typedef struct _PEB64 { unsigned char InheritedAddressSpace; unsigned char ReadImageFileExecOptions; unsigned char BeingDebugged; union { unsigned char BitField; struct { unsigned char ImageUsesLargePages : 1; unsigned char IsProtectedProcess : 1; unsigned char IsLegacyProcess : 1; unsigned char IsImageDynamicallyRelocated : 1; unsigned char SkipPatchingUser32Forwarders : 1; unsigned char SpareBits : 3; }; }; unsigned __int64 Mutant; unsigned __int64 ImageBaseAddress; unsigned __int64 Ldr; unsigned __int64 ProcessParameters; unsigned __int64 SubSystemData; unsigned __int64 ProcessHeap; unsigned __int64 FastPebLock; unsigned __int64 AtlThunkSListPtr; unsigned __int64 IFEOKey; union { unsigned long CrossProcessFlags; struct { unsigned long ProcessInJob : 1; unsigned long ProcessInitializing : 1; unsigned long ProcessUsingVEH : 1; unsigned long ProcessUsingVCH : 1; unsigned long ProcessUsingFTH : 1; unsigned long ReservedBits0 : 27; }; }; union { unsigned __int64 KernelCallbackTable; unsigned __int64 UserSharedInfoPtr; }; unsigned long SystemReserved[1]; unsigned long AtlThunkSListPtr32; unsigned __int64 ApiSetMap; unsigned long TlsExpansionCounter; unsigned __int64 TlsBitmap; unsigned long TlsBitmapBits[2]; unsigned __int64 ReadOnlySharedMemoryBase; unsigned __int64 HotpatchInformation; unsigned __int64 ReadOnlyStaticServerData; unsigned __int64 AnsiCodePageData; unsigned __int64 OemCodePageData; unsigned __int64 UnicodeCaseTableData; unsigned long NumberOfProcessors; unsigned long NtGlobalFlag; LARGE_INTEGER CriticalSectionTimeout; unsigned __int64 HeapSegmentReserve; unsigned __int64 HeapSegmentCommit; unsigned __int64 HeapDeCommitTotalFreeThreshold; unsigned __int64 HeapDeCommitFreeBlockThreshold; unsigned long NumberOfHeaps; unsigned long MaximumNumberOfHeaps; unsigned __int64 ProcessHeaps; unsigned __int64 GdiSharedHandleTable; unsigned __int64 ProcessStarterHelper; unsigned long GdiDCAttributeList; unsigned __int64 LoaderLock; unsigned long OSMajorVersion; unsigned long OSMinorVersion; unsigned short OSBuildNumber; unsigned short OSCSDVersion; unsigned long OSPlatformId; unsigned long ImageSubsystem; unsigned long ImageSubsystemMajorVersion; unsigned long ImageSubsystemMinorVersion; unsigned __int64 ActiveProcessAffinityMask; unsigned long GdiHandleBuffer[60]; unsigned __int64 PostProcessInitRoutine; unsigned __int64 TlsExpansionBitmap; unsigned long TlsExpansionBitmapBits[32]; unsigned long SessionId; ULARGE_INTEGER AppCompatFlags; ULARGE_INTEGER AppCompatFlagsUser; unsigned __int64 pShimData; unsigned __int64 AppCompatInfo; STRING64 CSDVersion; unsigned __int64 ActivationContextData; unsigned __int64 ProcessAssemblyStorageMap; unsigned __int64 SystemDefaultActivationContextData; unsigned __int64 SystemAssemblyStorageMap; unsigned __int64 MinimumStackCommit; unsigned __int64 FlsCallback; LIST_ENTRY64 FlsListHead; unsigned __int64 FlsBitmap; unsigned long FlsBitmapBits[4]; unsigned long FlsHighIndex; unsigned __int64 WerRegistrationData; unsigned __int64 WerShipAssertPtr; unsigned __int64 pContextData; unsigned __int64 pImageHeaderHash; union { unsigned long TracingFlags; struct { unsigned long HeapTracingEnabled : 1; unsigned long CritSecTracingEnabled : 1; unsigned long SpareTracingBits : 30; }; }; } PEB64, *PPEB64;