_PEB64

//0x388 bytes (sizeof) struct _PEB64 { UCHAR InheritedAddressSpace; //0x0 UCHAR ReadImageFileExecOptions; //0x1 UCHAR BeingDebugged; //0x2 union { UCHAR BitField; //0x3 struct { UCHAR ImageUsesLargePages:1; //0x3 UCHAR IsProtectedProcess:1; //0x3 UCHAR IsImageDynamicallyRelocated:1; //0x3 UCHAR SkipPatchingUser32Forwarders:1; //0x3 UCHAR IsPackagedProcess:1; //0x3 UCHAR IsAppContainer:1; //0x3 UCHAR IsProtectedProcessLight:1; //0x3 UCHAR SpareBits:1; //0x3 }; }; UCHAR Padding0[4]; //0x4 ULONGLONG Mutant; //0x8 ULONGLONG ImageBaseAddress; //0x10 ULONGLONG Ldr; //0x18 ULONGLONG ProcessParameters; //0x20 ULONGLONG SubSystemData; //0x28 ULONGLONG ProcessHeap; //0x30 ULONGLONG FastPebLock; //0x38 ULONGLONG AtlThunkSListPtr; //0x40 ULONGLONG IFEOKey; //0x48 union { ULONG CrossProcessFlags; //0x50 struct { ULONG ProcessInJob:1; //0x50 ULONG ProcessInitializing:1; //0x50 ULONG ProcessUsingVEH:1; //0x50 ULONG ProcessUsingVCH:1; //0x50 ULONG ProcessUsingFTH:1; //0x50 ULONG ReservedBits0:27; //0x50 }; }; UCHAR Padding1[4]; //0x54 union { ULONGLONG KernelCallbackTable; //0x58 ULONGLONG UserSharedInfoPtr; //0x58 }; ULONG SystemReserved[1]; //0x60 ULONG AtlThunkSListPtr32; //0x64 ULONGLONG ApiSetMap; //0x68 ULONG TlsExpansionCounter; //0x70 UCHAR Padding2[4]; //0x74 ULONGLONG TlsBitmap; //0x78 ULONG TlsBitmapBits[2]; //0x80 ULONGLONG ReadOnlySharedMemoryBase; //0x88 ULONGLONG SparePvoid0; //0x90 ULONGLONG ReadOnlyStaticServerData; //0x98 ULONGLONG AnsiCodePageData; //0xa0 ULONGLONG OemCodePageData; //0xa8 ULONGLONG UnicodeCaseTableData; //0xb0 ULONG NumberOfProcessors; //0xb8 ULONG NtGlobalFlag; //0xbc union _LARGE_INTEGER CriticalSectionTimeout; //0xc0 ULONGLONG HeapSegmentReserve; //0xc8 ULONGLONG HeapSegmentCommit; //0xd0 ULONGLONG HeapDeCommitTotalFreeThreshold; //0xd8 ULONGLONG HeapDeCommitFreeBlockThreshold; //0xe0 ULONG NumberOfHeaps; //0xe8 ULONG MaximumNumberOfHeaps; //0xec ULONGLONG ProcessHeaps; //0xf0 ULONGLONG GdiSharedHandleTable; //0xf8 ULONGLONG ProcessStarterHelper; //0x100 ULONG GdiDCAttributeList; //0x108 UCHAR Padding3[4]; //0x10c ULONGLONG LoaderLock; //0x110 ULONG OSMajorVersion; //0x118 ULONG OSMinorVersion; //0x11c USHORT OSBuildNumber; //0x120 USHORT OSCSDVersion; //0x122 ULONG OSPlatformId; //0x124 ULONG ImageSubsystem; //0x128 ULONG ImageSubsystemMajorVersion; //0x12c ULONG ImageSubsystemMinorVersion; //0x130 UCHAR Padding4[4]; //0x134 ULONGLONG ActiveProcessAffinityMask; //0x138 ULONG GdiHandleBuffer[60]; //0x140 ULONGLONG PostProcessInitRoutine; //0x230 ULONGLONG TlsExpansionBitmap; //0x238 ULONG TlsExpansionBitmapBits[32]; //0x240 ULONG SessionId; //0x2c0 UCHAR Padding5[4]; //0x2c4 union _ULARGE_INTEGER AppCompatFlags; //0x2c8 union _ULARGE_INTEGER AppCompatFlagsUser; //0x2d0 ULONGLONG pShimData; //0x2d8 ULONGLONG AppCompatInfo; //0x2e0 struct _STRING64 CSDVersion; //0x2e8 ULONGLONG ActivationContextData; //0x2f8 ULONGLONG ProcessAssemblyStorageMap; //0x300 ULONGLONG SystemDefaultActivationContextData; //0x308 ULONGLONG SystemAssemblyStorageMap; //0x310 ULONGLONG MinimumStackCommit; //0x318 ULONGLONG FlsCallback; //0x320 struct LIST_ENTRY64 FlsListHead; //0x328 ULONGLONG FlsBitmap; //0x338 ULONG FlsBitmapBits[4]; //0x340 ULONG FlsHighIndex; //0x350 ULONGLONG WerRegistrationData; //0x358 ULONGLONG WerShipAssertPtr; //0x360 ULONGLONG pUnused; //0x368 ULONGLONG pImageHeaderHash; //0x370 union { ULONG TracingFlags; //0x378 struct { ULONG HeapTracingEnabled:1; //0x378 ULONG CritSecTracingEnabled:1; //0x378 ULONG LibLoaderTracingEnabled:1; //0x378 ULONG SpareTracingBits:29; //0x378 }; }; UCHAR Padding6[4]; //0x37c ULONGLONG CsrServerReadOnlySharedMemoryBase; //0x380 };