PEB structure (winternl.h)
[This structure may be altered in future versions of Windows.]
Contains process information.
Syntax
typedef struct _PEB {
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[1];
PVOID Reserved3[2];
PPEB_LDR_DATA Ldr;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
PVOID Reserved4[3];
PVOID AtlThunkSListPtr;
PVOID Reserved5;
ULONG Reserved6;
PVOID Reserved7;
ULONG Reserved8;
ULONG AtlThunkSListPtr32;
PVOID Reserved9[45];
BYTE Reserved10[96];
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
BYTE Reserved11[128];
PVOID Reserved12[1];
ULONG SessionId;
} PEB, *PPEB;
Members
Reserved1[2]
Reserved for internal use by the operating system.
BeingDebugged
Indicates whether the specified process is currently being debugged. The PEB structure, however, is an internal operating-system structure whose layout may change in the future. It is best to use the CheckRemoteDebuggerPresent function instead.
Reserved2[1]
Reserved for internal use by the operating system.
Reserved3[2]
Reserved for internal use by the operating system.
Ldr
A pointer to a PEB_LDR_DATA structure that contains information about the loaded modules for the process.
ProcessParameters
A pointer to an RTL_USER_PROCESS_PARAMETERS structure that contains process parameter information such as the command line.
Reserved4[3]
Reserved for internal use by the operating system.
AtlThunkSListPtr
Reserved5
Reserved for internal use by the operating system.
Reserved6
Reserved for internal use by the operating system.
Reserved7
Reserved for internal use by the operating system.
Reserved8
AtlThunkSListPtr32
Reserved9[45]
Reserved10[96]
PostProcessInitRoutine
Not supported.
Reserved11[128]
Reserved12[1]
SessionId
The Terminal Services session identifier associated with the current process.
Remarks
The syntax for this structure on 64-bit Windows is as follows:
typedef struct _PEB {
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[21];
PPEB_LDR_DATA LoaderData;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
BYTE Reserved3[520];
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
BYTE Reserved4[136];
ULONG SessionId;
} PEB;
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows XP [desktop apps only] |
| Minimum supported server | Windows Server 2003 [desktop apps only] |
| Header | winternl.h |