_PEB32

//0x488 bytes (sizeof) struct _PEB32 { UCHAR InheritedAddressSpace; //0x0 UCHAR ReadImageFileExecOptions; //0x1 UCHAR BeingDebugged; //0x2 union { UCHAR BitField; //0x3 struct { UCHAR ImageUsesLargePages:1; //0x3 UCHAR IsProtectedProcess:1; //0x3 UCHAR IsImageDynamicallyRelocated:1; //0x3 UCHAR SkipPatchingUser32Forwarders:1; //0x3 UCHAR IsPackagedProcess:1; //0x3 UCHAR IsAppContainer:1; //0x3 UCHAR IsProtectedProcessLight:1; //0x3 UCHAR IsLongPathAwareProcess:1; //0x3 }; }; ULONG Mutant; //0x4 ULONG ImageBaseAddress; //0x8 ULONG Ldr; //0xc ULONG ProcessParameters; //0x10 ULONG SubSystemData; //0x14 ULONG ProcessHeap; //0x18 ULONG FastPebLock; //0x1c ULONG AtlThunkSListPtr; //0x20 ULONG IFEOKey; //0x24 union { ULONG CrossProcessFlags; //0x28 struct { ULONG ProcessInJob:1; //0x28 ULONG ProcessInitializing:1; //0x28 ULONG ProcessUsingVEH:1; //0x28 ULONG ProcessUsingVCH:1; //0x28 ULONG ProcessUsingFTH:1; //0x28 ULONG ProcessPreviouslyThrottled:1; //0x28 ULONG ProcessCurrentlyThrottled:1; //0x28 ULONG ProcessImagesHotPatched:1; //0x28 ULONG ReservedBits0:24; //0x28 }; }; union { ULONG KernelCallbackTable; //0x2c ULONG UserSharedInfoPtr; //0x2c }; ULONG SystemReserved; //0x30 ULONG AtlThunkSListPtr32; //0x34 ULONG ApiSetMap; //0x38 ULONG TlsExpansionCounter; //0x3c ULONG TlsBitmap; //0x40 ULONG TlsBitmapBits[2]; //0x44 ULONG ReadOnlySharedMemoryBase; //0x4c ULONG SharedData; //0x50 ULONG ReadOnlyStaticServerData; //0x54 ULONG AnsiCodePageData; //0x58 ULONG OemCodePageData; //0x5c ULONG UnicodeCaseTableData; //0x60 ULONG NumberOfProcessors; //0x64 ULONG NtGlobalFlag; //0x68 union _LARGE_INTEGER CriticalSectionTimeout; //0x70 ULONG HeapSegmentReserve; //0x78 ULONG HeapSegmentCommit; //0x7c ULONG HeapDeCommitTotalFreeThreshold; //0x80 ULONG HeapDeCommitFreeBlockThreshold; //0x84 ULONG NumberOfHeaps; //0x88 ULONG MaximumNumberOfHeaps; //0x8c ULONG ProcessHeaps; //0x90 ULONG GdiSharedHandleTable; //0x94 ULONG ProcessStarterHelper; //0x98 ULONG GdiDCAttributeList; //0x9c ULONG LoaderLock; //0xa0 ULONG OSMajorVersion; //0xa4 ULONG OSMinorVersion; //0xa8 USHORT OSBuildNumber; //0xac USHORT OSCSDVersion; //0xae ULONG OSPlatformId; //0xb0 ULONG ImageSubsystem; //0xb4 ULONG ImageSubsystemMajorVersion; //0xb8 ULONG ImageSubsystemMinorVersion; //0xbc ULONG ActiveProcessAffinityMask; //0xc0 ULONG GdiHandleBuffer[34]; //0xc4 ULONG PostProcessInitRoutine; //0x14c ULONG TlsExpansionBitmap; //0x150 ULONG TlsExpansionBitmapBits[32]; //0x154 ULONG SessionId; //0x1d4 union _ULARGE_INTEGER AppCompatFlags; //0x1d8 union _ULARGE_INTEGER AppCompatFlagsUser; //0x1e0 ULONG pShimData; //0x1e8 ULONG AppCompatInfo; //0x1ec struct _STRING32 CSDVersion; //0x1f0 ULONG ActivationContextData; //0x1f8 ULONG ProcessAssemblyStorageMap; //0x1fc ULONG SystemDefaultActivationContextData; //0x200 ULONG SystemAssemblyStorageMap; //0x204 ULONG MinimumStackCommit; //0x208 ULONG SparePointers[2]; //0x20c ULONG PatchLoaderData; //0x214 ULONG ChpeV2ProcessInfo; //0x218 ULONG AppModelFeatureState; //0x21c ULONG SpareUlongs[2]; //0x220 USHORT ActiveCodePage; //0x228 USHORT OemCodePage; //0x22a USHORT UseCaseMapping; //0x22c USHORT UnusedNlsField; //0x22e ULONG WerRegistrationData; //0x230 ULONG WerShipAssertPtr; //0x234 ULONG Spare; //0x238 ULONG pImageHeaderHash; //0x23c union { ULONG TracingFlags; //0x240 struct { ULONG HeapTracingEnabled:1; //0x240 ULONG CritSecTracingEnabled:1; //0x240 ULONG LibLoaderTracingEnabled:1; //0x240 ULONG SpareTracingBits:29; //0x240 }; }; ULONGLONG CsrServerReadOnlySharedMemoryBase; //0x248 ULONG TppWorkerpListLock; //0x250 struct LIST_ENTRY32 TppWorkerpList; //0x254 ULONG WaitOnAddressHashTable[128]; //0x25c ULONG TelemetryCoverageHeader; //0x45c ULONG CloudFileFlags; //0x460 ULONG CloudFileDiagFlags; //0x464 CHAR PlaceholderCompatibilityMode; //0x468 CHAR PlaceholderCompatibilityModeReserved[7]; //0x469 ULONG LeapSecondData; //0x470 union { ULONG LeapSecondFlags; //0x474 struct { ULONG SixtySecondEnabled:1; //0x474 ULONG Reserved:31; //0x474 }; }; ULONG NtGlobalFlag2; //0x478 ULONGLONG ExtendedFeatureDisableMask; //0x480 };