@@ -784,6 +784,14 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS_FULL
784784 // ...
785785} RTL_USER_PROCESS_PARAMETERS_FULL , * PRTL_USER_PROCESS_PARAMETERS_FULL ;
786786
787+ typedef struct KERNEL_CALLBACK_TABLE * PKERNEL_CALLBACK_TABLE ;
788+ typedef struct API_SET_NAMESPACE * PAPI_SET_NAMESPACE ;
789+ typedef struct RTL_BITMAP * PRTL_BITMAP ;
790+ typedef struct SILO_USER_SHARED_DATA * PSILO_USER_SHARED_DATA ;
791+ typedef struct CPTABLEINFO * PCPTABLEINFO ;
792+ typedef struct NLSTABLEINFO * PNLSTABLEINFO ;
793+ typedef struct GDI_HANDLE_ENTRY * PGDI_HANDLE_ENTRY ;
794+
787795typedef struct _PEB_FULL
788796{
789797 //
@@ -847,6 +855,261 @@ typedef struct _PEB_FULL
847855 //
848856 PVOID ProcessHeap ;
849857
858+ //
859+ // Pointer to a critical section used to synchronize access to the PEB.
860+ //
861+ PRTL_CRITICAL_SECTION FastPebLock ;
862+
863+ //
864+ // Pointer to a singly linked list used by ATL.
865+ //
866+ PSLIST_HEADER AtlThunkSListPtr ;
867+
868+ //
869+ // Handle to the Image File Execution Options key.
870+ //
871+ HANDLE IFEOKey ;
872+
873+ //
874+ // Cross process flags.
875+ //
876+ union
877+ {
878+ ULONG CrossProcessFlags ;
879+ struct
880+ {
881+ ULONG ProcessInJob : 1 ; // The process is part of a job.
882+ ULONG ProcessInitializing : 1 ; // The process is initializing.
883+ ULONG ProcessUsingVEH : 1 ; // The process is using VEH.
884+ ULONG ProcessUsingVCH : 1 ; // The process is using VCH.
885+ ULONG ProcessUsingFTH : 1 ; // The process is using FTH.
886+ ULONG ProcessPreviouslyThrottled : 1 ; // The process was previously throttled.
887+ ULONG ProcessCurrentlyThrottled : 1 ; // The process is currently throttled.
888+ ULONG ProcessImagesHotPatched : 1 ; // The process images are hot patched. // RS5
889+ ULONG ReservedBits0 : 24 ;
890+ };
891+ };
892+
893+ //
894+ // User32 KERNEL_CALLBACK_TABLE (ntuser.h)
895+ //
896+ union
897+ {
898+ PKERNEL_CALLBACK_TABLE KernelCallbackTable ;
899+ PVOID UserSharedInfoPtr ;
900+ };
901+
902+ //
903+ // Reserved.
904+ //
905+ ULONG SystemReserved ;
906+
907+ //
908+ // Pointer to the Active Template Library (ATL) singly linked list (32-bit)
909+ //
910+ ULONG AtlThunkSListPtr32 ;
911+
912+ //
913+ // Pointer to the API Set Schema.
914+ //
915+ PAPI_SET_NAMESPACE ApiSetMap ;
916+
917+ //
918+ // Counter for TLS expansion.
919+ //
920+ ULONG TlsExpansionCounter ;
921+
922+ //
923+ // Pointer to the TLS bitmap.
924+ //
925+ PRTL_BITMAP TlsBitmap ;
926+
927+ //
928+ // Bits for the TLS bitmap.
929+ //
930+ ULONG TlsBitmapBits [2 ];
931+
932+ //
933+ // Reserved for CSRSS.
934+ //
935+ PVOID ReadOnlySharedMemoryBase ;
936+
937+ //
938+ // Pointer to the USER_SHARED_DATA for the current SILO.
939+ //
940+ PSILO_USER_SHARED_DATA SharedData ;
941+
942+ //
943+ // Reserved for CSRSS.
944+ //
945+ PVOID * ReadOnlyStaticServerData ;
946+
947+ //
948+ // Pointer to the ANSI code page data.
949+ //
950+ PCPTABLEINFO AnsiCodePageData ;
951+
952+ //
953+ // Pointer to the OEM code page data.
954+ //
955+ PCPTABLEINFO OemCodePageData ;
956+
957+ //
958+ // Pointer to the Unicode case table data.
959+ //
960+ PNLSTABLEINFO UnicodeCaseTableData ;
961+
962+ //
963+ // The total number of system processors.
964+ //
965+ ULONG NumberOfProcessors ;
966+
967+ //
968+ // Global flags for the system.
969+ //
970+ union
971+ {
972+ ULONG NtGlobalFlag ;
973+ struct
974+ {
975+ ULONG StopOnException : 1 ; // FLG_STOP_ON_EXCEPTION
976+ ULONG ShowLoaderSnaps : 1 ; // FLG_SHOW_LDR_SNAPS
977+ ULONG DebugInitialCommand : 1 ; // FLG_DEBUG_INITIAL_COMMAND
978+ ULONG StopOnHungGUI : 1 ; // FLG_STOP_ON_HUNG_GUI
979+ ULONG HeapEnableTailCheck : 1 ; // FLG_HEAP_ENABLE_TAIL_CHECK
980+ ULONG HeapEnableFreeCheck : 1 ; // FLG_HEAP_ENABLE_FREE_CHECK
981+ ULONG HeapValidateParameters : 1 ; // FLG_HEAP_VALIDATE_PARAMETERS
982+ ULONG HeapValidateAll : 1 ; // FLG_HEAP_VALIDATE_ALL
983+ ULONG ApplicationVerifier : 1 ; // FLG_APPLICATION_VERIFIER
984+ ULONG MonitorSilentProcessExit : 1 ; // FLG_MONITOR_SILENT_PROCESS_EXIT
985+ ULONG PoolEnableTagging : 1 ; // FLG_POOL_ENABLE_TAGGING
986+ ULONG HeapEnableTagging : 1 ; // FLG_HEAP_ENABLE_TAGGING
987+ ULONG UserStackTraceDb : 1 ; // FLG_USER_STACK_TRACE_DB
988+ ULONG KernelStackTraceDb : 1 ; // FLG_KERNEL_STACK_TRACE_DB
989+ ULONG MaintainObjectTypeList : 1 ; // FLG_MAINTAIN_OBJECT_TYPELIST
990+ ULONG HeapEnableTagByDll : 1 ; // FLG_HEAP_ENABLE_TAG_BY_DLL
991+ ULONG DisableStackExtension : 1 ; // FLG_DISABLE_STACK_EXTENSION
992+ ULONG EnableCsrDebug : 1 ; // FLG_ENABLE_CSRDEBUG
993+ ULONG EnableKDebugSymbolLoad : 1 ; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD
994+ ULONG DisablePageKernelStacks : 1 ; // FLG_DISABLE_PAGE_KERNEL_STACKS
995+ ULONG EnableSystemCritBreaks : 1 ; // FLG_ENABLE_SYSTEM_CRIT_BREAKS
996+ ULONG HeapDisableCoalescing : 1 ; // FLG_HEAP_DISABLE_COALESCING
997+ ULONG EnableCloseExceptions : 1 ; // FLG_ENABLE_CLOSE_EXCEPTIONS
998+ ULONG EnableExceptionLogging : 1 ; // FLG_ENABLE_EXCEPTION_LOGGING
999+ ULONG EnableHandleTypeTagging : 1 ; // FLG_ENABLE_HANDLE_TYPE_TAGGING
1000+ ULONG HeapPageAllocs : 1 ; // FLG_HEAP_PAGE_ALLOCS
1001+ ULONG DebugInitialCommandEx : 1 ; // FLG_DEBUG_INITIAL_COMMAND_EX
1002+ ULONG DisableDbgPrint : 1 ; // FLG_DISABLE_DBGPRINT
1003+ ULONG CritSecEventCreation : 1 ; // FLG_CRITSEC_EVENT_CREATION
1004+ ULONG LdrTopDown : 1 ; // FLG_LDR_TOP_DOWN
1005+ ULONG EnableHandleExceptions : 1 ; // FLG_ENABLE_HANDLE_EXCEPTIONS
1006+ ULONG DisableProtDlls : 1 ; // FLG_DISABLE_PROTDLLS
1007+ } NtGlobalFlags ;
1008+ };
1009+
1010+ //
1011+ // Timeout for critical sections.
1012+ //
1013+ LARGE_INTEGER CriticalSectionTimeout ;
1014+
1015+ //
1016+ // Reserved size for heap segments.
1017+ //
1018+ SIZE_T HeapSegmentReserve ;
1019+
1020+ //
1021+ // Committed size for heap segments.
1022+ //
1023+ SIZE_T HeapSegmentCommit ;
1024+
1025+ //
1026+ // Threshold for decommitting total free heap.
1027+ //
1028+ SIZE_T HeapDeCommitTotalFreeThreshold ;
1029+
1030+ //
1031+ // Threshold for decommitting free heap blocks.
1032+ //
1033+ SIZE_T HeapDeCommitFreeBlockThreshold ;
1034+
1035+ //
1036+ // Number of process heaps.
1037+ //
1038+ ULONG NumberOfHeaps ;
1039+
1040+ //
1041+ // Maximum number of process heaps.
1042+ //
1043+ ULONG MaximumNumberOfHeaps ;
1044+
1045+ //
1046+ // Pointer to an array of process heaps. ProcessHeaps is initialized
1047+ // to point to the first free byte after the PEB and MaximumNumberOfHeaps
1048+ // is computed from the page size used to hold the PEB, less the fixed
1049+ // size of this data structure.
1050+ //
1051+ PVOID * ProcessHeaps ;
1052+
1053+ //
1054+ // Pointer to the system GDI shared handle table.
1055+ //
1056+ PGDI_HANDLE_ENTRY GdiSharedHandleTable ;
1057+
1058+ //
1059+ // Pointer to the process starter helper.
1060+ //
1061+ PVOID ProcessStarterHelper ;
1062+
1063+ //
1064+ // The maximum number of GDI function calls during batch operations (GdiSetBatchLimit)
1065+ //
1066+ ULONG GdiDCAttributeList ;
1067+
1068+ //
1069+ // Pointer to the loader lock critical section.
1070+ //
1071+ PRTL_CRITICAL_SECTION LoaderLock ;
1072+
1073+ //
1074+ // Major version of the operating system.
1075+ //
1076+ ULONG OSMajorVersion ;
1077+
1078+ //
1079+ // Minor version of the operating system.
1080+ //
1081+ ULONG OSMinorVersion ;
1082+
1083+ //
1084+ // Build number of the operating system.
1085+ //
1086+ USHORT OSBuildNumber ;
1087+
1088+ //
1089+ // CSD version of the operating system.
1090+ //
1091+ USHORT OSCSDVersion ;
1092+
1093+ //
1094+ // Platform ID of the operating system.
1095+ //
1096+ ULONG OSPlatformId ;
1097+
1098+ //
1099+ // Subsystem version of the current process image (PE Headers).
1100+ //
1101+ ULONG ImageSubsystem ;
1102+
1103+ //
1104+ // Major version of the current process image subsystem (PE Headers).
1105+ //
1106+ ULONG ImageSubsystemMajorVersion ;
1107+
1108+ //
1109+ // Minor version of the current process image subsystem (PE Headers).
1110+ //
1111+ ULONG ImageSubsystemMinorVersion ;
1112+
8501113 // ...
8511114} PEB_FULL , * PPEB_FULL ;
8521115
0 commit comments