_PEB32

Metadatacopy
struct _PEB32 {
    unsigned char InheritedAddressSpace;/* 0x0  1 */
    unsigned char ReadImageFileExecOptions;/* 0x1  1 */
    unsigned char BeingDebugged;/* 0x2  1 */
    union {
        unsigned char BitField;/* 0x3  1 */
        struct {
            unsigned char ImageUsesLargePages : 1;/* 0x3:0  1 */
            unsigned char IsProtectedProcess : 1;/* 0x3:1  1 */
            unsigned char IsImageDynamicallyRelocated : 1;/* 0x3:2  1 */
            unsigned char SkipPatchingUser32Forwarders : 1;/* 0x3:3  1 */
            unsigned char IsPackagedProcess : 1;/* 0x3:4  1 */
            unsigned char IsAppContainer : 1;/* 0x3:5  1 */
            unsigned char IsProtectedProcessLight : 1;/* 0x3:6  1 */
            unsigned char IsLongPathAwareProcess : 1;/* 0x3:7  1 */
        };/* 0x3  1 */
    };/* 0x3  1 */
    unsigned long Mutant;/* 0x4  4 */
    unsigned long ImageBaseAddress;/* 0x8  4 */
    unsigned long Ldr;/* 0xc  4 */
    unsigned long ProcessParameters;/* 0x10  4 */
    unsigned long SubSystemData;/* 0x14  4 */
    unsigned long ProcessHeap;/* 0x18  4 */
    unsigned long FastPebLock;/* 0x1c  4 */
    unsigned long AtlThunkSListPtr;/* 0x20  4 */
    unsigned long IFEOKey;/* 0x24  4 */
    union {
        unsigned long CrossProcessFlags;/* 0x28  4 */
        struct {
            unsigned long ProcessInJob : 1;/* 0x28:0  4 */
            unsigned long ProcessInitializing : 1;/* 0x28:1  4 */
            unsigned long ProcessUsingVEH : 1;/* 0x28:2  4 */
            unsigned long ProcessUsingVCH : 1;/* 0x28:3  4 */
            unsigned long ProcessUsingFTH : 1;/* 0x28:4  4 */
            unsigned long ProcessPreviouslyThrottled : 1;/* 0x28:5  4 */
            unsigned long ProcessCurrentlyThrottled : 1;/* 0x28:6  4 */
            unsigned long ProcessImagesHotPatched : 1;/* 0x28:7  4 */
            unsigned long ReservedBits0 : 24;/* 0x28:8  4 */
        };/* 0x28  4 */
    };/* 0x28  4 */
    union {
        unsigned long KernelCallbackTable;/* 0x2c  4 */
        unsigned long UserSharedInfoPtr;/* 0x2c  4 */
    };/* 0x2c  4 */
    unsigned long SystemReserved;/* 0x30  4 */
    unsigned long AtlThunkSListPtr32;/* 0x34  4 */
    unsigned long ApiSetMap;/* 0x38  4 */
    unsigned long TlsExpansionCounter;/* 0x3c  4 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    unsigned long TlsBitmap;/* 0x40  4 */
    unsigned long TlsBitmapBits[2];/* 0x44  8 */
    unsigned long ReadOnlySharedMemoryBase;/* 0x4c  4 */
    unsigned long SharedData;/* 0x50  4 */
    unsigned long ReadOnlyStaticServerData;/* 0x54  4 */
    unsigned long AnsiCodePageData;/* 0x58  4 */
    unsigned long OemCodePageData;/* 0x5c  4 */
    unsigned long UnicodeCaseTableData;/* 0x60  4 */
    unsigned long NumberOfProcessors;/* 0x64  4 */
    unsigned long NtGlobalFlag;/* 0x68  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER CriticalSectionTimeout;/* 0x70  8 */
    unsigned long HeapSegmentReserve;/* 0x78  4 */
    unsigned long HeapSegmentCommit;/* 0x7c  4 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned long HeapDeCommitTotalFreeThreshold;/* 0x80  4 */
    unsigned long HeapDeCommitFreeBlockThreshold;/* 0x84  4 */
    unsigned long NumberOfHeaps;/* 0x88  4 */
    unsigned long MaximumNumberOfHeaps;/* 0x8c  4 */
    unsigned long ProcessHeaps;/* 0x90  4 */
    unsigned long GdiSharedHandleTable;/* 0x94  4 */
    unsigned long ProcessStarterHelper;/* 0x98  4 */
    unsigned long GdiDCAttributeList;/* 0x9c  4 */
    unsigned long LoaderLock;/* 0xa0  4 */
    unsigned long OSMajorVersion;/* 0xa4  4 */
    unsigned long OSMinorVersion;/* 0xa8  4 */
    unsigned short OSBuildNumber;/* 0xac  2 */
    unsigned short OSCSDVersion;/* 0xae  2 */
    unsigned long OSPlatformId;/* 0xb0  4 */
    unsigned long ImageSubsystem;/* 0xb4  4 */
    unsigned long ImageSubsystemMajorVersion;/* 0xb8  4 */
    unsigned long ImageSubsystemMinorVersion;/* 0xbc  4 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    unsigned long ActiveProcessAffinityMask;/* 0xc0  4 */
    unsigned long GdiHandleBuffer[34];/* 0xc4  136 */
    /* ── cacheline 5 boundary (320 bytes) ── */
    unsigned long PostProcessInitRoutine;/* 0x14c  4 */
    unsigned long TlsExpansionBitmap;/* 0x150  4 */
    unsigned long TlsExpansionBitmapBits[32];/* 0x154  128 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    unsigned long SessionId;/* 0x1d4  4 */
    union _ULARGE_INTEGER AppCompatFlags;/* 0x1d8  8 */
    union _ULARGE_INTEGER AppCompatFlagsUser;/* 0x1e0  8 */
    unsigned long pShimData;/* 0x1e8  4 */
    unsigned long AppCompatInfo;/* 0x1ec  4 */
    struct _STRING32 CSDVersion;/* 0x1f0  8 */
    unsigned long ActivationContextData;/* 0x1f8  4 */
    unsigned long ProcessAssemblyStorageMap;/* 0x1fc  4 */
    /* ── cacheline 8 boundary (512 bytes) ── */
    unsigned long SystemDefaultActivationContextData;/* 0x200  4 */
    unsigned long SystemAssemblyStorageMap;/* 0x204  4 */
    unsigned long MinimumStackCommit;/* 0x208  4 */
    unsigned long SparePointers[2];/* 0x20c  8 */
    unsigned long PatchLoaderData;/* 0x214  4 */
    unsigned long ChpeV2ProcessInfo;/* 0x218  4 */
    unsigned long AppModelFeatureState;/* 0x21c  4 */
    unsigned long SpareUlongs[2];/* 0x220  8 */
    unsigned short ActiveCodePage;/* 0x228  2 */
    unsigned short OemCodePage;/* 0x22a  2 */
    unsigned short UseCaseMapping;/* 0x22c  2 */
    unsigned short UnusedNlsField;/* 0x22e  2 */
    unsigned long WerRegistrationData;/* 0x230  4 */
    unsigned long WerShipAssertPtr;/* 0x234  4 */
    unsigned long Spare;/* 0x238  4 */
    unsigned long pImageHeaderHash;/* 0x23c  4 */
    /* ── cacheline 9 boundary (576 bytes) ── */
    union {
        unsigned long TracingFlags;/* 0x240  4 */
        struct {
            unsigned long HeapTracingEnabled : 1;/* 0x240:0  4 */
            unsigned long CritSecTracingEnabled : 1;/* 0x240:1  4 */
            unsigned long LibLoaderTracingEnabled : 1;/* 0x240:2  4 */
            unsigned long SpareTracingBits : 29;/* 0x240:3  4 */
        };/* 0x240  4 */
    };/* 0x240  4 */
    /* 4 bytes padding */
    unsigned __int64 CsrServerReadOnlySharedMemoryBase;/* 0x248  8 */
    unsigned long TppWorkerpListLock;/* 0x250  4 */
    struct LIST_ENTRY32 TppWorkerpList;/* 0x254  8 */
    unsigned long WaitOnAddressHashTable[128];/* 0x25c  512 */
    /* ── cacheline 17 boundary (1088 bytes) ── */
    unsigned long TelemetryCoverageHeader;/* 0x45c  4 */
    unsigned long CloudFileFlags;/* 0x460  4 */
    unsigned long CloudFileDiagFlags;/* 0x464  4 */
    char PlaceholderCompatibilityMode;/* 0x468  1 */
    char PlaceholderCompatibilityModeReserved[7];/* 0x469  7 */
    unsigned long LeapSecondData;/* 0x470  4 */
    union {
        unsigned long LeapSecondFlags;/* 0x474  4 */
        struct {
            unsigned long SixtySecondEnabled : 1;/* 0x474:0  4 */
            unsigned long Reserved : 31;/* 0x474:1  4 */
        };/* 0x474  4 */
    };/* 0x474  4 */
    unsigned long NtGlobalFlag2;/* 0x478  4 */
    /* 4 bytes padding */
    /* ── cacheline 18 boundary (1152 bytes) ── */
    unsigned __int64 ExtendedFeatureDisableMask;/* 0x480  8 */
    unsigned long Win32ClientProcInfo;/* 0x488  4 */
};