//0x368 bytes (sizeof)
struct _PEB64
{
UCHAR InheritedAddressSpace; //0x0
UCHAR ReadImageFileExecOptions; //0x1
UCHAR BeingDebugged; //0x2
union
{
UCHAR BitField; //0x3
struct
{
UCHAR ImageUsesLargePages:1; //0x3
UCHAR IsProtectedProcess:1; //0x3
UCHAR IsLegacyProcess:1; //0x3
UCHAR IsImageDynamicallyRelocated:1; //0x3
UCHAR SkipPatchingUser32Forwarders:1; //0x3
UCHAR SpareBits:3; //0x3
};
};
ULONGLONG Mutant; //0x8
ULONGLONG ImageBaseAddress; //0x10
ULONGLONG Ldr; //0x18
ULONGLONG ProcessParameters; //0x20
ULONGLONG SubSystemData; //0x28
ULONGLONG ProcessHeap; //0x30
ULONGLONG FastPebLock; //0x38
ULONGLONG AtlThunkSListPtr; //0x40
ULONGLONG IFEOKey; //0x48
union
{
ULONG CrossProcessFlags; //0x50
struct
{
ULONG ProcessInJob:1; //0x50
ULONG ProcessInitializing:1; //0x50
ULONG ProcessUsingVEH:1; //0x50
ULONG ProcessUsingVCH:1; //0x50
ULONG ReservedBits0:28; //0x50
};
};
union
{
ULONGLONG KernelCallbackTable; //0x58
ULONGLONG UserSharedInfoPtr; //0x58
};
ULONG SystemReserved[1]; //0x60
ULONG SpareUlong; //0x64
ULONGLONG SparePebPtr0; //0x68
ULONG TlsExpansionCounter; //0x70
ULONGLONG TlsBitmap; //0x78
ULONG TlsBitmapBits[2]; //0x80
ULONGLONG ReadOnlySharedMemoryBase; //0x88
ULONGLONG HotpatchInformation; //0x90
ULONGLONG ReadOnlyStaticServerData; //0x98
ULONGLONG AnsiCodePageData; //0xa0
ULONGLONG OemCodePageData; //0xa8
ULONGLONG UnicodeCaseTableData; //0xb0
ULONG NumberOfProcessors; //0xb8
ULONG NtGlobalFlag; //0xbc
union _LARGE_INTEGER CriticalSectionTimeout; //0xc0
ULONGLONG HeapSegmentReserve; //0xc8
ULONGLONG HeapSegmentCommit; //0xd0
ULONGLONG HeapDeCommitTotalFreeThreshold; //0xd8
ULONGLONG HeapDeCommitFreeBlockThreshold; //0xe0
ULONG NumberOfHeaps; //0xe8
ULONG MaximumNumberOfHeaps; //0xec
ULONGLONG ProcessHeaps; //0xf0
ULONGLONG GdiSharedHandleTable; //0xf8
ULONGLONG ProcessStarterHelper; //0x100
ULONG GdiDCAttributeList; //0x108
ULONGLONG LoaderLock; //0x110
ULONG OSMajorVersion; //0x118
ULONG OSMinorVersion; //0x11c
USHORT OSBuildNumber; //0x120
USHORT OSCSDVersion; //0x122
ULONG OSPlatformId; //0x124
ULONG ImageSubsystem; //0x128
ULONG ImageSubsystemMajorVersion; //0x12c
ULONG ImageSubsystemMinorVersion; //0x130
ULONGLONG ActiveProcessAffinityMask; //0x138
ULONG GdiHandleBuffer[60]; //0x140
ULONGLONG PostProcessInitRoutine; //0x230
ULONGLONG TlsExpansionBitmap; //0x238
ULONG TlsExpansionBitmapBits[32]; //0x240
ULONG SessionId; //0x2c0
union _ULARGE_INTEGER AppCompatFlags; //0x2c8
union _ULARGE_INTEGER AppCompatFlagsUser; //0x2d0
ULONGLONG pShimData; //0x2d8
ULONGLONG AppCompatInfo; //0x2e0
struct _STRING64 CSDVersion; //0x2e8
ULONGLONG ActivationContextData; //0x2f8
ULONGLONG ProcessAssemblyStorageMap; //0x300
ULONGLONG SystemDefaultActivationContextData; //0x308
ULONGLONG SystemAssemblyStorageMap; //0x310
ULONGLONG MinimumStackCommit; //0x318
ULONGLONG FlsCallback; //0x320
struct LIST_ENTRY64 FlsListHead; //0x328
ULONGLONG FlsBitmap; //0x338
ULONG FlsBitmapBits[4]; //0x340
ULONG FlsHighIndex; //0x350
ULONGLONG WerRegistrationData; //0x358
ULONGLONG WerShipAssertPtr; //0x360
};