_PEB

incomplete only the Native API and process/thread environment structures two MIPS binaries were compiled with (_TEB, _PEB, _KPCR, RTL, object/file/registry information classes, image headers): no kernel objects

2 variants the sources define _PEB differently:


struct _PEB {
    unsigned char InheritedAddressSpace;/* 0x0  1 */
    /* 3 bytes padding */
    void* Mutant;/* 0x4  4 */
    void* ImageBaseAddress;/* 0x8  4 */
    struct _PEB_LDR_DATA* Ldr;/* 0xc  4 */
    struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;/* 0x10  4 */
    void* SubSystemData;/* 0x14  4 */
    void* ProcessHeap;/* 0x18  4 */
    void* FastPebLock;/* 0x1c  4 */
    void* FastPebLockRoutine;/* 0x20  4 */
    void* FastPebUnlockRoutine;/* 0x24  4 */
    void* Spare[4];/* 0x28  16 */
    struct _PEB_FREE_BLOCK* FreeList;/* 0x38  4 */
    unsigned long TlsExpansionCounter;/* 0x3c  4 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    void* TlsBitmap;/* 0x40  4 */
    unsigned long TlsBitmapBits[2];/* 0x44  8 */
    void* ReadOnlySharedMemoryBase;/* 0x4c  4 */
    void* ReadOnlySharedMemoryHeap;/* 0x50  4 */
    void** ReadOnlyStaticServerData;/* 0x54  4 */
    void* AnsiCodePageData;/* 0x58  4 */
    void* OemCodePageData;/* 0x5c  4 */
    void* UnicodeCaseTableData;/* 0x60  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER CriticalSectionTimeout;/* 0x68  8 */
};
/* source: Windows NT 3.1 beta DDK, MIPS/CDPLAYER.EXE and MIPS/DISKPERF.EXE inline CodeView 4 (NB08) type records; build 404.1 per the DDK's version.h; this definition: MIPS/CDPLAYER.EXE */

size 112 (0x70)22 members2 holes (7 bytes)padding 02 cachelines


struct _PEB {
    unsigned char InheritedAddressSpace;/* 0x0  1 */
    /* 3 bytes padding */
    void* Mutant;/* 0x4  4 */
    void* ImageBaseAddress;/* 0x8  4 */
    struct _PEB_LDR_DATA* Ldr;/* 0xc  4 */
    struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;/* 0x10  4 */
    void* SubSystemData;/* 0x14  4 */
    void* ProcessHeap;/* 0x18  4 */
    void* FastPebLock;/* 0x1c  4 */
    void* FastPebLockRoutine;/* 0x20  4 */
    void* FastPebUnlockRoutine;/* 0x24  4 */
    void* Spare[4];/* 0x28  16 */
    struct _PEB_FREE_BLOCK* FreeList;/* 0x38  4 */
    unsigned long TlsExpansionCounter;/* 0x3c  4 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    void* TlsBitmap;/* 0x40  4 */
    unsigned long TlsBitmapBits[2];/* 0x44  8 */
    void* ReadOnlySharedMemoryBase;/* 0x4c  4 */
    void* ReadOnlySharedMemoryHeap;/* 0x50  4 */
    void** ReadOnlyStaticServerData;/* 0x54  4 */
    void* AnsiCodePageData;/* 0x58  4 */
    void* OemCodePageData;/* 0x5c  4 */
    void* UnicodeCaseTableData;/* 0x60  4 */
};
/* source: Windows NT 3.1 beta DDK, MIPS/CDPLAYER.EXE and MIPS/DISKPERF.EXE inline CodeView 4 (NB08) type records; build 404.1 per the DDK's version.h; this definition: MIPS/DISKPERF.EXE */

size 100 (0x64)21 members1 hole (3 bytes)padding 02 cachelines

Used in (2)

_PROCESS_BASIC_INFORMATION _TEB