : [28] UChar
    2332. 

  2332. #    +0x2f0 GdiTebBatch      : _GDI_TEB_BATCH
    2333. 

  2333. #    +0x7d8 RealClientId     : _CLIENT_ID
    2334. 

  2334. #    +0x7e8 GdiCachedProcessHandle : Ptr64 Void
    2335. 

  2335. #    +0x7f0 GdiClientPID     : Uint4B
    2336. 

  2336. #    +0x7f4 GdiClientTID     : Uint4B
    2337. 

  2337. #    +0x7f8 GdiThreadLocalInfo : Ptr64 Void
    2338. 

  2338. #    +0x800 Win32ClientInfo  : [62] Uint8B
    2339. 

  2339. #    +0x9f0 glDispatchTable  : [233] Ptr64 Void
    2340. 

  2340. #    +0x1138 glReserved1      : [29] Uint8B
    2341. 

  2341. #    +0x1220 glReserved2      : Ptr64 Void
    2342. 

  2342. #    +0x1228 glSectionInfo    : Ptr64 Void
    2343. 

  2343. #    +0x1230 glSection        : Ptr64 Void
    2344. 

  2344. #    +0x1238 glTable          : Ptr64 Void
    2345. 

  2345. #    +0x1240 glCurrentRC      : Ptr64 Void
    2346. 

  2346. #    +0x1248 glContext        : Ptr64 Void
    2347. 

  2347. #    +0x1250 LastStatusValue  : Uint4B
    2348. 

  2348. #    +0x1258 StaticUnicodeString : _UNICODE_STRING
    2349. 

  2349. #    +0x1268 StaticUnicodeBuffer : [261] Uint2B
    2350. 

  2350. #    +0x1478 DeallocationStack : Ptr64 Void
    2351. 

  2351. #    +0x1480 TlsSlots         : [64] Ptr64 Void
    2352. 

  2352. #    +0x1680 TlsLinks         : _LIST_ENTRY
    2353. 

  2353. #    +0x1690 Vdm              : Ptr64 Void
    2354. 

  2354. #    +0x1698 ReservedForNtRpc : Ptr64 Void
    2355. 

  2355. #    +0x16a0 DbgSsReserved    : [2] Ptr64 Void
    2356. 

  2356. #    +0x16b0 HardErrorMode    : Uint4B
    2357. 

  2357. #    +0x16b8 Instrumentation  : [14] Ptr64 Void
    2358. 

  2358. #    +0x1728 SubProcessTag    : Ptr64 Void
    2359. 

  2359. #    +0x1730 EtwTraceData     : Ptr64 Void
    2360. 

  2360. #    +0x1738 WinSockData      : Ptr64 Void
    2361. 

  2361. #    +0x1740 GdiBatchCount    : Uint4B
    2362. 

  2362. #    +0x1744 InDbgPrint       : UChar
    2363. 

  2363. #    +0x1745 FreeStackOnTermination : UChar
    2364. 

  2364. #    +0x1746 HasFiberData     : UChar
    2365. 

  2365. #    +0x1747 IdealProcessor   : UChar
    2366. 

  2366. #    +0x1748 GuaranteedStackBytes : Uint4B
    2367. 

  2367. #    +0x1750 ReservedForPerf  : Ptr64 Void
    2368. 

  2368. #    +0x1758 ReservedForOle   : Ptr64 Void
    2369. 

  2369. #    +0x1760 WaitingOnLoaderLock : Uint4B
    2370. 

  2370. #    +0x1768 SparePointer1    : Uint8B
    2371. 

  2371. #    +0x1770 SoftPatchPtr1    : Uint8B
    2372. 

  2372. #    +0x1778 SoftPatchPtr2    : Uint8B
    2373. 

  2373. #    +0x1780 TlsExpansionSlots : Ptr64 Ptr64 Void
    2374. 

  2374. #    +0x1788 DeallocationBStore : Ptr64 Void
    2375. 

  2375. #    +0x1790 BStoreLimit      : Ptr64 Void
    2376. 

  2376. #    +0x1798 ImpersonationLocale : Uint4B
    2377. 

  2377. #    +0x179c IsImpersonating  : Uint4B
    2378. 

  2378. #    +0x17a0 NlsCache         : Ptr64 Void
    2379. 

  2379. #    +0x17a8 pShimData        : Ptr64 Void
    2380. 

  2380. #    +0x17b0 HeapVirtualAffinity : Uint4B
    2381. 

  2381. #    +0x17b8 CurrentTransactionHandle : Ptr64 Void
    2382. 

  2382. #    +0x17c0 ActiveFrame      : Ptr64 _TEB_ACTIVE_FRAME
    2383. 

  2383. #    +0x17c8 FlsData          : Ptr64 Void
    2384. 

  2384. #    +0x17d0 SafeThunkCall    : UChar
    2385. 

  2385. #    +0x17d1 BooleanSpare     : [3] UChar
    2386. 

  2386. class _TEB_XP_64(Structure):
    2387. 

  2387.     _pack_ = 8
    2388. 

  2388.     _fields_ = [
    2389. 

  2389.         ("NtTib",                           NT_TIB),
    2390. 

  2390.         ("EnvironmentPointer",              PVOID),
    2391. 

  2391.         ("ClientId",                        CLIENT_ID),
    2392. 

  2392.         ("ActiveRpcHandle",                 PVOID),
    2393. 

  2393.         ("ThreadLocalStoragePointer",       PVOID),
    2394. 

  2394.         ("ProcessEnvironmentBlock",         PVOID), # PPEB
    2395. 

  2395.         ("LastErrorValue",                  DWORD),
    2396. 

  2396.         ("CountOfOwnedCriticalSections",    DWORD),
    2397. 

  2397.         ("CsrClientThread",                 PVOID),
    2398. 

  2398.         ("Win32ThreadInfo",                 PVOID),
    2399. 

  2399.         ("User32Reserved",                  DWORD * 26),
    2400. 

  2400.         ("UserReserved",                    DWORD * 5),
    2401. 

  2401.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    2402. 

  2402.         ("CurrentLocale",                   DWORD),
    2403. 

  2403.         ("FpSoftwareStatusRegister",        DWORD),
    2404. 

  2404.         ("SystemReserved1",                 PVOID * 54),
    2405. 

  2405.         ("ExceptionCode",                   SDWORD),
    2406. 

  2406.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    2407. 

  2407.         ("SpareBytes1",                     UCHAR * 28),
    2408. 

  2408.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    2409. 

  2409.         ("RealClientId",                    CLIENT_ID),
    2410. 

  2410.         ("GdiCachedProcessHandle",          HANDLE),
    2411. 

  2411.         ("GdiClientPID",                    DWORD),
    2412. 

  2412.         ("GdiClientTID",                    DWORD),
    2413. 

  2413.         ("GdiThreadLocalInfo",              PVOID),
    2414. 

  2414.         ("Win32ClientInfo",                 QWORD * 62),
    2415. 

  2415.         ("glDispatchTable",                 PVOID * 233),
    2416. 

  2416.         ("glReserved1",                     QWORD * 29),
    2417. 

  2417.         ("glReserved2",                     PVOID),
    2418. 

  2418.         ("glSectionInfo",                   PVOID),
    2419. 

  2419.         ("glSection",                       PVOID),
    2420. 

  2420.         ("glTable",                         PVOID),
    2421. 

  2421.         ("glCurrentRC",                     PVOID),
    2422. 

  2422.         ("glContext",                       PVOID),
    2423. 

  2423.         ("LastStatusValue",                 NTSTATUS),
    2424. 

  2424.         ("StaticUnicodeString",             UNICODE_STRING),
    2425. 

  2425.         ("StaticUnicodeBuffer",             WCHAR * 261),
    2426. 

  2426.         ("DeallocationStack",               PVOID),
    2427. 

  2427.         ("TlsSlots",                        PVOID * 64),
    2428. 

  2428.         ("TlsLinks",                        LIST_ENTRY),
    2429. 

  2429.         ("Vdm",                             PVOID),
    2430. 

  2430.         ("ReservedForNtRpc",                PVOID),
    2431. 

  2431.         ("DbgSsReserved",                   PVOID * 2),
    2432. 

  2432.         ("HardErrorMode",                   DWORD),
    2433. 

  2433.         ("Instrumentation",                 PVOID * 14),
    2434. 

  2434.         ("SubProcessTag",                   PVOID),
    2435. 

  2435.         ("EtwTraceData",                    PVOID),
    2436. 

  2436.         ("WinSockData",                     PVOID),
    2437. 

  2437.         ("GdiBatchCount",                   DWORD),
    2438. 

  2438.         ("InDbgPrint",                      BOOLEAN),
    2439. 

  2439.         ("FreeStackOnTermination",          BOOLEAN),
    2440. 

  2440.         ("HasFiberData",                    BOOLEAN),
    2441. 

  2441.         ("IdealProcessor",                  UCHAR),
    2442. 

  2442.         ("GuaranteedStackBytes",            DWORD),
    2443. 

  2443.         ("ReservedForPerf",                 PVOID),
    2444. 

  2444.         ("ReservedForOle",                  PVOID),
    2445. 

  2445.         ("WaitingOnLoaderLock",             DWORD),
    2446. 

  2446.         ("SparePointer1",                   PVOID),
    2447. 

  2447.         ("SoftPatchPtr1",                   PVOID),
    2448. 

  2448.         ("SoftPatchPtr2",                   PVOID),
    2449. 

  2449.         ("TlsExpansionSlots",               PVOID), # Ptr64 Ptr64 Void
    2450. 

  2450.         ("DeallocationBStore",              PVOID),
    2451. 

  2451.         ("BStoreLimit",                     PVOID),
    2452. 

  2452.         ("ImpersonationLocale",             DWORD),
    2453. 

  2453.         ("IsImpersonating",                 BOOL),
    2454. 

  2454.         ("NlsCache",                        PVOID),
    2455. 

  2455.         ("pShimData",                       PVOID),
    2456. 

  2456.         ("HeapVirtualAffinity",             DWORD),
    2457. 

  2457.         ("CurrentTransactionHandle",        HANDLE),
    2458. 

  2458.         ("ActiveFrame",                     PVOID), # PTEB_ACTIVE_FRAME
    2459. 

  2459.         ("FlsData",                         PVOID),
    2460. 

  2460.         ("SafeThunkCall",                   BOOLEAN),
    2461. 

  2461.         ("BooleanSpare",                    BOOLEAN * 3),
    2462. 

  2462. ]
    2463. 

  2463. 

  2464. #    +0x000 NtTib            : _NT_TIB
    2465. 

  2465. #    +0x01c EnvironmentPointer : Ptr32 Void
    2466. 

  2466. #    +0x020 ClientId         : _CLIENT_ID
    2467. 

  2467. #    +0x028 ActiveRpcHandle  : Ptr32 Void
    2468. 

  2468. #    +0x02c ThreadLocalStoragePointer : Ptr32 Void
    2469. 

  2469. #    +0x030 ProcessEnvironmentBlock : Ptr32 _PEB
    2470. 

  2470. #    +0x034 LastErrorValue   : Uint4B
    2471. 

  2471. #    +0x038 CountOfOwnedCriticalSections : Uint4B
    2472. 

  2472. #    +0x03c CsrClientThread  : Ptr32 Void
    2473. 

  2473. #    +0x040 Win32ThreadInfo  : Ptr32 Void
    2474. 

  2474. #    +0x044 User32Reserved   : [26] Uint4B
    2475. 

  2475. #    +0x0ac UserReserved     : [5] Uint4B
    2476. 

  2476. #    +0x0c0 WOW32Reserved    : Ptr32 Void
    2477. 

  2477. #    +0x0c4 CurrentLocale    : Uint4B
    2478. 

  2478. #    +0x0c8 FpSoftwareStatusRegister : Uint4B
    2479. 

  2479. #    +0x0cc SystemReserved1  : [54] Ptr32 Void
    2480. 

  2480. #    +0x1a4 ExceptionCode    : Int4B
    2481. 

  2481. #    +0x1a8 ActivationContextStackPointer : Ptr32 _ACTIVATION_CONTEXT_STACK
    2482. 

  2482. #    +0x1ac SpareBytes1      : [40] UChar
    2483. 

  2483. #    +0x1d4 GdiTebBatch      : _GDI_TEB_BATCH
    2484. 

  2484. #    +0x6b4 RealClientId     : _CLIENT_ID
    2485. 

  2485. #    +0x6bc GdiCachedProcessHandle : Ptr32 Void
    2486. 

  2486. #    +0x6c0 GdiClientPID     : Uint4B
    2487. 

  2487. #    +0x6c4 GdiClientTID     : Uint4B
    2488. 

  2488. #    +0x6c8 GdiThreadLocalInfo : Ptr32 Void
    2489. 

  2489. #    +0x6cc Win32ClientInfo  : [62] Uint4B
    2490. 

  2490. #    +0x7c4 glDispatchTable  : [233] Ptr32 Void
    2491. 

  2491. #    +0xb68 glReserved1      : [29] Uint4B
    2492. 

  2492. #    +0xbdc glReserved2      : Ptr32 Void
    2493. 

  2493. #    +0xbe0 glSectionInfo    : Ptr32 Void
    2494. 

  2494. #    +0xbe4 glSection        : Ptr32 Void
    2495. 

  2495. #    +0xbe8 glTable          : Ptr32 Void
    2496. 

  2496. #    +0xbec glCurrentRC      : Ptr32 Void
    2497. 

  2497. #    +0xbf0 glContext        : Ptr32 Void
    2498. 

  2498. #    +0xbf4 LastStatusValue  : Uint4B
    2499. 

  2499. #    +0xbf8 StaticUnicodeString : _UNICODE_STRING
    2500. 

  2500. #    +0xc00 StaticUnicodeBuffer : [261] Uint2B
    2501. 

  2501. #    +0xe0c DeallocationStack : Ptr32 Void
    2502. 

  2502. #    +0xe10 TlsSlots         : [64] Ptr32 Void
    2503. 

  2503. #    +0xf10 TlsLinks         : _LIST_ENTRY
    2504. 

  2504. #    +0xf18 Vdm              : Ptr32 Void
    2505. 

  2505. #    +0xf1c ReservedForNtRpc : Ptr32 Void
    2506. 

  2506. #    +0xf20 DbgSsReserved    : [2] Ptr32 Void
    2507. 

  2507. #    +0xf28 HardErrorMode    : Uint4B
    2508. 

  2508. #    +0xf2c Instrumentation  : [14] Ptr32 Void
    2509. 

  2509. #    +0xf64 SubProcessTag    : Ptr32 Void
    2510. 

  2510. #    +0xf68 EtwTraceData     : Ptr32 Void
    2511. 

  2511. #    +0xf6c WinSockData      : Ptr32 Void
    2512. 

  2512. #    +0xf70 GdiBatchCount    : Uint4B
    2513. 

  2513. #    +0xf74 InDbgPrint       : UChar
    2514. 

  2514. #    +0xf75 FreeStackOnTermination : UChar
    2515. 

  2515. #    +0xf76 HasFiberData     : UChar
    2516. 

  2516. #    +0xf77 IdealProcessor   : UChar
    2517. 

  2517. #    +0xf78 GuaranteedStackBytes : Uint4B
    2518. 

  2518. #    +0xf7c ReservedForPerf  : Ptr32 Void
    2519. 

  2519. #    +0xf80 ReservedForOle   : Ptr32 Void
    2520. 

  2520. #    +0xf84 WaitingOnLoaderLock : Uint4B
    2521. 

  2521. #    +0xf88 SparePointer1    : Uint4B
    2522. 

  2522. #    +0xf8c SoftPatchPtr1    : Uint4B
    2523. 

  2523. #    +0xf90 SoftPatchPtr2    : Uint4B
    2524. 

  2524. #    +0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void
    2525. 

  2525. #    +0xf98 ImpersonationLocale : Uint4B
    2526. 

  2526. #    +0xf9c IsImpersonating  : Uint4B
    2527. 

  2527. #    +0xfa0 NlsCache         : Ptr32 Void
    2528. 

  2528. #    +0xfa4 pShimData        : Ptr32 Void
    2529. 

  2529. #    +0xfa8 HeapVirtualAffinity : Uint4B
    2530. 

  2530. #    +0xfac CurrentTransactionHandle : Ptr32 Void
    2531. 

  2531. #    +0xfb0 ActiveFrame      : Ptr32 _TEB_ACTIVE_FRAME
    2532. 

  2532. #    +0xfb4 FlsData          : Ptr32 Void
    2533. 

  2533. #    +0xfb8 SafeThunkCall    : UChar
    2534. 

  2534. #    +0xfb9 BooleanSpare     : [3] UChar
    2535. 

  2535. class _TEB_2003(Structure):
    2536. 

  2536.     _pack_ = 8
    2537. 

  2537.     _fields_ = [
    2538. 

  2538.         ("NtTib",                           NT_TIB),
    2539. 

  2539.         ("EnvironmentPointer",              PVOID),
    2540. 

  2540.         ("ClientId",                        CLIENT_ID),
    2541. 

  2541.         ("ActiveRpcHandle",                 HANDLE),
    2542. 

  2542.         ("ThreadLocalStoragePointer",       PVOID),
    2543. 

  2543.         ("ProcessEnvironmentBlock",         PVOID), # PPEB
    2544. 

  2544.         ("LastErrorValue",                  DWORD),
    2545. 

  2545.         ("CountOfOwnedCriticalSections",    DWORD),
    2546. 

  2546.         ("CsrClientThread",                 PVOID),
    2547. 

  2547.         ("Win32ThreadInfo",                 PVOID),
    2548. 

  2548.         ("User32Reserved",                  DWORD * 26),
    2549. 

  2549.         ("UserReserved",                    DWORD * 5),
    2550. 

  2550.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    2551. 

  2551.         ("CurrentLocale",                   DWORD),
    2552. 

  2552.         ("FpSoftwareStatusRegister",        DWORD),
    2553. 

  2553.         ("SystemReserved1",                 PVOID * 54),
    2554. 

  2554.         ("ExceptionCode",                   SDWORD),
    2555. 

  2555.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    2556. 

  2556.         ("SpareBytes1",                     UCHAR * 40),
    2557. 

  2557.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    2558. 

  2558.         ("RealClientId",                    CLIENT_ID),
    2559. 

  2559.         ("GdiCachedProcessHandle",          HANDLE),
    2560. 

  2560.         ("GdiClientPID",                    DWORD),
    2561. 

  2561.         ("GdiClientTID",                    DWORD),
    2562. 

  2562.         ("GdiThreadLocalInfo",              PVOID),
    2563. 

  2563.         ("Win32ClientInfo",                 DWORD * 62),
    2564. 

  2564.         ("glDispatchTable",                 PVOID * 233),
    2565. 

  2565.         ("glReserved1",                     DWORD * 29),
    2566. 

  2566.         ("glReserved2",                     PVOID),
    2567. 

  2567.         ("glSectionInfo",                   PVOID),
    2568. 

  2568.         ("glSection",                       PVOID),
    2569. 

  2569.         ("glTable",                         PVOID),
    2570. 

  2570.         ("glCurrentRC",                     PVOID),
    2571. 

  2571.         ("glContext",                       PVOID),
    2572. 

  2572.         ("LastStatusValue",                 NTSTATUS),
    2573. 

  2573.         ("StaticUnicodeString",             UNICODE_STRING),
    2574. 

  2574.         ("StaticUnicodeBuffer",             WCHAR * 261),
    2575. 

  2575.         ("DeallocationStack",               PVOID),
    2576. 

  2576.         ("TlsSlots",                        PVOID * 64),
    2577. 

  2577.         ("TlsLinks",                        LIST_ENTRY),
    2578. 

  2578.         ("Vdm",                             PVOID),
    2579. 

  2579.         ("ReservedForNtRpc",                PVOID),
    2580. 

  2580.         ("DbgSsReserved",                   PVOID * 2),
    2581. 

  2581.         ("HardErrorMode",                   DWORD),
    2582. 

  2582.         ("Instrumentation",                 PVOID * 14),
    2583. 

  2583.         ("SubProcessTag",                   PVOID),
    2584. 

  2584.         ("EtwTraceData",                    PVOID),
    2585. 

  2585.         ("WinSockData",                     PVOID),
    2586. 

  2586.         ("GdiBatchCount",                   DWORD),
    2587. 

  2587.         ("InDbgPrint",                      BOOLEAN),
    2588. 

  2588.         ("FreeStackOnTermination",          BOOLEAN),
    2589. 

  2589.         ("HasFiberData",                    BOOLEAN),
    2590. 

  2590.         ("IdealProcessor",                  UCHAR),
    2591. 

  2591.         ("GuaranteedStackBytes",            DWORD),
    2592. 

  2592.         ("ReservedForPerf",                 PVOID),
    2593. 

  2593.         ("ReservedForOle",                  PVOID),
    2594. 

  2594.         ("WaitingOnLoaderLock",             DWORD),
    2595. 

  2595.         ("SparePointer1",                   PVOID),
    2596. 

  2596.         ("SoftPatchPtr1",                   PVOID),
    2597. 

  2597.         ("SoftPatchPtr2",                   PVOID),
    2598. 

  2598.         ("TlsExpansionSlots",               PVOID), # Ptr32 Ptr32 Void
    2599. 

  2599.         ("ImpersonationLocale",             DWORD),
    2600. 

  2600.         ("IsImpersonating",                 BOOL),
    2601. 

  2601.         ("NlsCache",                        PVOID),
    2602. 

  2602.         ("pShimData",                       PVOID),
    2603. 

  2603.         ("HeapVirtualAffinity",             DWORD),
    2604. 

  2604.         ("CurrentTransactionHandle",        HANDLE),
    2605. 

  2605.         ("ActiveFrame",                     PVOID), # PTEB_ACTIVE_FRAME
    2606. 

  2606.         ("FlsData",                         PVOID),
    2607. 

  2607.         ("SafeThunkCall",                   BOOLEAN),
    2608. 

  2608.         ("BooleanSpare",                    BOOLEAN * 3),
    2609. 

  2609. ]
    2610. 

  2610. 

  2611. _TEB_2003_64    = _TEB_XP_64
    2612. 

  2612. _TEB_2003_R2    = _TEB_2003
    2613. 

  2613. _TEB_2003_R2_64 = _TEB_2003_64
    2614. 

  2614. 

  2615. #    +0x000 NtTib            : _NT_TIB
    2616. 

  2616. #    +0x01c EnvironmentPointer : Ptr32 Void
    2617. 

  2617. #    +0x020 ClientId         : _CLIENT_ID
    2618. 

  2618. #    +0x028 ActiveRpcHandle  : Ptr32 Void
    2619. 

  2619. #    +0x02c ThreadLocalStoragePointer : Ptr32 Void
    2620. 

  2620. #    +0x030 ProcessEnvironmentBlock : Ptr32 _PEB
    2621. 

  2621. #    +0x034 LastErrorValue   : Uint4B
    2622. 

  2622. #    +0x038 CountOfOwnedCriticalSections : Uint4B
    2623. 

  2623. #    +0x03c CsrClientThread  : Ptr32 Void
    2624. 

  2624. #    +0x040 Win32ThreadInfo  : Ptr32 Void
    2625. 

  2625. #    +0x044 User32Reserved   : [26] Uint4B
    2626. 

  2626. #    +0x0ac UserReserved     : [5] Uint4B
    2627. 

  2627. #    +0x0c0 WOW32Reserved    : Ptr32 Void
    2628. 

  2628. #    +0x0c4 CurrentLocale    : Uint4B
    2629. 

  2629. #    +0x0c8 FpSoftwareStatusRegister : Uint4B
    2630. 

  2630. #    +0x0cc SystemReserved1  : [54] Ptr32 Void
    2631. 

  2631. #    +0x1a4 ExceptionCode    : Int4B
    2632. 

  2632. #    +0x1a8 ActivationContextStackPointer : Ptr32 _ACTIVATION_CONTEXT_STACK
    2633. 

  2633. #    +0x1ac SpareBytes1      : [36] UChar
    2634. 

  2634. #    +0x1d0 TxFsContext      : Uint4B
    2635. 

  2635. #    +0x1d4 GdiTebBatch      : _GDI_TEB_BATCH
    2636. 

  2636. #    +0x6b4 RealClientId     : _CLIENT_ID
    2637. 

  2637. #    +0x6bc GdiCachedProcessHandle : Ptr32 Void
    2638. 

  2638. #    +0x6c0 GdiClientPID     : Uint4B
    2639. 

  2639. #    +0x6c4 GdiClientTID     : Uint4B
    2640. 

  2640. #    +0x6c8 GdiThreadLocalInfo : Ptr32 Void
    2641. 

  2641. #    +0x6cc Win32ClientInfo  : [62] Uint4B
    2642. 

  2642. #    +0x7c4 glDispatchTable  : [233] Ptr32 Void
    2643. 

  2643. #    +0xb68 glReserved1      : [29] Uint4B
    2644. 

  2644. #    +0xbdc glReserved2      : Ptr32 Void
    2645. 

  2645. #    +0xbe0 glSectionInfo    : Ptr32 Void
    2646. 

  2646. #    +0xbe4 glSection        : Ptr32 Void
    2647. 

  2647. #    +0xbe8 glTable          : Ptr32 Void
    2648. 

  2648. #    +0xbec glCurrentRC      : Ptr32 Void
    2649. 

  2649. #    +0xbf0 glContext        : Ptr32 Void
    2650. 

  2650. #    +0xbf4 LastStatusValue  : Uint4B
    2651. 

  2651. #    +0xbf8 StaticUnicodeString : _UNICODE_STRING
    2652. 

  2652. #    +0xc00 StaticUnicodeBuffer : [261] Wchar
    2653. 

  2653. #    +0xe0c DeallocationStack : Ptr32 Void
    2654. 

  2654. #    +0xe10 TlsSlots         : [64] Ptr32 Void
    2655. 

  2655. #    +0xf10 TlsLinks         : _LIST_ENTRY
    2656. 

  2656. #    +0xf18 Vdm              : Ptr32 Void
    2657. 

  2657. #    +0xf1c ReservedForNtRpc : Ptr32 Void
    2658. 

  2658. #    +0xf20 DbgSsReserved    : [2] Ptr32 Void
    2659. 

  2659. #    +0xf28 HardErrorMode    : Uint4B
    2660. 

  2660. #    +0xf2c Instrumentation  : [9] Ptr32 Void
    2661. 

  2661. #    +0xf50 ActivityId       : _GUID
    2662. 

  2662. #    +0xf60 SubProcessTag    : Ptr32 Void
    2663. 

  2663. #    +0xf64 EtwLocalData     : Ptr32 Void
    2664. 

  2664. #    +0xf68 EtwTraceData     : Ptr32 Void
    2665. 

  2665. #    +0xf6c WinSockData      : Ptr32 Void
    2666. 

  2666. #    +0xf70 GdiBatchCount    : Uint4B
    2667. 

  2667. #    +0xf74 SpareBool0       : UChar
    2668. 

  2668. #    +0xf75 SpareBool1       : UChar
    2669. 

  2669. #    +0xf76 SpareBool2       : UChar
    2670. 

  2670. #    +0xf77 IdealProcessor   : UChar
    2671. 

  2671. #    +0xf78 GuaranteedStackBytes : Uint4B
    2672. 

  2672. #    +0xf7c ReservedForPerf  : Ptr32 Void
    2673. 

  2673. #    +0xf80 ReservedForOle   : Ptr32 Void
    2674. 

  2674. #    +0xf84 WaitingOnLoaderLock : Uint4B
    2675. 

  2675. #    +0xf88 SavedPriorityState : Ptr32 Void
    2676. 

  2676. #    +0xf8c SoftPatchPtr1    : Uint4B
    2677. 

  2677. #    +0xf90 ThreadPoolData   : Ptr32 Void
    2678. 

  2678. #    +0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void
    2679. 

  2679. #    +0xf98 ImpersonationLocale : Uint4B
    2680. 

  2680. #    +0xf9c IsImpersonating  : Uint4B
    2681. 

  2681. #    +0xfa0 NlsCache         : Ptr32 Void
    2682. 

  2682. #    +0xfa4 pShimData        : Ptr32 Void
    2683. 

  2683. #    +0xfa8 HeapVirtualAffinity : Uint4B
    2684. 

  2684. #    +0xfac CurrentTransactionHandle : Ptr32 Void
    2685. 

  2685. #    +0xfb0 ActiveFrame      : Ptr32 _TEB_ACTIVE_FRAME
    2686. 

  2686. #    +0xfb4 FlsData          : Ptr32 Void
    2687. 

  2687. #    +0xfb8 PreferredLanguages : Ptr32 Void
    2688. 

  2688. #    +0xfbc UserPrefLanguages : Ptr32 Void
    2689. 

  2689. #    +0xfc0 MergedPrefLanguages : Ptr32 Void
    2690. 

  2690. #    +0xfc4 MuiImpersonation : Uint4B
    2691. 

  2691. #    +0xfc8 CrossTebFlags    : Uint2B
    2692. 

  2692. #    +0xfc8 SpareCrossTebBits : Pos 0, 16 Bits
    2693. 

  2693. #    +0xfca SameTebFlags     : Uint2B
    2694. 

  2694. #    +0xfca DbgSafeThunkCall : Pos 0, 1 Bit
    2695. 

  2695. #    +0xfca DbgInDebugPrint  : Pos 1, 1 Bit
    2696. 

  2696. #    +0xfca DbgHasFiberData  : Pos 2, 1 Bit
    2697. 

  2697. #    +0xfca DbgSkipThreadAttach : Pos 3, 1 Bit
    2698. 

  2698. #    +0xfca DbgWerInShipAssertCode : Pos 4, 1 Bit
    2699. 

  2699. #    +0xfca DbgRanProcessInit : Pos 5, 1 Bit
    2700. 

  2700. #    +0xfca DbgClonedThread  : Pos 6, 1 Bit
    2701. 

  2701. #    +0xfca DbgSuppressDebugMsg : Pos 7, 1 Bit
    2702. 

  2702. #    +0xfca RtlDisableUserStackWalk : Pos 8, 1 Bit
    2703. 

  2703. #    +0xfca RtlExceptionAttached : Pos 9, 1 Bit
    2704. 

  2704. #    +0xfca SpareSameTebBits : Pos 10, 6 Bits
    2705. 

  2705. #    +0xfcc TxnScopeEnterCallback : Ptr32 Void
    2706. 

  2706. #    +0xfd0 TxnScopeExitCallback : Ptr32 Void
    2707. 

  2707. #    +0xfd4 TxnScopeContext  : Ptr32 Void
    2708. 

  2708. #    +0xfd8 LockCount        : Uint4B
    2709. 

  2709. #    +0xfdc ProcessRundown   : Uint4B
    2710. 

  2710. #    +0xfe0 LastSwitchTime   : Uint8B
    2711. 

  2711. #    +0xfe8 TotalSwitchOutTime : Uint8B
    2712. 

  2712. #    +0xff0 WaitReasonBitMap : _LARGE_INTEGER
    2713. 

  2713. class _TEB_2008(Structure):
    2714. 

  2714.     _pack_ = 8
    2715. 

  2715.     _fields_ = [
    2716. 

  2716.         ("NtTib",                           NT_TIB),
    2717. 

  2717.         ("EnvironmentPointer",              PVOID),
    2718. 

  2718.         ("ClientId",                        CLIENT_ID),
    2719. 

  2719.         ("ActiveRpcHandle",                 HANDLE),
    2720. 

  2720.         ("ThreadLocalStoragePointer",       PVOID),
    2721. 

  2721.         ("ProcessEnvironmentBlock",         PVOID), # PPEB
    2722. 

  2722.         ("LastErrorValue",                  DWORD),
    2723. 

  2723.         ("CountOfOwnedCriticalSections",    DWORD),
    2724. 

  2724.         ("CsrClientThread",                 PVOID),
    2725. 

  2725.         ("Win32ThreadInfo",                 PVOID),
    2726. 

  2726.         ("User32Reserved",                  DWORD * 26),
    2727. 

  2727.         ("UserReserved",                    DWORD * 5),
    2728. 

  2728.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    2729. 

  2729.         ("CurrentLocale",                   DWORD),
    2730. 

  2730.         ("FpSoftwareStatusRegister",        DWORD),
    2731. 

  2731.         ("SystemReserved1",                 PVOID * 54),
    2732. 

  2732.         ("ExceptionCode",                   SDWORD),
    2733. 

  2733.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    2734. 

  2734.         ("SpareBytes1",                     UCHAR * 36),
    2735. 

  2735.         ("TxFsContext",                     DWORD),
    2736. 

  2736.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    2737. 

  2737.         ("RealClientId",                    CLIENT_ID),
    2738. 

  2738.         ("GdiCachedProcessHandle",          HANDLE),
    2739. 

  2739.         ("GdiClientPID",                    DWORD),
    2740. 

  2740.         ("GdiClientTID",                    DWORD),
    2741. 

  2741.         ("GdiThreadLocalInfo",              PVOID),
    2742. 

  2742.         ("Win32ClientInfo",                 DWORD * 62),
    2743. 

  2743.         ("glDispatchTable",                 PVOID * 233),
    2744. 

  2744.         ("glReserved1",                     DWORD * 29),
    2745. 

  2745.         ("glReserved2",                     PVOID),
    2746. 

  2746.         ("glSectionInfo",                   PVOID),
    2747. 

  2747.         ("glSection",                       PVOID),
    2748. 

  2748.         ("glTable",                         PVOID),
    2749. 

  2749.         ("glCurrentRC",                     PVOID),
    2750. 

  2750.         ("glContext",                       PVOID),
    2751. 

  2751.         ("LastStatusValue",                 NTSTATUS),
    2752. 

  2752.         ("StaticUnicodeString",             UNICODE_STRING),
    2753. 

  2753.         ("StaticUnicodeBuffer",             WCHAR * 261),
    2754. 

  2754.         ("DeallocationStack",               PVOID),
    2755. 

  2755.         ("TlsSlots",                        PVOID * 64),
    2756. 

  2756.         ("TlsLinks",                        LIST_ENTRY),
    2757. 

  2757.         ("Vdm",                             PVOID),
    2758. 

  2758.         ("ReservedForNtRpc",                PVOID),
    2759. 

  2759.         ("DbgSsReserved",                   PVOID * 2),
    2760. 

  2760.         ("HardErrorMode",                   DWORD),
    2761. 

  2761.         ("Instrumentation",                 PVOID * 9),
    2762. 

  2762.         ("ActivityId",                      GUID),
    2763. 

  2763.         ("SubProcessTag",                   PVOID),
    2764. 

  2764.         ("EtwLocalData",                    PVOID),
    2765. 

  2765.         ("EtwTraceData",                    PVOID),
    2766. 

  2766.         ("WinSockData",                     PVOID),
    2767. 

  2767.         ("GdiBatchCount",                   DWORD),
    2768. 

  2768.         ("SpareBool0",                      BOOLEAN),
    2769. 

  2769.         ("SpareBool1",                      BOOLEAN),
    2770. 

  2770.         ("SpareBool2",                      BOOLEAN),
    2771. 

  2771.         ("IdealProcessor",                  UCHAR),
    2772. 

  2772.         ("GuaranteedStackBytes",            DWORD),
    2773. 

  2773.         ("ReservedForPerf",                 PVOID),
    2774. 

  2774.         ("ReservedForOle",                  PVOID),
    2775. 

  2775.         ("WaitingOnLoaderLock",             DWORD),
    2776. 

  2776.         ("SavedPriorityState",              PVOID),
    2777. 

  2777.         ("SoftPatchPtr1",                   PVOID),
    2778. 

  2778.         ("ThreadPoolData",                  PVOID),
    2779. 

  2779.         ("TlsExpansionSlots",               PVOID), # Ptr32 Ptr32 Void
    2780. 

  2780.         ("ImpersonationLocale",             DWORD),
    2781. 

  2781.         ("IsImpersonating",                 BOOL),
    2782. 

  2782.         ("NlsCache",                        PVOID),
    2783. 

  2783.         ("pShimData",                       PVOID),
    2784. 

  2784.         ("HeapVirtualAffinity",             DWORD),
    2785. 

  2785.         ("CurrentTransactionHandle",        HANDLE),
    2786. 

  2786.         ("ActiveFrame",                     PVOID), # PTEB_ACTIVE_FRAME
    2787. 

  2787.         ("FlsData",                         PVOID),
    2788. 

  2788.         ("PreferredLanguages",              PVOID),
    2789. 

  2789.         ("UserPrefLanguages",               PVOID),
    2790. 

  2790.         ("MergedPrefLanguages",             PVOID),
    2791. 

  2791.         ("MuiImpersonation",                BOOL),
    2792. 

  2792.         ("CrossTebFlags",                   WORD),
    2793. 

  2793.         ("SameTebFlags",                    WORD),
    2794. 

  2794.         ("TxnScopeEnterCallback",           PVOID),
    2795. 

  2795.         ("TxnScopeExitCallback",            PVOID),
    2796. 

  2796.         ("TxnScopeContext",                 PVOID),
    2797. 

  2797.         ("LockCount",                       DWORD),
    2798. 

  2798.         ("ProcessRundown",                  DWORD),
    2799. 

  2799.         ("LastSwitchTime",                  QWORD),
    2800. 

  2800.         ("TotalSwitchOutTime",              QWORD),
    2801. 

  2801.         ("WaitReasonBitMap",                LONGLONG),  # LARGE_INTEGER
    2802. 

  2802. ]
    2803. 

  2803. 

  2804. #    +0x000 NtTib            : _NT_TIB
    2805. 

  2805. #    +0x038 EnvironmentPointer : Ptr64 Void
    2806. 

  2806. #    +0x040 ClientId         : _CLIENT_ID
    2807. 

  2807. #    +0x050 ActiveRpcHandle  : Ptr64 Void
    2808. 

  2808. #    +0x058 ThreadLocalStoragePointer : Ptr64 Void
    2809. 

  2809. #    +0x060 ProcessEnvironmentBlock : Ptr64 _PEB
    2810. 

  2810. #    +0x068 LastErrorValue   : Uint4B
    2811. 

  2811. #    +0x06c CountOfOwnedCriticalSections : Uint4B
    2812. 

  2812. #    +0x070 CsrClientThread  : Ptr64 Void
    2813. 

  2813. #    +0x078 Win32ThreadInfo  : Ptr64 Void
    2814. 

  2814. #    +0x080 User32Reserved   : [26] Uint4B
    2815. 

  2815. #    +0x0e8 UserReserved     : [5] Uint4B
    2816. 

  2816. #    +0x100 WOW32Reserved    : Ptr64 Void
    2817. 

  2817. #    +0x108 CurrentLocale    : Uint4B
    2818. 

  2818. #    +0x10c FpSoftwareStatusRegister : Uint4B
    2819. 

  2819. #    +0x110 SystemReserved1  : [54] Ptr64 Void
    2820. 

  2820. #    +0x2c0 ExceptionCode    : Int4B
    2821. 

  2821. #    +0x2c8 ActivationContextStackPointer : Ptr64 _ACTIVATION_CONTEXT_STACK
    2822. 

  2822. #    +0x2d0 SpareBytes1      : [24] UChar
    2823. 

  2823. #    +0x2e8 TxFsContext      : Uint4B
    2824. 

  2824. #    +0x2f0 GdiTebBatch      : _GDI_TEB_BATCH
    2825. 

  2825. #    +0x7d8 RealClientId     : _CLIENT_ID
    2826. 

  2826. #    +0x7e8 GdiCachedProcessHandle : Ptr64 Void
    2827. 

  2827. #    +0x7f0 GdiClientPID     : Uint4B
    2828. 

  2828. #    +0x7f4 GdiClientTID     : Uint4B
    2829. 

  2829. #    +0x7f8 GdiThreadLocalInfo : Ptr64 Void
    2830. 

  2830. #    +0x800 Win32ClientInfo  : [62] Uint8B
    2831. 

  2831. #    +0x9f0 glDispatchTable  : [233] Ptr64 Void
    2832. 

  2832. #    +0x1138 glReserved1      : [29] Uint8B
    2833. 

  2833. #    +0x1220 glReserved2      : Ptr64 Void
    2834. 

  2834. #    +0x1228 glSectionInfo    : Ptr64 Void
    2835. 

  2835. #    +0x1230 glSection        : Ptr64 Void
    2836. 

  2836. #    +0x1238 glTable          : Ptr64 Void
    2837. 

  2837. #    +0x1240 glCurrentRC      : Ptr64 Void
    2838. 

  2838. #    +0x1248 glContext        : Ptr64 Void
    2839. 

  2839. #    +0x1250 LastStatusValue  : Uint4B
    2840. 

  2840. #    +0x1258 StaticUnicodeString : _UNICODE_STRING
    2841. 

  2841. #    +0x1268 StaticUnicodeBuffer : [261] Wchar
    2842. 

  2842. #    +0x1478 DeallocationStack : Ptr64 Void
    2843. 

  2843. #    +0x1480 TlsSlots         : [64] Ptr64 Void
    2844. 

  2844. #    +0x1680 TlsLinks         : _LIST_ENTRY
    2845. 

  2845. #    +0x1690 Vdm              : Ptr64 Void
    2846. 

  2846. #    +0x1698 ReservedForNtRpc : Ptr64 Void
    2847. 

  2847. #    +0x16a0 DbgSsReserved    : [2] Ptr64 Void
    2848. 

  2848. #    +0x16b0 HardErrorMode    : Uint4B
    2849. 

  2849. #    +0x16b8 Instrumentation  : [11] Ptr64 Void
    2850. 

  2850. #    +0x1710 ActivityId       : _GUID
    2851. 

  2851. #    +0x1720 SubProcessTag    : Ptr64 Void
    2852. 

  2852. #    +0x1728 EtwLocalData     : Ptr64 Void
    2853. 

  2853. #    +0x1730 EtwTraceData     : Ptr64 Void
    2854. 

  2854. #    +0x1738 WinSockData      : Ptr64 Void
    2855. 

  2855. #    +0x1740 GdiBatchCount    : Uint4B
    2856. 

  2856. #    +0x1744 SpareBool0       : UChar
    2857. 

  2857. #    +0x1745 SpareBool1       : UChar
    2858. 

  2858. #    +0x1746 SpareBool2       : UChar
    2859. 

  2859. #    +0x1747 IdealProcessor   : UChar
    2860. 

  2860. #    +0x1748 GuaranteedStackBytes : Uint4B
    2861. 

  2861. #    +0x1750 ReservedForPerf  : Ptr64 Void
    2862. 

  2862. #    +0x1758 ReservedForOle   : Ptr64 Void
    2863. 

  2863. #    +0x1760 WaitingOnLoaderLock : Uint4B
    2864. 

  2864. #    +0x1768 SavedPriorityState : Ptr64 Void
    2865. 

  2865. #    +0x1770 SoftPatchPtr1    : Uint8B
    2866. 

  2866. #    +0x1778 ThreadPoolData   : Ptr64 Void
    2867. 

  2867. #    +0x1780 TlsExpansionSlots : Ptr64 Ptr64 Void
    2868. 

  2868. #    +0x1788 DeallocationBStore : Ptr64 Void
    2869. 

  2869. #    +0x1790 BStoreLimit      : Ptr64 Void
    2870. 

  2870. #    +0x1798 ImpersonationLocale : Uint4B
    2871. 

  2871. #    +0x179c IsImpersonating  : Uint4B
    2872. 

  2872. #    +0x17a0 NlsCache         : Ptr64 Void
    2873. 

  2873. #    +0x17a8 pShimData        : Ptr64 Void
    2874. 

  2874. #    +0x17b0 HeapVirtualAffinity : Uint4B
    2875. 

  2875. #    +0x17b8 CurrentTransactionHandle : Ptr64 Void
    2876. 

  2876. #    +0x17c0 ActiveFrame      : Ptr64 _TEB_ACTIVE_FRAME
    2877. 

  2877. #    +0x17c8 FlsData          : Ptr64 Void
    2878. 

  2878. #    +0x17d0 PreferredLanguages : Ptr64 Void
    2879. 

  2879. #    +0x17d8 UserPrefLanguages : Ptr64 Void
    2880. 

  2880. #    +0x17e0 MergedPrefLanguages : Ptr64 Void
    2881. 

  2881. #    +0x17e8 MuiImpersonation : Uint4B
    2882. 

  2882. #    +0x17ec CrossTebFlags    : Uint2B
    2883. 

  2883. #    +0x17ec SpareCrossTebBits : Pos 0, 16 Bits
    2884. 

  2884. #    +0x17ee SameTebFlags     : Uint2B
    2885. 

  2885. #    +0x17ee DbgSafeThunkCall : Pos 0, 1 Bit
    2886. 

  2886. #    +0x17ee DbgInDebugPrint  : Pos 1, 1 Bit
    2887. 

  2887. #    +0x17ee DbgHasFiberData  : Pos 2, 1 Bit
    2888. 

  2888. #    +0x17ee DbgSkipThreadAttach : Pos 3, 1 Bit
    2889. 

  2889. #    +0x17ee DbgWerInShipAssertCode : Pos 4, 1 Bit
    2890. 

  2890. #    +0x17ee DbgRanProcessInit : Pos 5, 1 Bit
    2891. 

  2891. #    +0x17ee DbgClonedThread  : Pos 6, 1 Bit
    2892. 

  2892. #    +0x17ee DbgSuppressDebugMsg : Pos 7, 1 Bit
    2893. 

  2893. #    +0x17ee RtlDisableUserStackWalk : Pos 8, 1 Bit
    2894. 

  2894. #    +0x17ee RtlExceptionAttached : Pos 9, 1 Bit
    2895. 

  2895. #    +0x17ee SpareSameTebBits : Pos 10, 6 Bits
    2896. 

  2896. #    +0x17f0 TxnScopeEnterCallback : Ptr64 Void
    2897. 

  2897. #    +0x17f8 TxnScopeExitCallback : Ptr64 Void
    2898. 

  2898. #    +0x1800 TxnScopeContext  : Ptr64 Void
    2899. 

  2899. #    +0x1808 LockCount        : Uint4B
    2900. 

  2900. #    +0x180c ProcessRundown   : Uint4B
    2901. 

  2901. #    +0x1810 LastSwitchTime   : Uint8B
    2902. 

  2902. #    +0x1818 TotalSwitchOutTime : Uint8B
    2903. 

  2903. #    +0x1820 WaitReasonBitMap : _LARGE_INTEGER
    2904. 

  2904. class _TEB_2008_64(Structure):
    2905. 

  2905.     _pack_ = 8
    2906. 

  2906.     _fields_ = [
    2907. 

  2907.         ("NtTib",                           NT_TIB),
    2908. 

  2908.         ("EnvironmentPointer",              PVOID),
    2909. 

  2909.         ("ClientId",                        CLIENT_ID),
    2910. 

  2910.         ("ActiveRpcHandle",                 HANDLE),
    2911. 

  2911.         ("ThreadLocalStoragePointer",       PVOID),
    2912. 

  2912.         ("ProcessEnvironmentBlock",         PVOID), # PPEB
    2913. 

  2913.         ("LastErrorValue",                  DWORD),
    2914. 

  2914.         ("CountOfOwnedCriticalSections",    DWORD),
    2915. 

  2915.         ("CsrClientThread",                 PVOID),
    2916. 

  2916.         ("Win32ThreadInfo",                 PVOID),
    2917. 

  2917.         ("User32Reserved",                  DWORD * 26),
    2918. 

  2918.         ("UserReserved",                    DWORD * 5),
    2919. 

  2919.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    2920. 

  2920.         ("CurrentLocale",                   DWORD),
    2921. 

  2921.         ("FpSoftwareStatusRegister",        DWORD),
    2922. 

  2922.         ("SystemReserved1",                 PVOID * 54),
    2923. 

  2923.         ("ExceptionCode",                   SDWORD),
    2924. 

  2924.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    2925. 

  2925.         ("SpareBytes1",                     UCHAR * 24),
    2926. 

  2926.         ("TxFsContext",                     DWORD),
    2927. 

  2927.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    2928. 

  2928.         ("RealClientId",                    CLIENT_ID),
    2929. 

  2929.         ("GdiCachedProcessHandle",          HANDLE),
    2930. 

  2930.         ("GdiClientPID",                    DWORD),
    2931. 

  2931.         ("GdiClientTID",                    DWORD),
    2932. 

  2932.         ("GdiThreadLocalInfo",              PVOID),
    2933. 

  2933.         ("Win32ClientInfo",                 QWORD * 62),
    2934. 

  2934.         ("glDispatchTable",                 PVOID * 233),
    2935. 

  2935.         ("glReserved1",                     QWORD * 29),
    2936. 

  2936.         ("glReserved2",                     PVOID),
    2937. 

  2937.         ("glSectionInfo",                   PVOID),
    2938. 

  2938.         ("glSection",                       PVOID),
    2939. 

  2939.         ("glTable",                         PVOID),
    2940. 

  2940.         ("glCurrentRC",                     PVOID),
    2941. 

  2941.         ("glContext",                       PVOID),
    2942. 

  2942.         ("LastStatusValue",                 NTSTATUS),
    2943. 

  2943.         ("StaticUnicodeString",             UNICODE_STRING),
    2944. 

  2944.         ("StaticUnicodeBuffer",             WCHAR * 261),
    2945. 

  2945.         ("DeallocationStack",               PVOID),
    2946. 

  2946.         ("TlsSlots",                        PVOID * 64),
    2947. 

  2947.         ("TlsLinks",                        LIST_ENTRY),
    2948. 

  2948.         ("Vdm",                             PVOID),
    2949. 

  2949.         ("ReservedForNtRpc",                PVOID),
    2950. 

  2950.         ("DbgSsReserved",                   PVOID * 2),
    2951. 

  2951.         ("HardErrorMode",                   DWORD),
    2952. 

  2952.         ("Instrumentation",                 PVOID * 11),
    2953. 

  2953.         ("ActivityId",                      GUID),
    2954. 

  2954.         ("SubProcessTag",                   PVOID),
    2955. 

  2955.         ("EtwLocalData",                    PVOID),
    2956. 

  2956.         ("EtwTraceData",                    PVOID),
    2957. 

  2957.         ("WinSockData",                     PVOID),
    2958. 

  2958.         ("GdiBatchCount",                   DWORD),
    2959. 

  2959.         ("SpareBool0",                      BOOLEAN),
    2960. 

  2960.         ("SpareBool1",                      BOOLEAN),
    2961. 

  2961.         ("SpareBool2",                      BOOLEAN),
    2962. 

  2962.         ("IdealProcessor",                  UCHAR),
    2963. 

  2963.         ("GuaranteedStackBytes",            DWORD),
    2964. 

  2964.         ("ReservedForPerf",                 PVOID),
    2965. 

  2965.         ("ReservedForOle",                  PVOID),
    2966. 

  2966.         ("WaitingOnLoaderLock",             DWORD),
    2967. 

  2967.         ("SavedPriorityState",              PVOID),
    2968. 

  2968.         ("SoftPatchPtr1",                   PVOID),
    2969. 

  2969.         ("ThreadPoolData",                  PVOID),
    2970. 

  2970.         ("TlsExpansionSlots",               PVOID), # Ptr64 Ptr64 Void
    2971. 

  2971.         ("DeallocationBStore",              PVOID),
    2972. 

  2972.         ("BStoreLimit",                     PVOID),
    2973. 

  2973.         ("ImpersonationLocale",             DWORD),
    2974. 

  2974.         ("IsImpersonating",                 BOOL),
    2975. 

  2975.         ("NlsCache",                        PVOID),
    2976. 

  2976.         ("pShimData",                       PVOID),
    2977. 

  2977.         ("HeapVirtualAffinity",             DWORD),
    2978. 

  2978.         ("CurrentTransactionHandle",        HANDLE),
    2979. 

  2979.         ("ActiveFrame",                     PVOID), # PTEB_ACTIVE_FRAME
    2980. 

  2980.         ("FlsData",                         PVOID),
    2981. 

  2981.         ("PreferredLanguages",              PVOID),
    2982. 

  2982.         ("UserPrefLanguages",               PVOID),
    2983. 

  2983.         ("MergedPrefLanguages",             PVOID),
    2984. 

  2984.         ("MuiImpersonation",                BOOL),
    2985. 

  2985.         ("CrossTebFlags",                   WORD),
    2986. 

  2986.         ("SameTebFlags",                    WORD),
    2987. 

  2987.         ("TxnScopeEnterCallback",           PVOID),
    2988. 

  2988.         ("TxnScopeExitCallback",            PVOID),
    2989. 

  2989.         ("TxnScopeContext",                 PVOID),
    2990. 

  2990.         ("LockCount",                       DWORD),
    2991. 

  2991.         ("ProcessRundown",                  DWORD),
    2992. 

  2992.         ("LastSwitchTime",                  QWORD),
    2993. 

  2993.         ("TotalSwitchOutTime",              QWORD),
    2994. 

  2994.         ("WaitReasonBitMap",                LONGLONG),  # LARGE_INTEGER
    2995. 

  2995. ]
    2996. 

  2996. 

  2997. #    +0x000 NtTib            : _NT_TIB
    2998. 

  2998. #    +0x01c EnvironmentPointer : Ptr32 Void
    2999. 

  2999. #    +0x020 ClientId         : _CLIENT_ID
    3000. 

  3000. #    +0x028 ActiveRpcHandle  : Ptr32 Void
    3001. 

  3001. #    +0x02c ThreadLocalStoragePointer : Ptr32 Void
    3002. 

  3002. #    +0x030 ProcessEnvironmentBlock : Ptr32 _PEB
    3003. 

  3003. #    +0x034 LastErrorValue   : Uint4B
    3004. 

  3004. #    +0x038 CountOfOwnedCriticalSections : Uint4B
    3005. 

  3005. #    +0x03c CsrClientThread  : Ptr32 Void
    3006. 

  3006. #    +0x040 Win32ThreadInfo  : Ptr32 Void
    3007. 

  3007. #    +0x044 User32Reserved   : [26] Uint4B
    3008. 

  3008. #    +0x0ac UserReserved     : [5] Uint4B
    3009. 

  3009. #    +0x0c0 WOW32Reserved    : Ptr32 Void
    3010. 

  3010. #    +0x0c4 CurrentLocale    : Uint4B
    3011. 

  3011. #    +0x0c8 FpSoftwareStatusRegister : Uint4B
    3012. 

  3012. #    +0x0cc SystemReserved1  : [54] Ptr32 Void
    3013. 

  3013. #    +0x1a4 ExceptionCode    : Int4B
    3014. 

  3014. #    +0x1a8 ActivationContextStackPointer : Ptr32 _ACTIVATION_CONTEXT_STACK
    3015. 

  3015. #    +0x1ac SpareBytes       : [36] UChar
    3016. 

  3016. #    +0x1d0 TxFsContext      : Uint4B
    3017. 

  3017. #    +0x1d4 GdiTebBatch      : _GDI_TEB_BATCH
    3018. 

  3018. #    +0x6b4 RealClientId     : _CLIENT_ID
    3019. 

  3019. #    +0x6bc GdiCachedProcessHandle : Ptr32 Void
    3020. 

  3020. #    +0x6c0 GdiClientPID     : Uint4B
    3021. 

  3021. #    +0x6c4 GdiClientTID     : Uint4B
    3022. 

  3022. #    +0x6c8 GdiThreadLocalInfo : Ptr32 Void
    3023. 

  3023. #    +0x6cc Win32ClientInfo  : [62] Uint4B
    3024. 

  3024. #    +0x7c4 glDispatchTable  : [233] Ptr32 Void
    3025. 

  3025. #    +0xb68 glReserved1      : [29] Uint4B
    3026. 

  3026. #    +0xbdc glReserved2      : Ptr32 Void
    3027. 

  3027. #    +0xbe0 glSectionInfo    : Ptr32 Void
    3028. 

  3028. #    +0xbe4 glSection        : Ptr32 Void
    3029. 

  3029. #    +0xbe8 glTable          : Ptr32 Void
    3030. 

  3030. #    +0xbec glCurrentRC      : Ptr32 Void
    3031. 

  3031. #    +0xbf0 glContext        : Ptr32 Void
    3032. 

  3032. #    +0xbf4 LastStatusValue  : Uint4B
    3033. 

  3033. #    +0xbf8 StaticUnicodeString : _UNICODE_STRING
    3034. 

  3034. #    +0xc00 StaticUnicodeBuffer : [261] Wchar
    3035. 

  3035. #    +0xe0c DeallocationStack : Ptr32 Void
    3036. 

  3036. #    +0xe10 TlsSlots         : [64] Ptr32 Void
    3037. 

  3037. #    +0xf10 TlsLinks         : _LIST_ENTRY
    3038. 

  3038. #    +0xf18 Vdm              : Ptr32 Void
    3039. 

  3039. #    +0xf1c ReservedForNtRpc : Ptr32 Void
    3040. 

  3040. #    +0xf20 DbgSsReserved    : [2] Ptr32 Void
    3041. 

  3041. #    +0xf28 HardErrorMode    : Uint4B
    3042. 

  3042. #    +0xf2c Instrumentation  : [9] Ptr32 Void
    3043. 

  3043. #    +0xf50 ActivityId       : _GUID
    3044. 

  3044. #    +0xf60 SubProcessTag    : Ptr32 Void
    3045. 

  3045. #    +0xf64 EtwLocalData     : Ptr32 Void
    3046. 

  3046. #    +0xf68 EtwTraceData     : Ptr32 Void
    3047. 

  3047. #    +0xf6c WinSockData      : Ptr32 Void
    3048. 

  3048. #    +0xf70 GdiBatchCount    : Uint4B
    3049. 

  3049. #    +0xf74 CurrentIdealProcessor : _PROCESSOR_NUMBER
    3050. 

  3050. #    +0xf74 IdealProcessorValue : Uint4B
    3051. 

  3051. #    +0xf74 ReservedPad0     : UChar
    3052. 

  3052. #    +0xf75 ReservedPad1     : UChar
    3053. 

  3053. #    +0xf76 ReservedPad2     : UChar
    3054. 

  3054. #    +0xf77 IdealProcessor   : UChar
    3055. 

  3055. #    +0xf78 GuaranteedStackBytes : Uint4B
    3056. 

  3056. #    +0xf7c ReservedForPerf  : Ptr32 Void
    3057. 

  3057. #    +0xf80 ReservedForOle   : Ptr32 Void
    3058. 

  3058. #    +0xf84 WaitingOnLoaderLock : Uint4B
    3059. 

  3059. #    +0xf88 SavedPriorityState : Ptr32 Void
    3060. 

  3060. #    +0xf8c SoftPatchPtr1    : Uint4B
    3061. 

  3061. #    +0xf90 ThreadPoolData   : Ptr32 Void
    3062. 

  3062. #    +0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void
    3063. 

  3063. #    +0xf98 MuiGeneration    : Uint4B
    3064. 

  3064. #    +0xf9c IsImpersonating  : Uint4B
    3065. 

  3065. #    +0xfa0 NlsCache         : Ptr32 Void
    3066. 

  3066. #    +0xfa4 pShimData        : Ptr32 Void
    3067. 

  3067. #    +0xfa8 HeapVirtualAffinity : Uint4B
    3068. 

  3068. #    +0xfac CurrentTransactionHandle : Ptr32 Void
    3069. 

  3069. #    +0xfb0 ActiveFrame      : Ptr32 _TEB_ACTIVE_FRAME
    3070. 

  3070. #    +0xfb4 FlsData          : Ptr32 Void
    3071. 

  3071. #    +0xfb8 PreferredLanguages : Ptr32 Void
    3072. 

  3072. #    +0xfbc UserPrefLanguages : Ptr32 Void
    3073. 

  3073. #    +0xfc0 MergedPrefLanguages : Ptr32 Void
    3074. 

  3074. #    +0xfc4 MuiImpersonation : Uint4B
    3075. 

  3075. #    +0xfc8 CrossTebFlags    : Uint2B
    3076. 

  3076. #    +0xfc8 SpareCrossTebBits : Pos 0, 16 Bits
    3077. 

  3077. #    +0xfca SameTebFlags     : Uint2B
    3078. 

  3078. #    +0xfca SafeThunkCall    : Pos 0, 1 Bit
    3079. 

  3079. #    +0xfca InDebugPrint     : Pos 1, 1 Bit
    3080. 

  3080. #    +0xfca HasFiberData     : Pos 2, 1 Bit
    3081. 

  3081. #    +0xfca SkipThreadAttach : Pos 3, 1 Bit
    3082. 

  3082. #    +0xfca WerInShipAssertCode : Pos 4, 1 Bit
    3083. 

  3083. #    +0xfca RanProcessInit   : Pos 5, 1 Bit
    3084. 

  3084. #    +0xfca ClonedThread     : Pos 6, 1 Bit
    3085. 

  3085. #    +0xfca SuppressDebugMsg : Pos 7, 1 Bit
    3086. 

  3086. #    +0xfca DisableUserStackWalk : Pos 8, 1 Bit
    3087. 

  3087. #    +0xfca RtlExceptionAttached : Pos 9, 1 Bit
    3088. 

  3088. #    +0xfca InitialThread    : Pos 10, 1 Bit
    3089. 

  3089. #    +0xfca SpareSameTebBits : Pos 11, 5 Bits
    3090. 

  3090. #    +0xfcc TxnScopeEnterCallback : Ptr32 Void
    3091. 

  3091. #    +0xfd0 TxnScopeExitCallback : Ptr32 Void
    3092. 

  3092. #    +0xfd4 TxnScopeContext  : Ptr32 Void
    3093. 

  3093. #    +0xfd8 LockCount        : Uint4B
    3094. 

  3094. #    +0xfdc SpareUlong0      : Uint4B
    3095. 

  3095. #    +0xfe0 ResourceRetValue : Ptr32 Void
    3096. 

  3096. class _TEB_2008_R2(Structure):
    3097. 

  3097.     _pack_ = 8
    3098. 

  3098.     _fields_ = [
    3099. 

  3099.         ("NtTib",                           NT_TIB),
    3100. 

  3100.         ("EnvironmentPointer",              PVOID),
    3101. 

  3101.         ("ClientId",                        CLIENT_ID),
    3102. 

  3102.         ("ActiveRpcHandle",                 HANDLE),
    3103. 

  3103.         ("ThreadLocalStoragePointer",       PVOID),
    3104. 

  3104.         ("ProcessEnvironmentBlock",         PVOID), # PPEB
    3105. 

  3105.         ("LastErrorValue",                  DWORD),
    3106. 

  3106.         ("CountOfOwnedCriticalSections",    DWORD),
    3107. 

  3107.         ("CsrClientThread",                 PVOID),
    3108. 

  3108.         ("Win32ThreadInfo",                 PVOID),
    3109. 

  3109.         ("User32Reserved",                  DWORD * 26),
    3110. 

  3110.         ("UserReserved",                    DWORD * 5),
    3111. 

  3111.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    3112. 

  3112.         ("CurrentLocale",                   DWORD),
    3113. 

  3113.         ("FpSoftwareStatusRegister",        DWORD),
    3114. 

  3114.         ("SystemReserved1",                 PVOID * 54),
    3115. 

  3115.         ("ExceptionCode",                   SDWORD),
    3116. 

  3116.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    3117. 

  3117.         ("SpareBytes",                      UCHAR * 36),
    3118. 

  3118.         ("TxFsContext",                     DWORD),
    3119. 

  3119.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    3120. 

  3120.         ("RealClientId",                    CLIENT_ID),
    3121. 

  3121.         ("GdiCachedProcessHandle",          HANDLE),
    3122. 

  3122.         ("GdiClientPID",                    DWORD),
    3123. 

  3123.         ("GdiClientTID",                    DWORD),
    3124. 

  3124.         ("GdiThreadLocalInfo",              PVOID),
    3125. 

  3125.         ("Win32ClientInfo",                 DWORD * 62),
    3126. 

  3126.         ("glDispatchTable",                 PVOID * 233),
    3127. 

  3127.         ("glReserved1",                     DWORD * 29),
    3128. 

  3128.         ("glReserved2",                     PVOID),
    3129. 

  3129.         ("glSectionInfo",                   PVOID),
    3130. 

  3130.         ("glSection",                       PVOID),
    3131. 

  3131.         ("glTable",                         PVOID),
    3132. 

  3132.         ("glCurrentRC",                     PVOID),
    3133. 

  3133.         ("glContext",                       PVOID),
    3134. 

  3134.         ("LastStatusValue",                 NTSTATUS),
    3135. 

  3135.         ("StaticUnicodeString",             UNICODE_STRING),
    3136. 

  3136.         ("StaticUnicodeBuffer",             WCHAR * 261),
    3137. 

  3137.         ("DeallocationStack",               PVOID),
    3138. 

  3138.         ("TlsSlots",                        PVOID * 64),
    3139. 

  3139.         ("TlsLinks",                        LIST_ENTRY),
    3140. 

  3140.         ("Vdm",                             PVOID),
    3141. 

  3141.         ("ReservedForNtRpc",                PVOID),
    3142. 

  3142.         ("DbgSsReserved",                   PVOID * 2),
    3143. 

  3143.         ("HardErrorMode",                   DWORD),
    3144. 

  3144.         ("Instrumentation",                 PVOID * 9),
    3145. 

  3145.         ("ActivityId",                      GUID),
    3146. 

  3146.         ("SubProcessTag",                   PVOID),
    3147. 

  3147.         ("EtwLocalData",                    PVOID),
    3148. 

  3148.         ("EtwTraceData",                    PVOID),
    3149. 

  3149.         ("WinSockData",                     PVOID),
    3150. 

  3150.         ("GdiBatchCount",                   DWORD),
    3151. 

  3151.         ("CurrentIdealProcessor",           PROCESSOR_NUMBER),
    3152. 

  3152.         ("IdealProcessorValue",             DWORD),
    3153. 

  3153.         ("ReservedPad0",                    UCHAR),
    3154. 

  3154.         ("ReservedPad1",                    UCHAR),
    3155. 

  3155.         ("ReservedPad2",                    UCHAR),
    3156. 

  3156.         ("IdealProcessor",                  UCHAR),
    3157. 

  3157.         ("GuaranteedStackBytes",            DWORD),
    3158. 

  3158.         ("ReservedForPerf",                 PVOID),
    3159. 

  3159.         ("ReservedForOle",                  PVOID),
    3160. 

  3160.         ("WaitingOnLoaderLock",             DWORD),
    3161. 

  3161.         ("SavedPriorityState",              PVOID),
    3162. 

  3162.         ("SoftPatchPtr1",                   PVOID),
    3163. 

  3163.         ("ThreadPoolData",                  PVOID),
    3164. 

  3164.         ("TlsExpansionSlots",               PVOID), # Ptr32 Ptr32 Void
    3165. 

  3165.         ("MuiGeneration",                   DWORD),
    3166. 

  3166.         ("IsImpersonating",                 BOOL),
    3167. 

  3167.         ("NlsCache",                        PVOID),
    3168. 

  3168.         ("pShimData",                       PVOID),
    3169. 

  3169.         ("HeapVirtualAffinity",             DWORD),
    3170. 

  3170.         ("CurrentTransactionHandle",        HANDLE),
    3171. 

  3171.         ("ActiveFrame",                     PVOID), # PTEB_ACTIVE_FRAME
    3172. 

  3172.         ("FlsData",                         PVOID),
    3173. 

  3173.         ("PreferredLanguages",              PVOID),
    3174. 

  3174.         ("UserPrefLanguages",               PVOID),
    3175. 

  3175.         ("MergedPrefLanguages",             PVOID),
    3176. 

  3176.         ("MuiImpersonation",                BOOL),
    3177. 

  3177.         ("CrossTebFlags",                   WORD),
    3178. 

  3178.         ("SameTebFlags",                    WORD),
    3179. 

  3179.         ("TxnScopeEnterCallback",           PVOID),
    3180. 

  3180.         ("TxnScopeExitCallback",            PVOID),
    3181. 

  3181.         ("TxnScopeContext",                 PVOID),
    3182. 

  3182.         ("LockCount",                       DWORD),
    3183. 

  3183.         ("SpareUlong0",                     ULONG),
    3184. 

  3184.         ("ResourceRetValue",                PVOID),
    3185. 

  3185. ]
    3186. 

  3186. 

  3187. #    +0x000 NtTib            : _NT_TIB
    3188. 

  3188. #    +0x038 EnvironmentPointer : Ptr64 Void
    3189. 

  3189. #    +0x040 ClientId         : _CLIENT_ID
    3190. 

  3190. #    +0x050 ActiveRpcHandle  : Ptr64 Void
    3191. 

  3191. #    +0x058 ThreadLocalStoragePointer : Ptr64 Void
    3192. 

  3192. #    +0x060 ProcessEnvironmentBlock : Ptr64 _PEB
    3193. 

  3193. #    +0x068 LastErrorValue   : Uint4B
    3194. 

  3194. #    +0x06c CountOfOwnedCriticalSections : Uint4B
    3195. 

  3195. #    +0x070 CsrClientThread  : Ptr64 Void
    3196. 

  3196. #    +0x078 Win32ThreadInfo  : Ptr64 Void
    3197. 

  3197. #    +0x080 User32Reserved   : [26] Uint4B
    3198. 

  3198. #    +0x0e8 UserReserved     : [5] Uint4B
    3199. 

  3199. #    +0x100 WOW32Reserved    : Ptr64 Void
    3200. 

  3200. #    +0x108 CurrentLocale    : Uint4B
    3201. 

  3201. #    +0x10c FpSoftwareStatusRegister : Uint4B
    3202. 

  3202. #    +0x110 SystemReserved1  : [54] Ptr64 Void
    3203. 

  3203. #    +0x2c0 ExceptionCode    : Int4B
    3204. 

  3204. #    +0x2c8 ActivationContextStackPointer : Ptr64 _ACTIVATION_CONTEXT_STACK
    3205. 

  3205. #    +0x2d0 SpareBytes       : [24] UChar
    3206. 

  3206. #    +0x2e8 TxFsContext      : Uint4B
    3207. 

  3207. #    +0x2f0 GdiTebBatch      : _GDI_TEB_BATCH
    3208. 

  3208. #    +0x7d8 RealClientId     : _CLIENT_ID
    3209. 

  3209. #    +0x7e8 GdiCachedProcessHandle : Ptr64 Void
    3210. 

  3210. #    +0x7f0 GdiClientPID     : Uint4B
    3211. 

  3211. #    +0x7f4 GdiClientTID     : Uint4B
    3212. 

  3212. #    +0x7f8 GdiThreadLocalInfo : Ptr64 Void
    3213. 

  3213. #    +0x800 Win32ClientInfo  : [62] Uint8B
    3214. 

  3214. #    +0x9f0 glDispatchTable  : [233] Ptr64 Void
    3215. 

  3215. #    +0x1138 glReserved1      : [29] Uint8B
    3216. 

  3216. #    +0x1220 glReserved2      : Ptr64 Void
    3217. 

  3217. #    +0x1228 glSectionInfo    : Ptr64 Void
    3218. 

  3218. #    +0x1230 glSection        : Ptr64 Void
    3219. 

  3219. #    +0x1238 glTable          : Ptr64 Void
    3220. 

  3220. #    +0x1240 glCurrentRC      : Ptr64 Void
    3221. 

  3221. #    +0x1248 glContext        : Ptr64 Void
    3222. 

  3222. #    +0x1250 LastStatusValue  : Uint4B
    3223. 

  3223. #    +0x1258 StaticUnicodeString : _UNICODE_STRING
    3224. 

  3224. #    +0x1268 StaticUnicodeBuffer : [261] Wchar
    3225. 

  3225. #    +0x1478 DeallocationStack : Ptr64 Void
    3226. 

  3226. #    +0x1480 TlsSlots         : [64] Ptr64 Void
    3227. 

  3227. #    +0x1680 TlsLinks         : _LIST_ENTRY
    3228. 

  3228. #    +0x1690 Vdm              : Ptr64 Void
    3229. 

  3229. #    +0x1698 ReservedForNtRpc : Ptr64 Void
    3230. 

  3230. #    +0x16a0 DbgSsReserved    : [2] Ptr64 Void
    3231. 

  3231. #    +0x16b0 HardErrorMode    : Uint4B
    3232. 

  3232. #    +0x16b8 Instrumentation  : [11] Ptr64 Void
    3233. 

  3233. #    +0x1710 ActivityId       : _GUID
    3234. 

  3234. #    +0x1720 SubProcessTag    : Ptr64 Void
    3235. 

  3235. #    +0x1728 EtwLocalData     : Ptr64 Void
    3236. 

  3236. #    +0x1730 EtwTraceData     : Ptr64 Void
    3237. 

  3237. #    +0x1738 WinSockData      : Ptr64 Void
    3238. 

  3238. #    +0x1740 GdiBatchCount    : Uint4B
    3239. 

  3239. #    +0x1744 CurrentIdealProcessor : _PROCESSOR_NUMBER
    3240. 

  3240. #    +0x1744 IdealProcessorValue : Uint4B
    3241. 

  3241. #    +0x1744 ReservedPad0     : UChar
    3242. 

  3242. #    +0x1745 ReservedPad1     : UChar
    3243. 

  3243. #    +0x1746 ReservedPad2     : UChar
    3244. 

  3244. #    +0x1747 IdealProcessor   : UChar
    3245. 

  3245. #    +0x1748 GuaranteedStackBytes : Uint4B
    3246. 

  3246. #    +0x1750 ReservedForPerf  : Ptr64 Void
    3247. 

  3247. #    +0x1758 ReservedForOle   : Ptr64 Void
    3248. 

  3248. #    +0x1760 WaitingOnLoaderLock : Uint4B
    3249. 

  3249. #    +0x1768 SavedPriorityState : Ptr64 Void
    3250. 

  3250. #    +0x1770 SoftPatchPtr1    : Uint8B
    3251. 

  3251. #    +0x1778 ThreadPoolData   : Ptr64 Void
    3252. 

  3252. #    +0x1780 TlsExpansionSlots : Ptr64 Ptr64 Void
    3253. 

  3253. #    +0x1788 DeallocationBStore : Ptr64 Void
    3254. 

  3254. #    +0x1790 BStoreLimit      : Ptr64 Void
    3255. 

  3255. #    +0x1798 MuiGeneration    : Uint4B
    3256. 

  3256. #    +0x179c IsImpersonating  : Uint4B
    3257. 

  3257. #    +0x17a0 NlsCache         : Ptr64 Void
    3258. 

  3258. #    +0x17a8 pShimData        : Ptr64 Void
    3259. 

  3259. #    +0x17b0 HeapVirtualAffinity : Uint4B
    3260. 

  3260. #    +0x17b8 CurrentTransactionHandle : Ptr64 Void
    3261. 

  3261. #    +0x17c0 ActiveFrame      : Ptr64 _TEB_ACTIVE_FRAME
    3262. 

  3262. #    +0x17c8 FlsData          : Ptr64 Void
    3263. 

  3263. #    +0x17d0 PreferredLanguages : Ptr64 Void
    3264. 

  3264. #    +0x17d8 UserPrefLanguages : Ptr64 Void
    3265. 

  3265. #    +0x17e0 MergedPrefLanguages : Ptr64 Void
    3266. 

  3266. #    +0x17e8 MuiImpersonation : Uint4B
    3267. 

  3267. #    +0x17ec CrossTebFlags    : Uint2B
    3268. 

  3268. #    +0x17ec SpareCrossTebBits : Pos 0, 16 Bits
    3269. 

  3269. #    +0x17ee SameTebFlags     : Uint2B
    3270. 

  3270. #    +0x17ee SafeThunkCall    : Pos 0, 1 Bit
    3271. 

  3271. #    +0x17ee InDebugPrint     : Pos 1, 1 Bit
    3272. 

  3272. #    +0x17ee HasFiberData     : Pos 2, 1 Bit
    3273. 

  3273. #    +0x17ee SkipThreadAttach : Pos 3, 1 Bit
    3274. 

  3274. #    +0x17ee WerInShipAssertCode : Pos 4, 1 Bit
    3275. 

  3275. #    +0x17ee RanProcessInit   : Pos 5, 1 Bit
    3276. 

  3276. #    +0x17ee ClonedThread     : Pos 6, 1 Bit
    3277. 

  3277. #    +0x17ee SuppressDebugMsg : Pos 7, 1 Bit
    3278. 

  3278. #    +0x17ee DisableUserStackWalk : Pos 8, 1 Bit
    3279. 

  3279. #    +0x17ee RtlExceptionAttached : Pos 9, 1 Bit
    3280. 

  3280. #    +0x17ee InitialThread    : Pos 10, 1 Bit
    3281. 

  3281. #    +0x17ee SpareSameTebBits : Pos 11, 5 Bits
    3282. 

  3282. #    +0x17f0 TxnScopeEnterCallback : Ptr64 Void
    3283. 

  3283. #    +0x17f8 TxnScopeExitCallback : Ptr64 Void
    3284. 

  3284. #    +0x1800 TxnScopeContext  : Ptr64 Void
    3285. 

  3285. #    +0x1808 LockCount        : Uint4B
    3286. 

  3286. #    +0x180c SpareUlong0      : Uint4B
    3287. 

  3287. #    +0x1810 ResourceRetValue : Ptr64 Void
    3288. 

  3288. class _TEB_2008_R2_64(Structure):
    3289. 

  3289.     _pack_ = 8
    3290. 

  3290.     _fields_ = [
    3291. 

  3291.         ("NtTib",                           NT_TIB),
    3292. 

  3292.         ("EnvironmentPointer",              PVOID),
    3293. 

  3293.         ("ClientId",                        CLIENT_ID),
    3294. 

  3294.         ("ActiveRpcHandle",                 HANDLE),
    3295. 

  3295.         ("ThreadLocalStoragePointer",       PVOID),
    3296. 

  3296.         ("ProcessEnvironmentBlock",         PVOID), # PPEB
    3297. 

  3297.         ("LastErrorValue",                  DWORD),
    3298. 

  3298.         ("CountOfOwnedCriticalSections",    DWORD),
    3299. 

  3299.         ("CsrClientThread",                 PVOID),
    3300. 

  3300.         ("Win32ThreadInfo",                 PVOID),
    3301. 

  3301.         ("User32Reserved",                  DWORD * 26),
    3302. 

  3302.         ("UserReserved",                    DWORD * 5),
    3303. 

  3303.         ("WOW32Reserved",                   PVOID), # ptr to wow64cpu!X86SwitchTo64BitMode
    3304. 

  3304.         ("CurrentLocale",                   DWORD),
    3305. 

  3305.         ("FpSoftwareStatusRegister",        DWORD),
    3306. 

  3306.         ("SystemReserved1",                 PVOID * 54),
    3307. 

  3307.         ("ExceptionCode",                   SDWORD),
    3308. 

  3308.         ("ActivationContextStackPointer",   PVOID), # PACTIVATION_CONTEXT_STACK
    3309. 

  3309.         ("SpareBytes",                      UCHAR * 24),
    3310. 

  3310.         ("TxFsContext",                     DWORD),
    3311. 

  3311.         ("GdiTebBatch",                     GDI_TEB_BATCH),
    3312. 

  3312.         ("RealClientId",                    CLIENT_ID),
    3313. 

  3313.         ("GdiCachedProcessHandle",          HANDLE),
    3314. 

  3314.         ("GdiClientPID",                    DWORD),
    3315. 

  3315.         ("GdiClientTID",                    DWORD),
    3316. 

  3316.         ("GdiThreadLocalInfo",              PVOID),
    3317. 

  3317.         ("Win32ClientInfo",                 DWORD * 62),
    3318. 

  3318.         ("glDispatchTable",                 PVOID * 233),
    3319. 

  3319.         ("glReserved1",                     QWORD * 29),
    3320. 

  3320.         ("glReserved2",                     PVOID),
    3321. 

  3321.         ("glSectionInfo",                   PVOID),
    3322. 

  3322.         ("glSection",                       PVOID),
    3323. 

  3323.         ("glTable",                         PVOID),
    3324. 

  3324.         ("glCurrentRC",                     PVOID),
    3325. 

  3325.         ("glContext",                       PVOID),
    3326. 

  3326.         ("LastStatusValue",                 NTSTATUS),
    3327. 

  3327.         ("StaticUnicodeString",             UNICODE_STRING),
    3328. 

  3328.         ("StaticUnicodeBuffer",             WCHAR * 261),
    3329. 

  3329.         ("DeallocationStack",               PVOID),
    3330. 

  3330.         ("TlsSlots",                        PVOID * 64),
    3331. 

  3331.         ("TlsLinks",                        LIST_ENTRY),
    3332. 

  3332.         ("Vdm",                             PVOID),
    3333. 

  3333.         ("ReservedForNtRpc",                PVOID),
    3334. 

  3334.         ("DbgSsReserved",                   PVOID * 2),
    3335. 

  3335.         ("HardErrorMode",                   DWORD),
    3336. 

  3336.         ("Instrumentation",                 PVOID * 11),
    3337. 

  3337.         ("ActivityId",                      GUID),
    3338. 

  3338.         ("SubProcessTag",                   PVOID),
    3339. 

  3339.         ("EtwLocalData",                    PVOID),
    3340. 

  3340.         ("EtwTraceData",                    PVOID),
    3341. 

  3341.         ("WinSockData",                     PVOID),
    3342. 

  3342.         ("GdiBatchCount",                   DWORD),
    3343. 

  3343.         ("CurrentIdealProcessor",           PROCESSOR_NUMBER),
    3344. 

  3344.         ("IdealProcessorValue",             DWORD),
    3345. 

  3345.         ("ReservedPad0",                    UCHAR),
    3346. 

  3346.         ("ReservedPad1",                    UCHAR),
    3347. 

  3347.         ("ReservedPad2",                    UCHAR),
    3348. 

  3348.         ("IdealProcessor",                  UCHAR),
    3349. 

  3349.         ("GuaranteedStackBytes",            DWORD),
    3350. 

  3350.         ("ReservedForPerf",                 PVOID),
    3351. 

  3351.         ("ReservedForOle",                  PVOID),
    3352. 

  3352.         ("WaitingOnLoaderLock",             DWORD),
    3353. 

  3353.         ("SavedPriorityState",              PVOID),
    3354. 

  3354.         ("SoftPatchPtr1",                   PVOID),
    3355. 

  3355.         ("ThreadPoolData",                  PVOID),
    3356. 

  3356.         ("TlsExpansionSlots",               PVOID), # Ptr64 Ptr64 Void
    3357. 

  3357.         ("DeallocationBStore",              PVOID),
    3358. 

  3358.         ("BStoreLimit",                     PVOID),
    3359. 

  3359.         ("MuiGeneration",                   DWORD),
    3360. 

  3360.         ("IsImpersonating",                 BOOL),
    3361. 

  3361.         ("NlsCache",                        PVOID),
    3362. 

  3362.         ("pShimData",                       PVOID),
    3363. 

  3363.         ("HeapVirtualAffinity",             DWORD),
    3364. 

  3364.         ("CurrentTransactionHandle",        HANDLE),
    3365. 

  3365.         ("ActiveFrame",                     PVOID), # PTEB_ACTIVE_FRAME
    3366. 

  3366.         ("FlsData",                         PVOID),
    3367. 

  3367.         ("PreferredLanguages",              PVOID),
    3368. 

  3368.         ("UserPrefLanguages",               PVOID),
    3369. 

  3369.         ("MergedPrefLanguages",             PVOID),
    3370. 

  3370.         ("MuiImpersonation",                BOOL),
    3371. 

  3371.         ("CrossTebFlags",                   WORD),
    3372. 

  3372.         ("SameTebFlags",                    WORD),
    3373. 

  3373.         ("TxnScopeEnterCallback",           PVOID),
    3374. 

  3374.         ("TxnScopeExitCallback",            PVOID),
    3375. 

  3375.         ("TxnScopeContext",                 PVOID),
    3376. 

  3376.         ("LockCount",                       DWORD),
    3377. 

  3377.         ("SpareUlong0",                     ULONG),
    3378. 

  3378.         ("ResourceRetValue",                PVOID),
    3379. 

  3379. ]
    3380. 

  3380. 

  3381. _TEB_Vista      = _TEB_2008
    3382. 

  3382. _TEB_Vista_64   = _TEB_2008_64
    3383. 

  3383. _TEB_W7         = _TEB_2008_R2
    3384. 

  3384. _TEB_W7_64      = _TEB_2008_R2_64
    3385. 

  3385. 

  3386. # Use the correct TEB structure definition.
    3387. 

  3387. # Defaults to the latest Windows version.
    3388. 

  3388. class TEB(Structure):
    3389. 

  3389.     _pack_ = 8
    3390. 

  3390.     if os == 'Windows NT':
    3391. 

  3391.         _pack_   = _TEB_NT._pack_
    3392. 

  3392.         _fields_ = _TEB_NT._fields_
    3393. 

  3393.     elif os == 'Windows 2000':
    3394. 

  3394.         _pack_   = _TEB_2000._pack_
    3395. 

  3395.         _fields_ = _TEB_2000._fields_
    3396. 

  3396.     elif os == 'Windows XP':
    3397. 

  3397.         _fields_ = _TEB_XP._fields_
    3398. 

  3398.     elif os == 'Windows XP (64 bits)':
    3399. 

  3399.         _fields_ = _TEB_XP_64._fields_
    3400. 

  3400.     elif os == 'Windows 2003':
    3401. 

  3401.         _fields_ = _TEB_2003._fields_
    3402. 

  3402.     elif os == 'Windows 2003 (64 bits)':
    3403. 

  3403.         _fields_ = _TEB_2003_64._fields_
    3404. 

  3404.     elif os == 'Windows 2008':
    3405. 

  3405.         _fields_ = _TEB_2008._fields_
    3406. 

  3406.     elif os == 'Windows 2008 (64 bits)':
    3407. 

  3407.         _fields_ = _TEB_2008_64._fields_
    3408. 

  3408.     elif os == 'Windows 2003 R2':
    3409. 

  3409.         _fields_ = _TEB_2003_R2._fields_
    3410. 

  3410.     elif os == 'Windows 2003 R2 (64 bits)':
    3411. 

  3411.         _fields_ = _TEB_2003_R2_64._fields_
    3412. 

  3412.     elif os == 'Windows 2008 R2':
    3413. 

  3413.         _fields_ = _TEB_2008_R2._fields_
    3414. 

  3414.     elif os == 'Windows 2008 R2 (64 bits)':
    3415. 

  3415.         _fields_ = _TEB_2008_R2_64._fields_
    3416. 

  3416.     elif os == 'Windows Vista':
    3417. 

  3417.         _fields_ = _TEB_Vista._fields_
    3418. 

  3418.     elif os == 'Windows Vista (64 bits)':
    3419. 

  3419.         _fields_ = _TEB_Vista_64._fields_
    3420. 

  3420.     elif os == 'Windows 7':
    3421. 

  3421.         _fields_ = _TEB_W7._fields_
    3422. 

  3422.     elif os == 'Windows 7 (64 bits)':
    3423. 

  3423.         _fields_ = _TEB_W7_64._fields_
    3424. 

  3424.     elif sizeof(SIZE_T) == sizeof(DWORD):
    3425. 

  3425.         _fields_ = _TEB_W7._fields_
    3426. 

  3426.     else:
    3427. 

  3427.         _fields_ = _TEB_W7_64._fields_
    3428. 

  3428. PTEB = POINTER(TEB)
    3429. 

  3429. 

  3430. #==============================================================================
    3431. 

  3431. # This calculates the list of exported symbols.
    3432. 

  3432. _all = set(vars().keys()).difference(_all)
    3433. 

  3433. __all__ = [_x for _x in _all if not _x.startswith('_')]
    3434. 

  3434. __all__.sort()
    3435. 

  3435. #==============================================================================
    3436. 

  3436.