x86 x64 下PEB结构

x64 下的calc

+0x000 InheritedAddressSpace : 0 '' +0x001 ReadImageFileExecOptions : 0 '' +0x002 BeingDebugged : 0x1 '' +0x003 BitField : 0x8 '' +0x003 ImageUsesLargePages : 0y0 +0x003 IsProtectedProcess : 0y0 +0x003 IsLegacyProcess : 0y0 +0x003 IsImageDynamicallyRelocated : 0y1 +0x003 SkipPatchingUser32Forwarders : 0y0 +0x003 SpareBits : 0y000 +0x008 Mutant : 0xffffffff`ffffffff Void +0x010 ImageBaseAddress : 0x00000000`ff6a0000 Void +0x018 Ldr : 0x00000000`77012640 _PEB_LDR_DATA +0x020 ProcessParameters : 0x00000000`00351e90 _RTL_USER_PROCESS_PARAMETERS +0x028 SubSystemData : (null) +0x030 ProcessHeap : 0x00000000`00350000 Void +0x038 FastPebLock : 0x00000000`7701a900 _RTL_CRITICAL_SECTION +0x040 AtlThunkSListPtr : (null) +0x048 IFEOKey : (null) +0x050 CrossProcessFlags : 0 +0x050 ProcessInJob : 0y0 +0x050 ProcessInitializing : 0y0 +0x050 ProcessUsingVEH : 0y0 +0x050 ProcessUsingVCH : 0y0 +0x050 ProcessUsingFTH : 0y0 +0x050 ReservedBits0 : 0y000000000000000000000000000 (0) +0x058 KernelCallbackTable : 0x00000000`76e69500 Void +0x058 UserSharedInfoPtr : 0x00000000`76e69500 Void +0x060 SystemReserved : [1] 0 +0x064 AtlThunkSListPtr32 : 0 +0x068 ApiSetMap : 0x000007fe`ff200000 Void +0x070 TlsExpansionCounter : 0 +0x078 TlsBitmap : 0x00000000`77012590 Void +0x080 TlsBitmapBits : [2] 0x1ffffff +0x088 ReadOnlySharedMemoryBase : 0x00000000`7efe0000 Void +0x090 HotpatchInformation : (null) +0x098 ReadOnlyStaticServerData : 0x00000000`7efe0a90 -> (null) +0x0a0 AnsiCodePageData : 0x000007ff`fffb0000 Void +0x0a8 OemCodePageData : 0x000007ff`fffc0228 Void +0x0b0 UnicodeCaseTableData : 0x000007ff`fffd0650 Void +0x0b8 NumberOfProcessors : 2 +0x0bc NtGlobalFlag : 0 +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER 0xffffe86d`079b8000 +0x0c8 HeapSegmentReserve : 0x100000 +0x0d0 HeapSegmentCommit : 0x2000 +0x0d8 HeapDeCommitTotalFreeThreshold : 0x10000 +0x0e0 HeapDeCommitFreeBlockThreshold : 0x1000 +0x0e8 NumberOfHeaps : 6 +0x0ec MaximumNumberOfHeaps : 0x10 +0x0f0 ProcessHeaps : 0x00000000`7701a6c0 -> 0x00000000`00350000 Void +0x0f8 GdiSharedHandleTable : 0x00000000`005e0000 Void +0x100 ProcessStarterHelper : (null) +0x108 GdiDCAttributeList : 0x14 +0x110 LoaderLock : 0x00000000`77017490 _RTL_CRITICAL_SECTION +0x118 OSMajorVersion : 6 +0x11c OSMinorVersion : 1 +0x120 OSBuildNumber : 0x1db1 +0x122 OSCSDVersion : 0x100 +0x124 OSPlatformId : 2 +0x128 ImageSubsystem : 2 +0x12c ImageSubsystemMajorVersion : 6 +0x130 ImageSubsystemMinorVersion : 1 +0x138 ActiveProcessAffinityMask : 3 +0x140 GdiHandleBuffer : [60] 0 +0x230 PostProcessInitRoutine : (null) +0x238 TlsExpansionBitmap : 0x00000000`77012580 Void +0x240 TlsExpansionBitmapBits : [32] 1 +0x2c0 SessionId : 1 +0x2c8 AppCompatFlags : _ULARGE_INTEGER 0x0 +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER 0x0 +0x2d8 pShimData : (null) +0x2e0 AppCompatInfo : (null) +0x2e8 CSDVersion : _UNICODE_STRING "Service Pack 1" +0x2f8 ActivationContextData : 0x00000000`00040000 _ACTIVATION_CONTEXT_DATA +0x300 ProcessAssemblyStorageMap : 0x00000000`00377f60 _ASSEMBLY_STORAGE_MAP +0x308 SystemDefaultActivationContextData : 0x00000000`00030000 _ACTIVATION_CONTEXT_DATA +0x310 SystemAssemblyStorageMap : 0x00000000`00377020 _ASSEMBLY_STORAGE_MAP +0x318 MinimumStackCommit : 0 +0x320 FlsCallback : 0x00000000`0037c220 _FLS_CALLBACK_INFO +0x328 FlsListHead : _LIST_ENTRY [ 0x00000000`0037be00 - 0x00000000`003d1610 ] +0x338 FlsBitmap : 0x00000000`77012570 Void +0x340 FlsBitmapBits : [4] 0xf +0x350 FlsHighIndex : 3 +0x358 WerRegistrationData : 0x00000000`00100000 Void +0x360 WerShipAssertPtr : (null) +0x368 pContextData : 0x00000000`00050000 Void +0x370 pImageHeaderHash : (null) +0x378 TracingFlags : 0 +0x378 HeapTracingEnabled : 0y0 +0x378 CritSecTracingEnabled : 0y0 +0x378 SpareTracingBits : 0y000000000000000000000000000000 (0)

  

原文地址:https://www.cnblogs.com/M4ster/p/PEB.html