--- /dev/null
- UCHAR SpareBytes1[0x30 - 3 * sizeof(PTR(PVOID)];
+
+ #define PASTE2(x,y) x##y
+ #define PASTE(x,y) PASTE2(x,y)
+
+ #ifdef EXPLICIT_32BIT
+ #define STRUCT(x) PASTE(x,32)
+ #define PTR(x) ULONG
+ #elif defined(EXPLICIT_64BIT)
+ #define STRUCT(x) PASTE(x,64)
+ #define PTR(x) ULONG64
+ #else
+ #define STRUCT(x) x
+ #define PTR(x) x
+ #endif
+
+ #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
+ #define GDI_HANDLE_BUFFER_SIZE 60
+ #else
+ #define GDI_HANDLE_BUFFER_SIZE 34
+ #endif
+
+ typedef struct STRUCT(_PEB)
+ {
+ BOOLEAN InheritedAddressSpace;
+ BOOLEAN ReadImageFileExecOptions;
+ BOOLEAN BeingDebugged;
+ #if (NTDDI_VERSION >= NTDDI_WS03)
+ union
+ {
+ BOOLEAN BitField;
+ struct
+ {
+ BOOLEAN ImageUsesLargePages:1;
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ BOOLEAN IsProtectedProcess:1;
+ BOOLEAN IsLegacyProcess:1;
+ BOOLEAN IsImageDynamicallyRelocated:1;
+ BOOLEAN SkipPatchingUser32Forwarders:1;
+ BOOLEAN SpareBits:3;
+ #else
+ BOOLEAN SpareBits:7;
+ #endif
+ };
+ };
+ #else
+ BOOLEAN SpareBool;
+ #endif
+ PTR(HANDLE) Mutant;
+ PTR(PVOID) ImageBaseAddress;
+ PTR(PPEB_LDR_DATA) Ldr;
+ PTR(struct _RTL_USER_PROCESS_PARAMETERS*) ProcessParameters;
+ PTR(PVOID) SubSystemData;
+ PTR(PVOID) ProcessHeap;
+ PTR(struct _RTL_CRITICAL_SECTION*) FastPebLock;
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PTR(PVOID) AltThunkSListPtr;
+ PTR(PVOID) IFEOKey;
+ union
+ {
+ ULONG CrossProcessFlags;
+ struct
+ {
+ ULONG ProcessInJob:1;
+ ULONG ProcessInitializing:1;
+ ULONG ProcessUsingVEH:1;
+ ULONG ProcessUsingVCH:1;
+ ULONG ReservedBits0:28;
+ };
+ };
+ union
+ {
+ PTR(PVOID) KernelCallbackTable;
+ PTR(PVOID) UserSharedInfoPtr;
+ };
+ #elif (NTDDI_VERSION >= NTDDI_WS03)
+ PTR(PVOID) AltThunkSListPtr;
+ PTR(PVOID) SparePtr2;
+ ULONG EnvironmentUpdateCount;
+ PTR(PVOID) KernelCallbackTable;
+ #else
+ PTR(PPEBLOCKROUTINE) FastPebLockRoutine;
+ PTR(PPEBLOCKROUTINE) FastPebUnlockRoutine;
+ ULONG EnvironmentUpdateCount;
+ PTR(PVOID) KernelCallbackTable;
+ #endif
+ ULONG SystemReserved[1];
+ ULONG SpareUlong; // AtlThunkSListPtr32
+ PTR(PPEB_FREE_BLOCK) FreeList;
+ ULONG TlsExpansionCounter;
+ PTR(PVOID) TlsBitmap;
+ ULONG TlsBitmapBits[2];
+ PTR(PVOID) ReadOnlySharedMemoryBase;
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PTR(PVOID) HotpatchInformation;
+ #else
+ PTR(PVOID) ReadOnlySharedMemoryHeap;
+ #endif
+ PTR(PVOID*) ReadOnlyStaticServerData;
+ PTR(PVOID) AnsiCodePageData;
+ PTR(PVOID) OemCodePageData;
+ PTR(PVOID) UnicodeCaseTableData;
+ ULONG NumberOfProcessors;
+ ULONG NtGlobalFlag;
+ LARGE_INTEGER CriticalSectionTimeout;
+ PTR(ULONG_PTR) HeapSegmentReserve;
+ PTR(ULONG_PTR) HeapSegmentCommit;
+ PTR(ULONG_PTR) HeapDeCommitTotalFreeThreshold;
+ PTR(ULONG_PTR) HeapDeCommitFreeBlockThreshold;
+ ULONG NumberOfHeaps;
+ ULONG MaximumNumberOfHeaps;
+ PTR(PVOID*) ProcessHeaps;
+ PTR(PVOID) GdiSharedHandleTable;
+ PTR(PVOID) ProcessStarterHelper;
+ ULONG GdiDCAttributeList;
+ PTR(struct _RTL_CRITICAL_SECTION*) LoaderLock;
+ ULONG OSMajorVersion;
+ ULONG OSMinorVersion;
+ USHORT OSBuildNumber;
+ USHORT OSCSDVersion;
+ ULONG OSPlatformId;
+ ULONG ImageSubsystem;
+ ULONG ImageSubsystemMajorVersion;
+ ULONG ImageSubsystemMinorVersion;
+ PTR(ULONG_PTR) ImageProcessAffinityMask;
+ ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE];
+ PTR(PPOST_PROCESS_INIT_ROUTINE) PostProcessInitRoutine;
+ PTR(PVOID) TlsExpansionBitmap;
+ ULONG TlsExpansionBitmapBits[32];
+ ULONG SessionId;
+ #if (NTDDI_VERSION >= NTDDI_WINXP)
+ ULARGE_INTEGER AppCompatFlags;
+ ULARGE_INTEGER AppCompatFlagsUser;
+ PTR(PVOID) pShimData;
+ PTR(PVOID) AppCompatInfo;
+ STRUCT(UNICODE_STRING) CSDVersion;
+ PTR(struct _ACTIVATION_CONTEXT_DATA*) ActivationContextData;
+ PTR(struct _ASSEMBLY_STORAGE_MAP*) ProcessAssemblyStorageMap;
+ PTR(struct _ACTIVATION_CONTEXT_DATA*) SystemDefaultActivationContextData;
+ PTR(struct _ASSEMBLY_STORAGE_MAP*) SystemAssemblyStorageMap;
+ PTR(ULONG_PTR) MinimumStackCommit;
+ #endif
+ #if (NTDDI_VERSION >= NTDDI_WS03)
+ PTR(PVOID*) FlsCallback;
+ STRUCT(LIST_ENTRY) FlsListHead;
+ PTR(PVOID) FlsBitmap;
+ ULONG FlsBitmapBits[4];
+ ULONG FlsHighIndex;
+ #endif
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PTR(PVOID) WerRegistrationData;
+ PTR(PVOID) WerShipAssertPtr;
+ #endif
+ } STRUCT(PEB), *STRUCT(PPEB);
+
+
+ #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x08);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x18);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x038);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x070);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x0BC);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x0F8);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x110);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x128);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x138);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x230);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x2C0);
++#if (NTDDI_VERSION >= NTDDI_WS03)
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x350);
++#endif
+ #else
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x04);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x0C);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x01C);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x03C);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x068);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x094);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x0A0);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x0B4);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x0C0);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x14C);
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x1D4);
++#if (NTDDI_VERSION >= NTDDI_WS03)
+ C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x22C);
+ #endif
++#endif
+
+ //
+ // GDI Batch Descriptor
+ //
+ typedef struct STRUCT(_GDI_TEB_BATCH)
+ {
+ ULONG Offset;
+ PTR(HANDLE) HDC;
+ ULONG Buffer[0x136];
+ } STRUCT(GDI_TEB_BATCH), *STRUCT(PGDI_TEB_BATCH);
+
+ //
+ // Thread Environment Block (TEB)
+ //
+ typedef struct STRUCT(_TEB)
+ {
+ STRUCT(NT_TIB) NtTib;
+ PTR(PVOID) EnvironmentPointer;
+ STRUCT(CLIENT_ID) ClientId;
+ PTR(PVOID) ActiveRpcHandle;
+ PTR(PVOID) ThreadLocalStoragePointer;
+ PTR(STRUCT(PPEB)) ProcessEnvironmentBlock;
+ ULONG LastErrorValue;
+ ULONG CountOfOwnedCriticalSections;
+ PTR(PVOID) CsrClientThread;
+ PTR(PVOID) Win32ThreadInfo;
+ ULONG User32Reserved[26];
+ ULONG UserReserved[5];
+ PTR(PVOID) WOW32Reserved;
+ LCID CurrentLocale;
+ ULONG FpSoftwareStatusRegister;
+ PTR(PVOID) SystemReserved1[54];
+ LONG ExceptionCode;
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
- PTR(PVOID) Instrumentation[9];
++ UCHAR SpareBytes1[0x30 - 3 * sizeof(PTR(PVOID))];
+ ULONG TxFsContext;
+ #elif (NTDDI_VERSION >= NTDDI_WS03)
+ PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
+ UCHAR SpareBytes1[0x34 - 3 * sizeof(PTR(PVOID))];
+ #else
+ ACTIVATION_CONTEXT_STACK ActivationContextStack;
+ UCHAR SpareBytes1[24];
+ #endif
+ STRUCT(GDI_TEB_BATCH) GdiTebBatch;
+ STRUCT(CLIENT_ID) RealClientId;
+ PTR(PVOID) GdiCachedProcessHandle;
+ ULONG GdiClientPID;
+ ULONG GdiClientTID;
+ PTR(PVOID) GdiThreadLocalInfo;
+ PTR(SIZE_T) Win32ClientInfo[62];
+ PTR(PVOID) glDispatchTable[233];
+ PTR(SIZE_T) glReserved1[29];
+ PTR(PVOID) glReserved2;
+ PTR(PVOID) glSectionInfo;
+ PTR(PVOID) glSection;
+ PTR(PVOID) glTable;
+ PTR(PVOID) glCurrentRC;
+ PTR(PVOID) glContext;
+ NTSTATUS LastStatusValue;
+ STRUCT(UNICODE_STRING) StaticUnicodeString;
+ WCHAR StaticUnicodeBuffer[261];
+ PTR(PVOID) DeallocationStack;
+ PTR(PVOID) TlsSlots[64];
+ STRUCT(LIST_ENTRY) TlsLinks;
+ PTR(PVOID) Vdm;
+ PTR(PVOID) ReservedForNtRpc;
+ PTR(PVOID) DbgSsReserved[2];
+ #if (NTDDI_VERSION >= NTDDI_WS03)
+ ULONG HardErrorMode;
+ #else
+ ULONG HardErrorsAreDisabled;
+ #endif
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
-C_ASSERT(FIELD_OFFSET(STRUCT(TEB), SubProcessTag) == 0x1728);
++ PTR(PVOID) Instrumentation[13 - sizeof(GUID)/sizeof(PTR(PVOID))];
+ GUID ActivityId;
+ PTR(PVOID) SubProcessTag;
+ PTR(PVOID) EtwLocalData;
++ PTR(PVOID) EtwTraceData;
+ #elif (NTDDI_VERSION >= NTDDI_WS03)
+ PTR(PVOID) Instrumentation[14];
+ PTR(PVOID) SubProcessTag;
+ PTR(PVOID) EtwLocalData;
+ #else
+ PTR(PVOID) Instrumentation[16];
+ #endif
+ PTR(PVOID) WinSockData;
+ ULONG GdiBatchCount;
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ BOOLEAN SpareBool0;
+ BOOLEAN SpareBool1;
+ BOOLEAN SpareBool2;
+ #else
+ BOOLEAN InDbgPrint;
+ BOOLEAN FreeStackOnTermination;
+ BOOLEAN HasFiberData;
+ #endif
+ UCHAR IdealProcessor;
+ #if (NTDDI_VERSION >= NTDDI_WS03)
+ ULONG GuaranteedStackBytes;
+ #else
+ ULONG Spare3;
+ #endif
+ PTR(PVOID) ReservedForPerf;
+ PTR(PVOID) ReservedForOle;
+ ULONG WaitingOnLoaderLock;
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PTR(PVOID) SavedPriorityState;
+ PTR(ULONG_PTR) SoftPatchPtr1;
+ PTR(ULONG_PTR) ThreadPoolData;
+ #elif (NTDDI_VERSION >= NTDDI_WS03)
+ PTR(ULONG_PTR) SparePointer1;
+ PTR(ULONG_PTR) SoftPatchPtr1;
+ PTR(ULONG_PTR) SoftPatchPtr2;
+ #else
+ Wx86ThreadState Wx86Thread;
+ #endif
+ PTR(PVOID*) TlsExpansionSlots;
+ #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
+ PTR(PVOID) DeallocationBStore;
+ PTR(PVOID) BStoreLimit;
+ #endif
+ ULONG ImpersonationLocale;
+ ULONG IsImpersonating;
+ PTR(PVOID) NlsCache;
+ PTR(PVOID) pShimData;
+ ULONG HeapVirtualAffinity;
+ PTR(HANDLE) CurrentTransactionHandle;
+ PTR(PTEB_ACTIVE_FRAME) ActiveFrame;
+ #if (NTDDI_VERSION >= NTDDI_WS03)
+ PVOID FlsData;
+ #endif
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PVOID PreferredLangauges;
+ PVOID UserPrefLanguages;
+ PVOID MergedPrefLanguages;
+ ULONG MuiImpersonation;
+ union
+ {
+ struct
+ {
+ USHORT SpareCrossTebFlags:16;
+ };
+ USHORT CrossTebFlags;
+ };
+ union
+ {
+ struct
+ {
+ USHORT DbgSafeThunkCall:1;
+ USHORT DbgInDebugPrint:1;
+ USHORT DbgHasFiberData:1;
+ USHORT DbgSkipThreadAttach:1;
+ USHORT DbgWerInShipAssertCode:1;
+ USHORT DbgIssuedInitialBp:1;
+ USHORT DbgClonedThread:1;
+ USHORT SpareSameTebBits:9;
+ };
+ USHORT SameTebFlags;
+ };
+ PTR(PVOID) TxnScopeEntercallback;
+ PTR(PVOID) TxnScopeExitCAllback;
+ PTR(PVOID) TxnScopeContext;
+ ULONG LockCount;
+ ULONG ProcessRundown;
+ ULONG64 LastSwitchTime;
+ ULONG64 TotalSwitchOutTime;
+ LARGE_INTEGER WaitReasonBitMap;
+ #else
+ BOOLEAN SafeThunkCall;
+ BOOLEAN BooleanSpare[3];
+ #endif
+ } STRUCT(TEB), *STRUCT(PTEB);
+
+ #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x038);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x2C0);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x2F0);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0x1250);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0x1690);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), HardErrorMode) == 0x16B0);
-C_ASSERT(FIELD_OFFSET(STRUCT(TEB), HardErrorMode) == 0xF28);
-C_ASSERT(FIELD_OFFSET(STRUCT(TEB), SubProcessTag) == 0xF64);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0x1740);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), IdealProcessor) == 0x1747);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0x1780);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0x17C0);
+ #else
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x01C);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x1A4);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x1D4);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0xBF4);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0xF18);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0xF70);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0xF94);
+ C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0xFB0);
+ #endif
+
+ #undef PTR
+ #undef STRUCT
+ #undef PASTE
+ #undef PASTE2
+ #undef GDI_HANDLE_BUFFER_SIZE
#include <ldrtypes.h>
#include <mmtypes.h>
#include <obtypes.h>
++#include <rtltypes.h>
#ifndef NTOS_MODE_USER
#include <extypes.h>
#include <setypes.h>
PTEB_ACTIVE_FRAME_CONTEXT Context;
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
+ typedef struct _CLIENT_ID32
+ {
+ ULONG UniqueProcess;
+ ULONG UniqueThread;
+ } CLIENT_ID32, *PCLIENT_ID32;
+
+ typedef struct _CLIENT_ID64
+ {
+ ULONG64 UniqueProcess;
+ ULONG64 UniqueThread;
+ } CLIENT_ID64, *PCLIENT_ID64;
+
++#if (NTDDI_VERSION < NTDDI_WS03)
++typedef struct _Wx86ThreadState
++{
++ PULONG CallBx86Eip;
++ PVOID DeallocationCpu;
++ BOOLEAN UseKnownWx86Dll;
++ CHAR OleStubInvoked;
++} Wx86ThreadState, *PWx86ThreadState;
++#endif
++
++
//
+ // Process Environment Block (PEB)
// Thread Environment Block (TEB)
//
- typedef struct _TEB
- {
- NT_TIB Tib;
- PVOID EnvironmentPointer;
- CLIENT_ID ClientId;
- PVOID ActiveRpcHandle;
- PVOID ThreadLocalStoragePointer;
- struct _PEB *ProcessEnvironmentBlock;
- ULONG LastErrorValue;
- ULONG CountOfOwnedCriticalSections;
- PVOID CsrClientThread;
- struct _W32THREAD* Win32ThreadInfo;
- ULONG User32Reserved[0x1A];
- ULONG UserReserved[5];
- PVOID WOW32Reserved;
- LCID CurrentLocale;
- ULONG FpSoftwareStatusRegister;
- PVOID SystemReserved1[0x36];
- LONG ExceptionCode;
- struct _ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;
- #ifdef _WIN64
- UCHAR SpareBytes1[24];
- #else
- UCHAR SpareBytes1[0x24];
- #endif
- ULONG TxFsContext;
- GDI_TEB_BATCH GdiTebBatch;
- CLIENT_ID RealClientId;
- PVOID GdiCachedProcessHandle;
- ULONG GdiClientPID;
- ULONG GdiClientTID;
- PVOID GdiThreadLocalInfo;
- SIZE_T Win32ClientInfo[62];
- PVOID glDispatchTable[0xE9];
- SIZE_T glReserved1[0x1D];
- PVOID glReserved2;
- PVOID glSectionInfo;
- PVOID glSection;
- PVOID glTable;
- PVOID glCurrentRC;
- PVOID glContext;
- NTSTATUS LastStatusValue;
- UNICODE_STRING StaticUnicodeString;
- WCHAR StaticUnicodeBuffer[0x105];
- PVOID DeallocationStack;
- PVOID TlsSlots[0x40];
- LIST_ENTRY TlsLinks;
- PVOID Vdm;
- PVOID ReservedForNtRpc;
- PVOID DbgSsReserved[0x2];
- ULONG HardErrorDisabled;
+ #include "peb_teb.h"
+
#ifdef _WIN64
- PVOID Instrumentation[11];
- #else
- PVOID Instrumentation[9];
- #endif
- GUID ActivityId;
- PVOID SubProcessTag;
- PVOID EtwTraceData;
- #if (NTDDI_VERSION >= NTDDI_LONGHORN)
- PVOID EtwLocalData;
- #endif
- PVOID WinSockData;
- ULONG GdiBatchCount;
- #if (NTDDI_VERSION >= NTDDI_LONGHORN)
- BOOLEAN SpareBool0;
- BOOLEAN SpareBool1;
- BOOLEAN SpareBool2;
- #else
- BOOLEAN InDbgPrint;
- BOOLEAN FreeStackOnTermination;
- BOOLEAN HasFiberData;
- #endif
- UCHAR IdealProcessor;
- ULONG GuaranteedStackBytes;
- PVOID ReservedForPerf;
- PVOID ReservedForOle;
- ULONG WaitingOnLoaderLock;
- #if (NTDDI_VERSION >= NTDDI_LONGHORN)
- PVOID SavedPriorityState;
- #else
- ULONG SparePointer1;
- #endif
- ULONG SoftPatchPtr1;
- ULONG SoftPatchPtr2;
- PVOID *TlsExpansionSlots;
- ULONG ImpersonationLocale;
- ULONG IsImpersonating;
- PVOID NlsCache;
- PVOID pShimData;
- ULONG HeapVirualAffinity;
- PVOID CurrentTransactionHandle;
- PTEB_ACTIVE_FRAME ActiveFrame;
- #if (NTDDI_VERSION >= NTDDI_WS03)
- PVOID FlsData;
- #endif
- #if (NTDDI_VERSION >= NTDDI_LONGHORN)
- PVOID PreferredLangauges;
- PVOID UserPrefLanguages;
- PVOID MergedPrefLanguages;
- ULONG MuiImpersonation;
- union
- {
- struct
- {
- USHORT SpareCrossTebFlags:16;
- };
- USHORT CrossTebFlags;
- };
- union
- {
- struct
- {
- USHORT DbgSafeThunkCall:1;
- USHORT DbgInDebugPrint:1;
- USHORT DbgHasFiberData:1;
- USHORT DbgSkipThreadAttach:1;
- USHORT DbgWerInShipAssertCode:1;
- USHORT DbgIssuedInitialBp:1;
- USHORT DbgClonedThread:1;
- USHORT SpareSameTebBits:9;
- };
- USHORT SameTebFlags;
- };
- PVOID TxnScopeEntercallback;
- PVOID TxnScopeExitCAllback;
- PVOID TxnScopeContext;
- ULONG LockCount;
- ULONG ProcessRundown;
- ULONGLONG LastSwitchTime;
- ULONGLONG TotalSwitchOutTime;
- LARGE_INTEGER WaitReasonBitMap;
- #else
- UCHAR SafeThunkCall;
- UCHAR BooleanSpare[3];
+ //
+ // Explicit 32 bit PEB/TEB
+ //
+ #define EXPLICIT_32BIT
+ #include "peb_teb.h"
+ #undef EXPLICIT_32BIT
+
+ //
+ // Explicit 64 bit PEB/TEB
+ //
+ #define EXPLICIT_64BIT
+ #include "peb_teb.h"
+ #undef EXPLICIT_64BIT
#endif
- } TEB, *PTEB;
#ifdef NTOS_MODE_USER