PEB structure

[This structure may be altered in future versions of Windows.]

Contains process information.

Syntax


typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  BYTE                          Reserved4[104];
  PVOID                         Reserved5[52];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved6[128];
  PVOID                         Reserved7[1];
  ULONG                         SessionId;
} PEB, *PPEB;

Members

Reserved1

Reserved for internal use by the operating system.

BeingDebugged

Indicates whether the specified process is currently being debugged. The PEB structure, however, is an internal operating-system structure whose layout may change in the future. It is best to use the CheckRemoteDebuggerPresent function instead.

Reserved2

Reserved for internal use by the operating system.

Reserved3

Reserved for internal use by the operating system.

Ldr

A pointer to a PEB_LDR_DATA structure that contains information about the loaded modules for the process.

ProcessParameters

A pointer to an RTL_USER_PROCESS_PARAMETERS structure that contains process parameter information such as the command line.

Reserved4

Reserved for internal use by the operating system.

Reserved5

Reserved for internal use by the operating system.

PostProcessInitRoutine

Not supported.

Reserved6

Reserved for internal use by the operating system.

Reserved7

Reserved for internal use by the operating system.

SessionId

The Terminal Services session identifier associated with the current process.

Remarks

The syntax for this structure on 64-bit Windows is as follows:

typedef struct _PEB {
    BYTE Reserved1[2];
    BYTE BeingDebugged;
    BYTE Reserved2[21];
    PPEB_LDR_DATA LoaderData;
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    BYTE Reserved3[520];
    PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
    BYTE Reserved4[136];
    ULONG SessionId;
} PEB;

Requirements

Minimum supported client

Windows XP [desktop apps only]

Minimum supported server

Windows Server 2003 [desktop apps only]

Header

Winternl.h

See also

NtQueryInformationProcess
PEB_LDR_DATA
RTL_USER_PROCESS_PARAMETERS
ZwQueryInformationProcess

 

 

Community Additions

ADD
Show:
© 2014 Microsoft