/* * Process and Thread Environment Block support functions * * This file is part of System Informer. */ #ifndef _NTPEBTEB_H #define _NTPEBTEB_H #ifdef __has_include #if __has_include () #include #endif // __has_include #if __has_include () #include #endif // __has_include #endif // __has_include typedef struct _APPCOMPAT_EXE_DATA APPCOMPAT_EXE_DATA, *PAPPCOMPAT_EXE_DATA; typedef struct _RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS; typedef struct _RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION; typedef struct _SILO_USER_SHARED_DATA *PSILO_USER_SHARED_DATA; typedef struct _LDR_RESLOADER_RET LDR_RESLOADER_RET, *PLDR_RESLOADER_RET; typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA; typedef struct _PEB_LDR_DATA PEB_LDR_DATA, *PPEB_LDR_DATA; typedef struct tagSOleTlsData SOleTlsData, *PSOleTlsData; typedef struct _KERNEL_CALLBACK_TABLE KERNEL_CALLBACK_TABLE, *PKERNEL_CALLBACK_TABLE; typedef struct _GDI_HANDLE_ENTRY GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY; typedef struct _SHIM_PROCESS_CONTEXT SHIM_PROCESS_CONTEXT, *PSHIM_PROCESS_CONTEXT; typedef struct _HEAP HEAP, *PHEAP; // PEB->AppCompatFlags #define KACF_OLDGETSHORTPATHNAME 0x00000001 #define KACF_VERSIONLIE_NOT_USED 0x00000002 #define KACF_GETTEMPPATH_NOT_USED 0x00000004 #define KACF_GETDISKFREESPACE 0x00000008 #define KACF_APPCOMPATFLAG_BIT4 0x00000010 #define KACF_FTMFROMCURRENTAPT 0x00000020 #define KACF_DISALLOWORBINDINGCHANGES 0x00000040 #define KACF_OLE32VALIDATEPTRS 0x00000080 #define KACF_DISABLECICERO 0x00000100 #define KACF_OLE32ENABLEASYNCDOCFILE 0x00000200 #define KACF_OLE32ENABLELEGACYEXCEPTIONHANDLING 0x00000400 #define KACF_RPCDISABLENDRCLIENTHARDENING 0x00000800 #define KACF_RPCDISABLENDRMAYBENULL_SIZEIS 0x00001000 #define KACF_DISABLEALLDDEHACK_NOT_USED 0x00002000 #define KACF_RPCDISABLENDR61_RANGE 0x00004000 #define KACF_RPC32ENABLELEGACYEXCEPTIONHANDLING 0x00008000 #define KACF_OLE32DOCFILEUSELEGACYNTFSFLAGS 0x00010000 #define KACF_RPCDISABLENDRCONSTIIDCHECK 0x00020000 #define KACF_USERDISABLEFORWARDERPATCH 0x00040000 #define KACF_APPCOMPATFLAG_BIT19 0x00080000 #define KACF_OLE32DISABLENEW_WMPAINT_DISPATCH 0x00100000 #define KACF_ADDRESTRICTEDSIDINCOINITIALIZESECURITY 0x00200000 #define KACF_ALLOCDEBUGINFOFORCRITSECTIONS 0x00400000 #define KACF_OLEAUT32ENABLEUNSAFELOADTYPELIBRELATIVE 0x00800000 #define KACF_ALLOWMAXIMIZEDWINDOWGAMMA 0x01000000 #define KACF_DONOTADDTOCACHE 0x80000000 #define KACF_DISABLEPOSIXDELETEFILE 0x100000000 // rev KernelBase!InternalDeleteFileW #define KACF_ENABLE_PROCESS_SYSTEMDPIAWARENESS 0x20000000000000 // rev // Enable Per-Process System DPI Awareness and Opt-in to Per-Process System DPI mode. #define KACF_DISABLE_PROCESS_SYSTEMDPIAWARENESS 0x40000000000000 // rev // Disable Per-Process System DPI Awareness and force legacy DPI behavior. #define KACF_ENABLE_GDI_DPI_SCALING 0x800000000000000 #define KACF_FORCE_DISABLE_GDI_SCALING 0x4000000000000000 // PEB->CrossProcessFlags #define PEB_FLAG_PROCESS_IN_JOB 0x00000001 // Process is part of a job #define PEB_FLAG_PROCESS_INITIALIZING 0x00000002 // Process is initializing #define PEB_FLAG_PROCESS_USING_VEH 0x00000004 // Process is using VEH #define PEB_FLAG_PROCESS_USING_VCH 0x00000008 // Process is using VCH #define PEB_FLAG_PROCESS_USING_FTH 0x00000010 // Process is using FTH #define PEB_FLAG_PROCESS_PREVIOUSLY_THROTTLED 0x00000020 // Process was previously throttled #define PEB_FLAG_PROCESS_CURRENTLY_THROTTLED 0x00000040 // Process is currently throttled #define PEB_FLAG_PROCESS_IMAGES_HOT_PATCHED 0x00000080 // Process images are hot patched (RS5+) // private #define API_SET_SECTION_NAME ".apiset" // private #define API_SET_SCHEMA_VERSION_V2 0x00000002 // WIN7, WIN8 #define API_SET_SCHEMA_VERSION_V4 0x00000004 // WINBLUE #define API_SET_SCHEMA_VERSION_V6 0x00000006 // since THRESHOLD #define API_SET_SCHEMA_VERSION API_SET_SCHEMA_VERSION_V6 // private #define API_SET_SCHEMA_FLAGS_SEALED 0x00000001 #define API_SET_SCHEMA_FLAGS_HOST_EXTENSION 0x00000002 // private #define API_SET_SCHEMA_ENTRY_FLAGS_SEALED 0x00000001 #define API_SET_SCHEMA_ENTRY_FLAGS_EXTENSION 0x00000002 // private typedef struct _API_SET_VALUE_ENTRY_V2 { ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base ULONG NameLength; ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base ULONG ValueLength; } API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2; // private typedef struct _API_SET_VALUE_ARRAY_V2 { ULONG Count; _Field_size_full_(Count) API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY]; } API_SET_VALUE_ARRAY_V2, *PAPI_SET_VALUE_ARRAY_V2; // private typedef struct _API_SET_NAMESPACE_ENTRY_V2 { ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base ULONG NameLength; ULONG DataOffset; // to API_SET_VALUE_ARRAY_V2, from schema base } API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2; // private // PEB->ApiSetMap on WIN7, WIN8 typedef struct _API_SET_NAMESPACE_ARRAY_V2 { ULONG Version; // API_SET_SCHEMA_VERSION_V2 ULONG Count; _Field_size_full_(Count) API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY]; } API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2; // private typedef struct _API_SET_VALUE_ENTRY_V4 { ULONG Flags; ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base ULONG NameLength; ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base ULONG ValueLength; } API_SET_VALUE_ENTRY_V4, *PAPI_SET_VALUE_ENTRY_V4; // private typedef struct _API_SET_VALUE_ARRAY_V4 { ULONG Flags; ULONG Count; _Field_size_full_(Count) API_SET_VALUE_ENTRY_V4 Array[ANYSIZE_ARRAY]; } API_SET_VALUE_ARRAY_V4, *PAPI_SET_VALUE_ARRAY_V4; // private typedef struct _API_SET_NAMESPACE_ENTRY_V4 { ULONG Flags; // API_SET_SCHEMA_ENTRY_FLAGS_* ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base ULONG NameLength; ULONG AliasOffset; // to WCHAR[AliasLength / sizeof(WCHAR)], from schema base ULONG AliasLength; ULONG DataOffset; // to API_SET_VALUE_ARRAY_V4, from schema base } API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4; // private // PEB->ApiSetMap on WINBLUE typedef struct _API_SET_NAMESPACE_ARRAY_V4 { ULONG Version; // API_SET_SCHEMA_VERSION_V4 ULONG Size; ULONG Flags; // API_SET_SCHEMA_FLAGS_* ULONG Count; _Field_size_full_(Count) API_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY]; } API_SET_NAMESPACE_ARRAY_V4, *PAPI_SET_NAMESPACE_ARRAY_V4; // private typedef struct _API_SET_VALUE_ENTRY { ULONG Flags; ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base ULONG NameLength; ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base ULONG ValueLength; } API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY; // private typedef struct _API_SET_NAMESPACE_ENTRY { ULONG Flags; // API_SET_SCHEMA_ENTRY_FLAGS_* ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base ULONG NameLength; ULONG HashedLength; ULONG ValueOffset; // to API_SET_VALUE_ENTRY[ValueCount], from schema base ULONG ValueCount; } API_SET_NAMESPACE_ENTRY, *PAPI_SET_NAMESPACE_ENTRY; // private typedef struct _API_SET_HASH_ENTRY { ULONG Hash; ULONG Index; } API_SET_HASH_ENTRY, *PAPI_SET_HASH_ENTRY; // private // PEB->ApiSetMap since THRESHOLD typedef struct _API_SET_NAMESPACE { ULONG Version; // API_SET_SCHEMA_VERSION_V6 ULONG Size; ULONG Flags; // API_SET_SCHEMA_FLAGS_* ULONG Count; ULONG EntryOffset; // to API_SET_NAMESPACE_ENTRY[Count], from this struct base ULONG HashOffset; // to API_SET_HASH_ENTRY[Count], from this struct base ULONG HashFactor; } API_SET_NAMESPACE, *PAPI_SET_NAMESPACE; // PEB->TelemetryCoverageHeader typedef struct _TELEMETRY_COVERAGE_HEADER { UCHAR MajorVersion; UCHAR MinorVersion; struct { USHORT TracingEnabled : 1; USHORT Reserved1 : 15; }; ULONG HashTableEntries; ULONG HashIndexMask; ULONG TableUpdateVersion; ULONG TableSizeInBytes; ULONG LastResetTick; ULONG ResetRound; ULONG Reserved2; ULONG RecordedCount; ULONG Reserved3[4]; ULONG HashTable[ANYSIZE_ARRAY]; } TELEMETRY_COVERAGE_HEADER, *PTELEMETRY_COVERAGE_HEADER; typedef struct _WER_RECOVERY_INFO { ULONG Length; PVOID Callback; PVOID Parameter; HANDLE Started; HANDLE Finished; HANDLE InProgress; LONG LastError; BOOL Successful; ULONG PingInterval; ULONG Flags; } WER_RECOVERY_INFO, *PWER_RECOVERY_INFO; typedef struct _WER_FILE { USHORT Flags; WCHAR Path[MAX_PATH]; } WER_FILE, *PWER_FILE; typedef struct _WER_MEMORY { PVOID Address; ULONG Size; } WER_MEMORY, *PWER_MEMORY; typedef struct _WER_GATHER { PVOID Next; USHORT Flags; union { WER_FILE File; WER_MEMORY Memory; } v; } WER_GATHER, *PWER_GATHER; typedef struct _WER_METADATA { PVOID Next; WCHAR Key[64]; WCHAR Value[128]; } WER_METADATA, *PWER_METADATA; typedef struct _WER_RUNTIME_DLL { PVOID Next; ULONG Length; PVOID Context; WCHAR CallbackDllPath[MAX_PATH]; } WER_RUNTIME_DLL, *PWER_RUNTIME_DLL; typedef struct _WER_DUMP_COLLECTION { PVOID Next; ULONG ProcessId; ULONG ThreadId; } WER_DUMP_COLLECTION, *PWER_DUMP_COLLECTION; typedef struct _WER_HEAP_MAIN_HEADER { WCHAR Signature[16]; LIST_ENTRY Links; HANDLE Mutex; PVOID FreeHeap; ULONG FreeCount; } WER_HEAP_MAIN_HEADER, *PWER_HEAP_MAIN_HEADER; #ifndef RESTART_MAX_CMD_LINE #define RESTART_MAX_CMD_LINE 1024 #endif typedef struct _WER_PEB_HEADER_BLOCK { LONG Length; WCHAR Signature[16]; WCHAR AppDataRelativePath[64]; WCHAR RestartCommandLine[RESTART_MAX_CMD_LINE]; WER_RECOVERY_INFO RecoveryInfo; PWER_GATHER Gather; PWER_METADATA MetaData; PWER_RUNTIME_DLL RuntimeDll; PWER_DUMP_COLLECTION DumpCollection; LONG GatherCount; LONG MetaDataCount; LONG DumpCount; LONG Flags; WER_HEAP_MAIN_HEADER MainHeader; PVOID Reserved; } WER_PEB_HEADER_BLOCK, *PWER_PEB_HEADER_BLOCK; #define GDI_HANDLE_BUFFER_SIZE32 34 #define GDI_HANDLE_BUFFER_SIZE64 60 #ifndef _WIN64 #define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32 #else #define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64 #endif typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE]; typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32]; typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64]; typedef _Function_class_(PS_POST_PROCESS_INIT_ROUTINE) VOID NTAPI PS_POST_PROCESS_INIT_ROUTINE( VOID ); typedef PS_POST_PROCESS_INIT_ROUTINE* PPS_POST_PROCESS_INIT_ROUTINE; #ifndef RTL_FLS_MAXIMUM_AVAILABLE #define RTL_FLS_MAXIMUM_AVAILABLE 128 #endif #ifndef FLS_MAXIMUM_AVAILABLE #define FLS_MAXIMUM_AVAILABLE 4080 #endif #ifndef TLS_MINIMUM_AVAILABLE #define TLS_MINIMUM_AVAILABLE 64 #endif #ifndef TLS_EXPANSION_SLOTS #define TLS_EXPANSION_SLOTS 1024 #endif /** * Process Environment Block (PEB) structure. * * \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb */ typedef struct _PEB { // // The process was cloned with an inherited address space. // BOOLEAN InheritedAddressSpace; // // The process has image file execution options (IFEO). // BOOLEAN ReadImageFileExecOptions; // // The process has a debugger attached. // BOOLEAN BeingDebugged; union { BOOLEAN BitField; struct { BOOLEAN ImageUsesLargePages : 1; // The process uses large image regions (4 MB). BOOLEAN IsProtectedProcess : 1; // The process is a protected process. BOOLEAN IsImageDynamicallyRelocated : 1; // The process image base address was relocated. BOOLEAN SkipPatchingUser32Forwarders : 1; // The process skipped forwarders for User32.dll functions. 1 for 64-bit, 0 for 32-bit. BOOLEAN IsPackagedProcess : 1; // The process is a packaged store process (APPX/MSIX). BOOLEAN IsAppContainerProcess : 1; // The process has an AppContainer token. BOOLEAN IsProtectedProcessLight : 1; // The process is a protected process (light). BOOLEAN IsLongPathAwareProcess : 1; // The process is long path aware. }; }; // // Handle to a mutex for synchronization. // HANDLE Mutant; // // Pointer to the base address of the process image. // PVOID ImageBaseAddress; // // Pointer to the process loader data. // PPEB_LDR_DATA Ldr; // // Pointer to the process parameters. // PRTL_USER_PROCESS_PARAMETERS ProcessParameters; // // Reserved. // PVOID SubSystemData; // // Pointer to the process default heap. // PHEAP ProcessHeap; // // Pointer to a critical section used to synchronize access to the PEB. // PRTL_CRITICAL_SECTION FastPebLock; // // Pointer to a singly linked list used by ATL. // PSLIST_HEADER AtlThunkSListPtr; // // Handle to the Image File Execution Options key. // HANDLE IFEOKey; // // Cross process flags. // union { ULONG CrossProcessFlags; struct { ULONG ProcessInJob : 1; // The process is part of a job. ULONG ProcessInitializing : 1; // The process is initializing. ULONG ProcessUsingVEH : 1; // The process is using VEH. ULONG ProcessUsingVCH : 1; // The process is using VCH. ULONG ProcessUsingFTH : 1; // The process is using FTH. ULONG ProcessPreviouslyThrottled : 1; // The process was previously throttled. ULONG ProcessCurrentlyThrottled : 1; // The process is currently throttled. ULONG ProcessImagesHotPatched : 1; // The process images are hot patched. // RS5 ULONG ReservedBits0 : 24; }; }; // // User32 KERNEL_CALLBACK_TABLE (ntuser.h) // union { PKERNEL_CALLBACK_TABLE KernelCallbackTable; PVOID UserSharedInfoPtr; }; // // Reserved. // ULONG SystemReserved; // // Pointer to the Active Template Library (ATL) singly linked list (32-bit) // ULONG AtlThunkSListPtr32; // // Pointer to the API Set Schema. // PAPI_SET_NAMESPACE ApiSetMap; // // Counter for TLS expansion. // ULONG TlsExpansionCounter; // // Pointer to the TLS bitmap. // PRTL_BITMAP TlsBitmap; // // Bits for the TLS bitmap. // ULONG TlsBitmapBits[2]; // // Reserved for CSRSS. // PVOID ReadOnlySharedMemoryBase; // // Pointer to the USER_SHARED_DATA for the current SILO. // PSILO_USER_SHARED_DATA SharedData; // // Reserved for CSRSS. // PVOID* ReadOnlyStaticServerData; // // Pointer to the ANSI code page data. // PCPTABLEINFO AnsiCodePageData; // // Pointer to the OEM code page data. // PCPTABLEINFO OemCodePageData; // // Pointer to the Unicode case table data. // PNLSTABLEINFO UnicodeCaseTableData; // // The total number of system processors. // ULONG NumberOfProcessors; // // Global flags for the system. // union { ULONG NtGlobalFlag; struct { ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS } NtGlobalFlags; }; // // Timeout for critical sections. // LARGE_INTEGER CriticalSectionTimeout; // // Reserved size for heap segments. // SIZE_T HeapSegmentReserve; // // Committed size for heap segments. // SIZE_T HeapSegmentCommit; // // Threshold for decommitting total free heap. // SIZE_T HeapDeCommitTotalFreeThreshold; // // Threshold for decommitting free heap blocks. // SIZE_T HeapDeCommitFreeBlockThreshold; // // Number of process heaps. // ULONG NumberOfHeaps; // // Maximum number of process heaps. // ULONG MaximumNumberOfHeaps; // // Pointer to an array of process heaps. ProcessHeaps is initialized // to point to the first free byte after the PEB and MaximumNumberOfHeaps // is computed from the page size used to hold the PEB, less the fixed // size of this data structure. // PVOID* ProcessHeaps; // // Pointer to the system GDI shared handle table. // PGDI_HANDLE_ENTRY GdiSharedHandleTable; // // Pointer to the process starter helper. // PVOID ProcessStarterHelper; // // The maximum number of GDI function calls during batch operations (GdiSetBatchLimit) // ULONG GdiDCAttributeList; // // Pointer to the loader lock critical section. // PRTL_CRITICAL_SECTION LoaderLock; // // Major version of the operating system. // ULONG OSMajorVersion; // // Minor version of the operating system. // ULONG OSMinorVersion; // // Build number of the operating system. // USHORT OSBuildNumber; // // CSD version of the operating system. // USHORT OSCSDVersion; // // Platform ID of the operating system. // ULONG OSPlatformId; // // Subsystem version of the current process image (PE Headers). // ULONG ImageSubsystem; // // Major version of the current process image subsystem (PE Headers). // ULONG ImageSubsystemMajorVersion; // // Minor version of the current process image subsystem (PE Headers). // ULONG ImageSubsystemMinorVersion; // // Affinity mask for the current process. // KAFFINITY ActiveProcessAffinityMask; // // Temporary buffer for GDI handles accumulated in the current batch. // GDI_HANDLE_BUFFER GdiHandleBuffer; // // Pointer to the post-process initialization routine available for use by the application. // PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine; // // Pointer to the TLS expansion bitmap. // PRTL_BITMAP TlsExpansionBitmap; // // Bits for the TLS expansion bitmap. TLS_EXPANSION_SLOTS // ULONG TlsExpansionBitmapBits[32]; // // Session ID of the current process. // ULONG SessionId; // // Application compatibility flags. KACF_* // ULARGE_INTEGER AppCompatFlags; // // Application compatibility flags. KACF_* // ULARGE_INTEGER AppCompatFlagsUser; // // Pointer to the Application SwitchBack Compatibility Engine. // PSHIM_PROCESS_CONTEXT pShimData; // // Pointer to the Application Compatibility Engine. // PAPPCOMPAT_EXE_DATA AppCompatInfo; // // CSD version string of the operating system. // UNICODE_STRING CSDVersion; // // Pointer to the process activation context. // PACTIVATION_CONTEXT_DATA ActivationContextData; // // Pointer to the process assembly storage map. // PASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap; // // Pointer to the system default activation context. // PACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData; // // Pointer to the system assembly storage map. // PASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap; // // Minimum stack commit size. // SIZE_T MinimumStackCommit; // // since 19H1 (previously FlsCallback to FlsHighIndex) // PVOID SparePointers[2]; // // Pointer to the patch loader data. // PVOID PatchLoaderData; // // Pointer to the CHPE V2 process information. CHPEV2_PROCESS_INFO // PVOID ChpeV2ProcessInfo; // // Packaged process feature state. // ULONG AppModelFeatureState; // // SpareUlongs // ULONG SpareUlongs[2]; // // Active code page. // USHORT ActiveCodePage; // // OEM code page. // USHORT OemCodePage; // // Code page case mapping. // USHORT UseCaseMapping; // // Unused NLS field. // USHORT UnusedNlsField; // // Pointer to the application WER registration data. // PWER_PEB_HEADER_BLOCK WerRegistrationData; // // Pointer to the application WER assert pointer. // PVOID WerShipAssertPtr; // // Pointer to the EC bitmap on ARM64. (Windows 11 and above) // union { PVOID pContextData; // Pointer to the switchback compatibility engine (Windows 7 and below) PVOID EcCodeBitMap; // Pointer to the EC bitmap on ARM64 (Windows 11 and above) // since WIN11 }; // // Reserved. // PVOID ImageHeaderHash; // // ETW tracing flags. // union { ULONG TracingFlags; struct { ULONG HeapTracingEnabled : 1; // ETW heap tracing enabled. ULONG CritSecTracingEnabled : 1; // ETW lock tracing enabled. ULONG LibLoaderTracingEnabled : 1; // ETW loader tracing enabled. ULONG SpareTracingBits : 29; }; }; // // Reserved for CSRSS. // ULONGLONG CsrServerReadOnlySharedMemoryBase; // // Pointer to the thread pool worker list lock. // PRTL_CRITICAL_SECTION TppWorkerpListLock; // // Pointer to the thread pool worker list. // LIST_ENTRY TppWorkerpList; // // Wait on address hash table. (RtlWaitOnAddress) // PVOID WaitOnAddressHashTable[128]; // // Pointer to the telemetry coverage header. // since RS3 // PTELEMETRY_COVERAGE_HEADER TelemetryCoverageHeader; // // Cloud file flags. (ProjFs and Cloud Files) // since RS4 // ULONG CloudFileFlags; // // Cloud file diagnostic flags. // ULONG CloudFileDiagFlags; // // Placeholder compatibility mode. (ProjFs and Cloud Files) // CHAR PlaceholderCompatibilityMode; // // Reserved for placeholder compatibility mode. // CHAR PlaceholderCompatibilityModeReserved[7]; // // Pointer to leap second data. // since RS5 // PLEAP_SECOND_DATA LeapSecondData; // // Leap second flags. // union { ULONG LeapSecondFlags; struct { ULONG SixtySecondEnabled : 1; // Leap seconds enabled. ULONG Reserved : 31; }; }; // // Global flags for the process. // ULONG NtGlobalFlag2; // // Extended feature disable mask (AVX). // since WIN11 // ULONGLONG ExtendedFeatureDisableMask; } PEB, *PPEB; #ifdef _WIN64 static_assert(FIELD_OFFSET(PEB, SessionId) == 0x2C0, "FIELD_OFFSET(PEB, SessionId) is incorrect"); static_assert(sizeof(PEB) == 0x7d0, "Size of PEB is incorrect"); // WIN11 #else static_assert(FIELD_OFFSET(PEB, SessionId) == 0x1D4, "FIELD_OFFSET(PEB, SessionId) is incorrect"); static_assert(sizeof(PEB) == 0x488, "Size of PEB is incorrect"); // WIN11 #endif #define GDI_BATCH_BUFFER_SIZE 310 /** * The GDI_TEB_BATCH structure is used to store information about GDI batch operations. */ typedef struct _GDI_TEB_BATCH { ULONG Offset; ULONG_PTR HDC; ULONG Buffer[GDI_BATCH_BUFFER_SIZE]; } GDI_TEB_BATCH, *PGDI_TEB_BATCH; #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED (0x00000001) /** * The TEB_ACTIVE_FRAME_CONTEXT structure is used to store information about an active frame context. */ typedef struct _TEB_ACTIVE_FRAME_CONTEXT { ULONG Flags; PCSTR FrameName; } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT; /** * The TEB_ACTIVE_FRAME_CONTEXT_EX structure extends TEB_ACTIVE_FRAME_CONTEXT with additional information. */ typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX { TEB_ACTIVE_FRAME_CONTEXT BasicContext; PCSTR SourceLocation; } TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX; #define TEB_ACTIVE_FRAME_FLAG_EXTENDED (0x00000001) /** * The TEB_ACTIVE_FRAME structure is used to store information about an active frame. */ typedef struct _TEB_ACTIVE_FRAME { ULONG Flags; struct _TEB_ACTIVE_FRAME *Previous; PTEB_ACTIVE_FRAME_CONTEXT Context; } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME; /** * The TEB_ACTIVE_FRAME_EX structure extends TEB_ACTIVE_FRAME with additional information. */ typedef struct _TEB_ACTIVE_FRAME_EX { TEB_ACTIVE_FRAME BasicFrame; PVOID ExtensionIdentifier; } TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX; #define STATIC_UNICODE_BUFFER_LENGTH 261 #define WIN32_CLIENT_INFO_LENGTH 62 #if (PHNT_MODE != PHNT_MODE_KERNEL) // private typedef struct _CALLBACKWND { HWND hwnd; ULONG_PTR pwnd; PACTIVATION_CONTEXT ActCtx; } CALLBACKWND, *PCALLBACKWND; // private typedef struct tagDPICONTEXTINFO { ULONG dpiContext; LOGICAL Dirty; } DPICONTEXTINFO, *PDPICONTEXTINFO; // private + rev typedef struct tagCLIENTINFO { ULONG_PTR CI_flags; ULONG_PTR Spins; ULONG ExpWinVer; ULONG CompatFlags; ULONG CompatFlags2; ULONG TIFlags; struct tagDESKTOPINFO* DeskInfo; PVOID DesktopBase; // ClientDelta before RS2 HHOOK hkCurrent; ULONG Hooks; CALLBACKWND CallbackWnd; ULONG HookCurrent; LONG InDDEMLCallback; struct tagCLIENTTHREADINFO* ClientThreadInfo; ULONG_PTR HookData; ULONG KeyCache; UCHAR KeyState[8]; ULONG AsyncKeyCache; UCHAR AsyncKeyState[8]; UCHAR AsyncKeyStateRecentDown[8]; HKL hKL; USHORT CodePage; UCHAR DbcsCFOld[2]; UCHAR DbcsCFNew[2]; MSG msgDbcsCB; PULONG RegisteredClasses; HANDLE mmcssHandle; ULONG_PTR CI_exflags; DPICONTEXTINFO dci; } CLIENTINFO, *PCLIENTINFO; #endif // (PHNT_MODE != PHNT_MODE_KERNEL) // rev - xor key for ReservedForNtRpc #ifdef _WIN64 #define RPC_THREAD_POINTER_KEY 0xABABABABDEDEDEDEui64 #else #define RPC_THREAD_POINTER_KEY 0xABABABAB #endif /** * Thread Environment Block (TEB) structure. * * \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb */ typedef struct _TEB { // // Thread Information Block (TIB) contains the thread's stack, base and limit addresses, the current stack pointer, and the exception list. // NT_TIB NtTib; // // Reserved. // PVOID EnvironmentPointer; // // Client ID for this thread. // CLIENT_ID ClientId; // // A handle to an active Remote Procedure Call (RPC) if the thread is currently involved in an RPC operation. // PVOID ActiveRpcHandle; // // A pointer to the __declspec(thread) local storage array. // PVOID ThreadLocalStoragePointer; // // A pointer to the Process Environment Block (PEB), which contains information about the process. // PPEB ProcessEnvironmentBlock; // // The previous Win32 error value for this thread. // ULONG LastErrorValue; // // The number of critical sections currently owned by this thread. // ULONG CountOfOwnedCriticalSections; // // Reserved. // PVOID CsrClientThread; // // Reserved for win32k.sys // PVOID Win32ThreadInfo; // // Reserved for user32.dll // ULONG User32Reserved[26]; // // Reserved for winsrv.dll // ULONG UserReserved[5]; // // Reserved. // PVOID WOW32Reserved; // // The LCID of the current thread. (Kernel32!GetThreadLocale) // LCID CurrentLocale; // // Reserved. // ULONG FpSoftwareStatusRegister; // // Reserved. // PVOID ReservedForDebuggerInstrumentation[16]; #ifdef _WIN64 // // Reserved for floating-point emulation. // PVOID SystemReserved1[25]; // // Per-thread fiber local storage. (Teb->HasFiberData) // PVOID HeapFlsData; // // Reserved. // ULONG_PTR RngState[4]; #else // // Reserved. // PVOID SystemReserved1[26]; #endif // // Placeholder compatibility mode. (ProjFs and Cloud Files) // CHAR PlaceholderCompatibilityMode; // // Indicates whether placeholder hydration is always explicit. // BOOLEAN PlaceholderHydrationAlwaysExplicit; // // ProjFs and Cloud Files (reparse point) file virtualization. // CHAR PlaceholderReserved[10]; // // The process ID (PID) that the current COM server thread is acting on behalf of. // ULONG ProxiedProcessId; // // Pointer to the activation context stack for the current thread. // ACTIVATION_CONTEXT_STACK ActivationStack; // // Opaque operation on behalf of another user or process. // UCHAR WorkingOnBehalfTicket[8]; // // The last exception status for the current thread. // NTSTATUS ExceptionCode; // // Pointer to the activation context stack for the current thread. // PACTIVATION_CONTEXT_STACK ActivationContextStackPointer; // // The stack pointer (SP) of the current system call or exception during instrumentation. // ULONG_PTR InstrumentationCallbackSp; // // The program counter (PC) of the previous system call or exception during instrumentation. // ULONG_PTR InstrumentationCallbackPreviousPc; // // The stack pointer (SP) of the previous system call or exception during instrumentation. // ULONG_PTR InstrumentationCallbackPreviousSp; #ifdef _WIN64 // // The miniversion ID of the current transacted file operation. // ULONG TxFsContext; #endif // // Indicates the state of the system call or exception instrumentation callback. // BOOLEAN InstrumentationCallbackDisabled; #ifdef _WIN64 // // Indicates the state of alignment exceptions for unaligned load/store operations. // BOOLEAN UnalignedLoadStoreExceptions; #endif #ifndef _WIN64 // // SpareBytes. // UCHAR SpareBytes[23]; // // The miniversion ID of the current transacted file operation. // ULONG TxFsContext; #endif // // Reserved for GDI (Win32k). // GDI_TEB_BATCH GdiTebBatch; CLIENT_ID RealClientId; HANDLE GdiCachedProcessHandle; ULONG GdiClientPID; ULONG GdiClientTID; PVOID GdiThreadLocalInfo; #if (PHNT_MODE != PHNT_MODE_KERNEL) union { // // User32 (Win32k) thread information. // CLIENTINFO Win32ClientInfo; ULONG_PTR Win32ClientInfoArea[WIN32_CLIENT_INFO_LENGTH]; }; #else ULONG_PTR Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH]; #endif // // Reserved for opengl32.dll // PVOID glDispatchTable[233]; ULONG_PTR glReserved1[29]; PVOID glReserved2; PVOID glSectionInfo; PVOID glSection; PVOID glTable; PVOID glCurrentRC; PVOID glContext; // // The previous status value for this thread. // NTSTATUS LastStatusValue; // // A static string for use by the application. // UNICODE_STRING StaticUnicodeString; // // A static buffer for use by the application. // WCHAR StaticUnicodeBuffer[STATIC_UNICODE_BUFFER_LENGTH]; // // The maximum stack size and indicates the base of the stack. // PVOID DeallocationStack; // // Data for Thread Local Storage. (TlsGetValue) // PVOID TlsSlots[TLS_MINIMUM_AVAILABLE]; // // Reserved for TLS. // LIST_ENTRY TlsLinks; // // Reserved for NTVDM. // PVOID Vdm; // // Reserved for RPC. The pointer is XOR'ed with RPC_THREAD_POINTER_KEY. // PVOID ReservedForNtRpc; // // Reserved for Debugging (DebugActiveProcess). // PVOID DbgSsReserved[2]; // // The error mode for the current thread. (GetThreadErrorMode) // ULONG HardErrorMode; // // Reserved. // #ifdef _WIN64 PVOID Instrumentation[11]; #else PVOID Instrumentation[9]; #endif // // Reserved. // GUID ActivityId; // // The identifier of the service that created the thread. (svchost) // PVOID SubProcessTag; // // Reserved. // PVOID PerflibData; // // Reserved. // PVOID EtwTraceData; // // The address of a socket handle during a blocking socket operation. (WSAStartup) // HANDLE WinSockData; // // The number of function calls accumulated in the current GDI batch. (GdiSetBatchLimit) // ULONG GdiBatchCount; // // The preferred processor for the current thread. (SetThreadIdealProcessor/SetThreadIdealProcessorEx) // union { PROCESSOR_NUMBER CurrentIdealProcessor; ULONG IdealProcessorValue; struct { UCHAR ReservedPad0; UCHAR ReservedPad1; UCHAR ReservedPad2; UCHAR IdealProcessor; }; }; // // The minimum size of the stack available during any stack overflow exceptions. (SetThreadStackGuarantee) // ULONG GuaranteedStackBytes; // // Reserved. // PVOID ReservedForPerf; // // Reserved for Object Linking and Embedding (OLE) // PSOleTlsData ReservedForOle; // // Indicates whether the thread is waiting on the loader lock. // ULONG WaitingOnLoaderLock; // // The saved priority state for the thread. // PVOID SavedPriorityState; // // Reserved. // ULONG_PTR ReservedForCodeCoverage; // // Reserved. // PVOID ThreadPoolData; // // Pointer to the TLS (Thread Local Storage) expansion slots for the thread. // PVOID *TlsExpansionSlots; #ifdef _WIN64 PVOID ChpeV2CpuAreaInfo; // CHPEV2_CPUAREA_INFO // previously DeallocationBStore PVOID Unused; // previously BStoreLimit #endif // // The generation of the MUI (Multilingual User Interface) data. // ULONG MuiGeneration; // // Indicates whether the thread is impersonating another security context. // ULONG IsImpersonating; // // Pointer to the NLS (National Language Support) cache. // PVOID NlsCache; // // Pointer to the AppCompat/Shim Engine data. // PVOID pShimData; // // Reserved. // ULONG HeapData; // // Handle to the current transaction associated with the thread. // HANDLE CurrentTransactionHandle; // // Pointer to the active frame for the thread. // PTEB_ACTIVE_FRAME ActiveFrame; // // Reserved for FLS (RtlProcessFlsData). // PVOID FlsData; // // Pointer to the preferred languages for the current thread. (GetThreadPreferredUILanguages) // PVOID PreferredLanguages; // // Pointer to the user-preferred languages for the current thread. (GetUserPreferredUILanguages) // PVOID UserPrefLanguages; // // Pointer to the merged preferred languages for the current thread. (MUI_MERGE_USER_FALLBACK) // PVOID MergedPrefLanguages; // // Indicates whether the thread is impersonating another user's language settings. // ULONG MuiImpersonation; // // Reserved. // union { USHORT CrossTebFlags; USHORT SpareCrossTebBits : 16; }; // // SameTebFlags modify the state and behavior of the current thread. // union { USHORT SameTebFlags; struct { USHORT SafeThunkCall : 1; USHORT InDebugPrint : 1; // Indicates if the thread is currently in a debug print routine. USHORT HasFiberData : 1; // Indicates if the thread has local fiber-local storage (FLS). USHORT SkipThreadAttach : 1; // Indicates if the thread should suppress DLL_THREAD_ATTACH notifications. USHORT WerInShipAssertCode : 1; USHORT RanProcessInit : 1; // Indicates if the thread has run process initialization code. USHORT ClonedThread : 1; // Indicates if the thread is a clone of a different thread. USHORT SuppressDebugMsg : 1; // Indicates if the thread should suppress LOAD_DLL_DEBUG_INFO notifications. USHORT DisableUserStackWalk : 1; USHORT RtlExceptionAttached : 1; USHORT InitialThread : 1; // Indicates if the thread is the initial thread of the process. USHORT SessionAware : 1; USHORT LoadOwner : 1; // Indicates if the thread is the owner of the process loader lock. USHORT LoaderWorker : 1; USHORT SkipLoaderInit : 1; USHORT SkipFileAPIBrokering : 1; }; }; // // Pointer to the callback function that is called when a KTM transaction scope is entered. // PVOID TxnScopeEnterCallback; // // Pointer to the callback function that is called when a KTM transaction scope is exited. /// PVOID TxnScopeExitCallback; // // Pointer to optional context data for use by the application when a KTM transaction scope callback is called. // PVOID TxnScopeContext; // // The lock count of critical sections for the current thread. // ULONG LockCount; // // The offset to the WOW64 (Windows on Windows) TEB for the current thread. // LONG WowTebOffset; // // Pointer to the DLL containing the resource (valid after LdrFindResource_U/LdrResFindResource/etc... returns). // PLDR_RESLOADER_RET ResourceRetValue; // // Reserved for Windows Driver Framework (WDF). // PVOID ReservedForWdf; // // Reserved for the Microsoft C runtime (CRT). // ULONGLONG ReservedForCrt; // // The Host Compute Service (HCS) container identifier. // GUID EffectiveContainerId; // // Reserved for Kernel32!Sleep (SpinWait). // ULONGLONG LastSleepCounter; // since Win11 // // Reserved for Kernel32!Sleep (SpinWait). // ULONG SpinCallCount; // // Extended feature disable mask (AVX). // ULONGLONG ExtendedFeatureDisableMask; // // Reserved. // PVOID SchedulerSharedDataSlot; // since 24H2 // // Reserved. // PVOID HeapWalkContext; // // The primary processor group affinity of the thread. // GROUP_AFFINITY PrimaryGroupAffinity; // // Read-copy-update (RCU) synchronization context. // ULONG Rcu[2]; } TEB, *PTEB; #ifdef _WIN64 static_assert(FIELD_OFFSET(TEB, SchedulerSharedDataSlot) == 0x1850, "Size of TEB is incorrect"); // WIN11 static_assert(sizeof(TEB) == 0x1878, "Size of TEB is incorrect"); // 24H2 #else static_assert(FIELD_OFFSET(TEB, SchedulerSharedDataSlot) == 0x1018, "Size of TEB is incorrect"); // WIN11 static_assert(sizeof(TEB) == 0x1038, "Size of TEB is incorrect"); // 24H2 #endif #endif