typedef struct _PEB
{
    unsigned char InheritedAddressSpace;
    unsigned char ReadImageFileExecOptions;
    unsigned char BeingDebugged;
    union
    {
        unsigned char BitField;
        struct
        {
            unsigned char ImageUsesLargePages : 1;
            unsigned char IsProtectedProcess : 1;
            unsigned char IsLegacyProcess : 1;
            unsigned char IsImageDynamicallyRelocated : 1;
            unsigned char SkipPatchingUser32Forwarders : 1;
            unsigned char SpareBits : 3;
        };
    };
    void *Mutant;
    void *ImageBaseAddress;
    PEB_LDR_DATA *Ldr;
    RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
    void *SubSystemData;
    void *ProcessHeap;
    RTL_CRITICAL_SECTION *FastPebLock;
    void *AtlThunkSListPtr;
    void *IFEOKey;
    union
    {
        unsigned long CrossProcessFlags;
        struct
        {
            unsigned long ProcessInJob : 1;
            unsigned long ProcessInitializing : 1;
            unsigned long ProcessUsingVEH : 1;
            unsigned long ProcessUsingVCH : 1;
            unsigned long ProcessUsingFTH : 1;
            unsigned long ReservedBits0 : 27;
        };
    };
    union
    {
        void *KernelCallbackTable;
        void *UserSharedInfoPtr;
    };
    unsigned long SystemReserved[1];
    unsigned long AtlThunkSListPtr32;
    void *ApiSetMap;
    unsigned long TlsExpansionCounter;
    void *TlsBitmap;
    unsigned long TlsBitmapBits[2];
    void *ReadOnlySharedMemoryBase;
    void *HotpatchInformation;
    void **ReadOnlyStaticServerData;
    void *AnsiCodePageData;
    void *OemCodePageData;
    void *UnicodeCaseTableData;
    unsigned long NumberOfProcessors;
    unsigned long NtGlobalFlag;
    LARGE_INTEGER CriticalSectionTimeout;
    unsigned __int64 HeapSegmentReserve;
    unsigned __int64 HeapSegmentCommit;
    unsigned __int64 HeapDeCommitTotalFreeThreshold;
    unsigned __int64 HeapDeCommitFreeBlockThreshold;
    unsigned long NumberOfHeaps;
    unsigned long MaximumNumberOfHeaps;
    void **ProcessHeaps;
    void *GdiSharedHandleTable;
    void *ProcessStarterHelper;
    unsigned long GdiDCAttributeList;
    RTL_CRITICAL_SECTION *LoaderLock;
    unsigned long OSMajorVersion;
    unsigned long OSMinorVersion;
    unsigned short OSBuildNumber;
    unsigned short OSCSDVersion;
    unsigned long OSPlatformId;
    unsigned long ImageSubsystem;
    unsigned long ImageSubsystemMajorVersion;
    unsigned long ImageSubsystemMinorVersion;
    unsigned __int64 ActiveProcessAffinityMask;
    unsigned long GdiHandleBuffer[60];
    void (*PostProcessInitRoutine)(void);
    void *TlsExpansionBitmap;
    unsigned long TlsExpansionBitmapBits[32];
    unsigned long SessionId;
    ULARGE_INTEGER AppCompatFlags;
    ULARGE_INTEGER AppCompatFlagsUser;
    void *pShimData;
    void *AppCompatInfo;
    UNICODE_STRING CSDVersion;
    ACTIVATION_CONTEXT_DATA *ActivationContextData;
    ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;
    ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;
    ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;
    unsigned __int64 MinimumStackCommit;
    FLS_CALLBACK_INFO *FlsCallback;
    LIST_ENTRY FlsListHead;
    void *FlsBitmap;
    unsigned long FlsBitmapBits[4];
    unsigned long FlsHighIndex;
    void *WerRegistrationData;
    void *WerShipAssertPtr;
    void *pContextData;
    void *pImageHeaderHash;
    union
    {
        unsigned long TracingFlags;
        struct
        {
            unsigned long HeapTracingEnabled : 1;
            unsigned long CritSecTracingEnabled : 1;
            unsigned long SpareTracingBits : 30;
        };
    };
} PEB, *PPEB;