_PEB

Metadatacopy
struct _PEB {
    unsigned char InheritedAddressSpace;/* 0x0  1 */
    unsigned char ReadImageFileExecOptions;/* 0x1  1 */
    unsigned char BeingDebugged;/* 0x2  1 */
    unsigned char SpareBool;/* 0x3  1 */
    void* Mutant;/* 0x4  4 */
    void* ImageBaseAddress;/* 0x8  4 */
    struct _PEB_LDR_DATA* Ldr;/* 0xc  4 */
    struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;/* 0x10  4 */
    void* SubSystemData;/* 0x14  4 */
    void* ProcessHeap;/* 0x18  4 */
    void* FastPebLock;/* 0x1c  4 */
    void* FastPebLockRoutine;/* 0x20  4 */
    void* FastPebUnlockRoutine;/* 0x24  4 */
    unsigned long EnvironmentUpdateCount;/* 0x28  4 */
    void* KernelCallbackTable;/* 0x2c  4 */
    void* EventLogSection;/* 0x30  4 */
    void* EventLog;/* 0x34  4 */
    struct _PEB_FREE_BLOCK* FreeList;/* 0x38  4 */
    unsigned long TlsExpansionCounter;/* 0x3c  4 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    void* TlsBitmap;/* 0x40  4 */
    unsigned long TlsBitmapBits[2];/* 0x44  8 */
    void* ReadOnlySharedMemoryBase;/* 0x4c  4 */
    void* ReadOnlySharedMemoryHeap;/* 0x50  4 */
    void** ReadOnlyStaticServerData;/* 0x54  4 */
    void* AnsiCodePageData;/* 0x58  4 */
    void* OemCodePageData;/* 0x5c  4 */
    void* UnicodeCaseTableData;/* 0x60  4 */
    unsigned long NumberOfProcessors;/* 0x64  4 */
    unsigned long NtGlobalFlag;/* 0x68  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER CriticalSectionTimeout;/* 0x70  8 */
    unsigned long HeapSegmentReserve;/* 0x78  4 */
    unsigned long HeapSegmentCommit;/* 0x7c  4 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned long HeapDeCommitTotalFreeThreshold;/* 0x80  4 */
    unsigned long HeapDeCommitFreeBlockThreshold;/* 0x84  4 */
    unsigned long NumberOfHeaps;/* 0x88  4 */
    unsigned long MaximumNumberOfHeaps;/* 0x8c  4 */
    void** ProcessHeaps;/* 0x90  4 */
    void* GdiSharedHandleTable;/* 0x94  4 */
    void* ProcessStarterHelper;/* 0x98  4 */
    void* GdiDCAttributeList;/* 0x9c  4 */
    void* LoaderLock;/* 0xa0  4 */
    unsigned long OSMajorVersion;/* 0xa4  4 */
    unsigned long OSMinorVersion;/* 0xa8  4 */
    unsigned long OSBuildNumber;/* 0xac  4 */
    unsigned long OSPlatformId;/* 0xb0  4 */
    unsigned long ImageSubsystem;/* 0xb4  4 */
    unsigned long ImageSubsystemMajorVersion;/* 0xb8  4 */
    unsigned long ImageSubsystemMinorVersion;/* 0xbc  4 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    unsigned long ImageProcessAffinityMask;/* 0xc0  4 */
    unsigned long GdiHandleBuffer[34];/* 0xc4  136 */
};
/* source: NT 4.0 DDK (August 1996) PPC LIBCNTPR.LIB CodeView type records; _EPROCESS/_ETHREAD offsets match KDEXTPPC.DLL (NT 4.0 Server CD) */