x86 x64 下PEB结构

x64 下的calc

 +0x000 InheritedAddressSpace : 0 ''
   +0x001 ReadImageFileExecOptions : 0 ''
   +0x002 BeingDebugged    : 0x1 ''
   +0x003 BitField         : 0x8 ''
   +0x003 ImageUsesLargePages : 0y0
   +0x003 IsProtectedProcess : 0y0
   +0x003 IsLegacyProcess  : 0y0
   +0x003 IsImageDynamicallyRelocated : 0y1
   +0x003 SkipPatchingUser32Forwarders : 0y0
   +0x003 SpareBits        : 0y000
   +0x008 Mutant           : 0xffffffff`ffffffff Void
   +0x010 ImageBaseAddress : 0x00000000`ff6a0000 Void
   +0x018 Ldr              : 0x00000000`77012640 _PEB_LDR_DATA
   +0x020 ProcessParameters : 0x00000000`00351e90 _RTL_USER_PROCESS_PARAMETERS
   +0x028 SubSystemData    : (null) 
   +0x030 ProcessHeap      : 0x00000000`00350000 Void
   +0x038 FastPebLock      : 0x00000000`7701a900 _RTL_CRITICAL_SECTION
   +0x040 AtlThunkSListPtr : (null) 
   +0x048 IFEOKey          : (null) 
   +0x050 CrossProcessFlags : 0
   +0x050 ProcessInJob     : 0y0
   +0x050 ProcessInitializing : 0y0
   +0x050 ProcessUsingVEH  : 0y0
   +0x050 ProcessUsingVCH  : 0y0
   +0x050 ProcessUsingFTH  : 0y0
   +0x050 ReservedBits0    : 0y000000000000000000000000000 (0)
   +0x058 KernelCallbackTable : 0x00000000`76e69500 Void
   +0x058 UserSharedInfoPtr : 0x00000000`76e69500 Void
   +0x060 SystemReserved   : [1] 0
   +0x064 AtlThunkSListPtr32 : 0
   +0x068 ApiSetMap        : 0x000007fe`ff200000 Void
   +0x070 TlsExpansionCounter : 0
   +0x078 TlsBitmap        : 0x00000000`77012590 Void
   +0x080 TlsBitmapBits    : [2] 0x1ffffff
   +0x088 ReadOnlySharedMemoryBase : 0x00000000`7efe0000 Void
   +0x090 HotpatchInformation : (null) 
   +0x098 ReadOnlyStaticServerData : 0x00000000`7efe0a90  -> (null) 
   +0x0a0 AnsiCodePageData : 0x000007ff`fffb0000 Void
   +0x0a8 OemCodePageData  : 0x000007ff`fffc0228 Void
   +0x0b0 UnicodeCaseTableData : 0x000007ff`fffd0650 Void
   +0x0b8 NumberOfProcessors : 2
   +0x0bc NtGlobalFlag     : 0
   +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER 0xffffe86d`079b8000
   +0x0c8 HeapSegmentReserve : 0x100000
   +0x0d0 HeapSegmentCommit : 0x2000
   +0x0d8 HeapDeCommitTotalFreeThreshold : 0x10000
   +0x0e0 HeapDeCommitFreeBlockThreshold : 0x1000
   +0x0e8 NumberOfHeaps    : 6
   +0x0ec MaximumNumberOfHeaps : 0x10
   +0x0f0 ProcessHeaps     : 0x00000000`7701a6c0  -> 0x00000000`00350000 Void
   +0x0f8 GdiSharedHandleTable : 0x00000000`005e0000 Void
   +0x100 ProcessStarterHelper : (null) 
   +0x108 GdiDCAttributeList : 0x14
   +0x110 LoaderLock       : 0x00000000`77017490 _RTL_CRITICAL_SECTION
   +0x118 OSMajorVersion   : 6
   +0x11c OSMinorVersion   : 1
   +0x120 OSBuildNumber    : 0x1db1
   +0x122 OSCSDVersion     : 0x100
   +0x124 OSPlatformId     : 2
   +0x128 ImageSubsystem   : 2
   +0x12c ImageSubsystemMajorVersion : 6
   +0x130 ImageSubsystemMinorVersion : 1
   +0x138 ActiveProcessAffinityMask : 3
   +0x140 GdiHandleBuffer  : [60] 0
   +0x230 PostProcessInitRoutine : (null) 
   +0x238 TlsExpansionBitmap : 0x00000000`77012580 Void
   +0x240 TlsExpansionBitmapBits : [32] 1
   +0x2c0 SessionId        : 1
   +0x2c8 AppCompatFlags   : _ULARGE_INTEGER 0x0
   +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER 0x0
   +0x2d8 pShimData        : (null) 
   +0x2e0 AppCompatInfo    : (null) 
   +0x2e8 CSDVersion       : _UNICODE_STRING "Service Pack 1"
   +0x2f8 ActivationContextData : 0x00000000`00040000 _ACTIVATION_CONTEXT_DATA
   +0x300 ProcessAssemblyStorageMap : 0x00000000`00377f60 _ASSEMBLY_STORAGE_MAP
   +0x308 SystemDefaultActivationContextData : 0x00000000`00030000 _ACTIVATION_CONTEXT_DATA
   +0x310 SystemAssemblyStorageMap : 0x00000000`00377020 _ASSEMBLY_STORAGE_MAP
   +0x318 MinimumStackCommit : 0
   +0x320 FlsCallback      : 0x00000000`0037c220 _FLS_CALLBACK_INFO
   +0x328 FlsListHead      : _LIST_ENTRY [ 0x00000000`0037be00 - 0x00000000`003d1610 ]
   +0x338 FlsBitmap        : 0x00000000`77012570 Void
   +0x340 FlsBitmapBits    : [4] 0xf
   +0x350 FlsHighIndex     : 3
   +0x358 WerRegistrationData : 0x00000000`00100000 Void
   +0x360 WerShipAssertPtr : (null) 
   +0x368 pContextData     : 0x00000000`00050000 Void
   +0x370 pImageHeaderHash : (null) 
   +0x378 TracingFlags     : 0
   +0x378 HeapTracingEnabled : 0y0
   +0x378 CritSecTracingEnabled : 0y0
   +0x378 SpareTracingBits : 0y000000000000000000000000000000 (0)

　　

转载于:https://www.cnblogs.com/M4ster/p/PEB.html