3 out of 8 rated this helpful - Rate this topic

PEB structure

[This structure may be altered in future versions of Windows.]

Applies to: desktop apps only

Contains process information.

Syntax

Copy

typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  BYTE                          Reserved4[104];
  PVOID                         Reserved5[52];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved6[128];
  PVOID                         Reserved7[1];
  ULONG                         SessionId;
} PEB, *PPEB;

Members

Reserved1: Reserved for internal use by the operating system.
BeingDebugged: Indicates whether the specified process is currently being debugged. The PEB structure, however, is an internal operating-system structure whose layout may change in the future. It is best to use the CheckRemoteDebuggerPresent function instead.
Reserved2: Reserved for internal use by the operating system.
Reserved3: Reserved for internal use by the operating system.
Ldr: A pointer to a PEB_LDR_DATA structure that contains information about the loaded modules for the process.
ProcessParameters: A pointer to an RTL_USER_PROCESS_PARAMETERS structure that contains process parameter information such as the command line.
Reserved4: Reserved for internal use by the operating system.
Reserved5: Reserved for internal use by the operating system.
PostProcessInitRoutine: Not supported.
Reserved6: Reserved for internal use by the operating system.
Reserved7: Reserved for internal use by the operating system.
SessionId: The Terminal Services session identifier associated with the current process.

Remarks

The syntax for this structure on 64-bit Windows is as follows: