Min version2003/XP64 SP1Vista SP178 Pre RTM88.110 TH2
Max version2003/XP64 SP2Vista SP27 SP110
x64 offset
offset:bitpos
Field Name
0x0000uint8_t
InheritedAddressSpace
0x0001uint8_t
ReadImageFileExecOptions
0x0002uint8_t
BeingDebugged
0x0003uint8_t
BitField
0x0003:0x00uint8_t
ImageUsesLargePages
0x0003:0x01uint8_t
SpareBits
uint8_t
IsProtectedProcess
0x0003:0x02uint8_t
IsLegacyProcess
uint8_t
IsImageDynamicallyRelocated
0x0003:0x03uint8_t
IsImageDynamicallyRelocated
uint8_t
SkipPatchingUser32Forwarders
0x0003:0x04uint8_t
SkipPatchingUser32Forwarders
uint8_t
IsPackagedProcess
0x0003:0x05uint8_t
SpareBits
uint8_t
IsPackagedProcess
uint8_t
IsAppContainer
0x0003:0x06uint8_t
IsAppContainer
uint8_t
IsProtectedProcessLight
0x0003:0x07uint8_t
SpareBits
0x0004uint8_t[4]
Padding0
0x0008void *
Mutant
0x0010void *
ImageBaseAddress
0x0018struct _PEB_LDR_DATA *
Ldr
0x0020struct _RTL_USER_PROCESS_PARAMETERS *
ProcessParameters
0x0028void *
SubSystemData
0x0030void *
ProcessHeap
0x0038struct _RTL_CRITICAL_SECTION *
FastPebLock
0x0040void *
AtlThunkSListPtr
0x0048void *
SparePtr2
void *
IFEOKey
0x0050unsigned long
EnvironmentUpdateCount
unsigned long
CrossProcessFlags
0x0050:0x00unsigned long
ProcessInJob
0x0050:0x01unsigned long
ProcessInitializing
0x0050:0x02unsigned long
ProcessUsingVEH
0x0050:0x03unsigned long
ProcessUsingVCH
0x0050:0x04unsigned long
ReservedBits0
unsigned long
ProcessUsingFTH
0x0050:0x05unsigned long
ReservedBits0
0x0054uint8_t[4]
Padding1
0x0058void *
KernelCallbackTable
void *
KernelCallbackTable
0x0058void *
UserSharedInfoPtr
0x0060unsigned long[1]
SystemReserved
0x0064unsigned long
SpareUlong
unsigned long
AtlThunkSListPtr32
0x0068struct _PEB_FREE_BLOCK *
FreeList
uint64_t
SparePebPtr0
void *
ApiSetMap
0x0070unsigned long
TlsExpansionCounter
0x0074uint8_t[4]
Padding2
0x0078void *
TlsBitmap
0x0080unsigned long[2]
TlsBitmapBits
0x0088void *
ReadOnlySharedMemoryBase
0x0090void *
ReadOnlySharedMemoryHeap
void *
HotpatchInformation
void *
SparePvoid0
0x0098void * *
ReadOnlyStaticServerData
0x00A0void *
AnsiCodePageData
0x00A8void *
OemCodePageData
0x00B0void *
UnicodeCaseTableData
0x00B8unsigned long
NumberOfProcessors
0x00BCunsigned long
NtGlobalFlag
0x00C0union _LARGE_INTEGER
CriticalSectionTimeout
0x00C8uint64_t
HeapSegmentReserve
0x00D0uint64_t
HeapSegmentCommit
0x00D8uint64_t
HeapDeCommitTotalFreeThreshold
0x00E0uint64_t
HeapDeCommitFreeBlockThreshold
0x00E8unsigned long
NumberOfHeaps
0x00ECunsigned long
MaximumNumberOfHeaps
0x00F0void * *
ProcessHeaps
0x00F8void *
GdiSharedHandleTable
0x0100void *
ProcessStarterHelper
0x0108unsigned long
GdiDCAttributeList
0x010Cuint8_t[4]
Padding3
0x0110struct _RTL_CRITICAL_SECTION *
LoaderLock
0x0118unsigned long
OSMajorVersion
0x011Cunsigned long
OSMinorVersion
0x0120uint16_t
OSBuildNumber
0x0122uint16_t
OSCSDVersion
0x0124unsigned long
OSPlatformId
0x0128unsigned long
ImageSubsystem
0x012Cunsigned long
ImageSubsystemMajorVersion
0x0130unsigned long
ImageSubsystemMinorVersion
0x0134uint8_t[4]
Padding4
0x0138uint64_t
ImageProcessAffinityMask
uint64_t
ActiveProcessAffinityMask
0x0140unsigned long[60]
GdiHandleBuffer
0x0230function *
PostProcessInitRoutine
0x0238void *
TlsExpansionBitmap
0x0240unsigned long[32]
TlsExpansionBitmapBits
0x02C0unsigned long
SessionId
0x02C4uint8_t[4]
Padding5
0x02C8union _ULARGE_INTEGER
AppCompatFlags
0x02D0union _ULARGE_INTEGER
AppCompatFlagsUser
0x02D8void *
pShimData
0x02E0void *
AppCompatInfo
0x02E8struct _UNICODE_STRING
CSDVersion
0x02F8const struct _ACTIVATION_CONTEXT_DATA *
ActivationContextData
0x0300struct _ASSEMBLY_STORAGE_MAP *
ProcessAssemblyStorageMap
0x0308const struct _ACTIVATION_CONTEXT_DATA *
SystemDefaultActivationContextData
0x0310struct _ASSEMBLY_STORAGE_MAP *
SystemAssemblyStorageMap
0x0318uint64_t
MinimumStackCommit
0x0320void * *
FlsCallback
struct _FLS_CALLBACK_INFO *
FlsCallback
0x0328struct _LIST_ENTRY
FlsListHead
0x0338void *
FlsBitmap
0x0340unsigned long[4]
FlsBitmapBits
0x0350unsigned long
FlsHighIndex
0x0358void *
WerRegistrationData
0x0360void *
WerShipAssertPtr
0x0368void *
pContextData
void *
pUnused
0x0370void *
pImageHeaderHash
0x0378unsigned long
TracingFlags
0x0378:0x00unsigned long
HeapTracingEnabled
0x0378:0x01unsigned long
CritSecTracingEnabled
0x0378:0x02unsigned long
SpareTracingBits
unsigned long
LibLoaderTracingEnabled
0x0378:0x03unsigned long
SpareTracingBits
0x037Cuint8_t[4]
Padding6
0x0380uint64_t
CsrServerReadOnlySharedMemoryBase
0x0388uint64_t
TppWorkerpListLock
0x0390struct _LIST_ENTRY
TppWorkerpList
0x03A0void *[128]
WaitOnAddressHashTable