zoukankan      html  css  js  c++  java
  • x86 x64 下PEB结构

    x64 下的calc

    +0x000 InheritedAddressSpace : 0 '' +0x001 ReadImageFileExecOptions : 0 '' +0x002 BeingDebugged : 0x1 '' +0x003 BitField : 0x8 '' +0x003 ImageUsesLargePages : 0y0 +0x003 IsProtectedProcess : 0y0 +0x003 IsLegacyProcess : 0y0 +0x003 IsImageDynamicallyRelocated : 0y1 +0x003 SkipPatchingUser32Forwarders : 0y0 +0x003 SpareBits : 0y000 +0x008 Mutant : 0xffffffff`ffffffff Void +0x010 ImageBaseAddress : 0x00000000`ff6a0000 Void +0x018 Ldr : 0x00000000`77012640 _PEB_LDR_DATA +0x020 ProcessParameters : 0x00000000`00351e90 _RTL_USER_PROCESS_PARAMETERS +0x028 SubSystemData : (null) +0x030 ProcessHeap : 0x00000000`00350000 Void +0x038 FastPebLock : 0x00000000`7701a900 _RTL_CRITICAL_SECTION +0x040 AtlThunkSListPtr : (null) +0x048 IFEOKey : (null) +0x050 CrossProcessFlags : 0 +0x050 ProcessInJob : 0y0 +0x050 ProcessInitializing : 0y0 +0x050 ProcessUsingVEH : 0y0 +0x050 ProcessUsingVCH : 0y0 +0x050 ProcessUsingFTH : 0y0 +0x050 ReservedBits0 : 0y000000000000000000000000000 (0) +0x058 KernelCallbackTable : 0x00000000`76e69500 Void +0x058 UserSharedInfoPtr : 0x00000000`76e69500 Void +0x060 SystemReserved : [1] 0 +0x064 AtlThunkSListPtr32 : 0 +0x068 ApiSetMap : 0x000007fe`ff200000 Void +0x070 TlsExpansionCounter : 0 +0x078 TlsBitmap : 0x00000000`77012590 Void +0x080 TlsBitmapBits : [2] 0x1ffffff +0x088 ReadOnlySharedMemoryBase : 0x00000000`7efe0000 Void +0x090 HotpatchInformation : (null) +0x098 ReadOnlyStaticServerData : 0x00000000`7efe0a90 -> (null) +0x0a0 AnsiCodePageData : 0x000007ff`fffb0000 Void +0x0a8 OemCodePageData : 0x000007ff`fffc0228 Void +0x0b0 UnicodeCaseTableData : 0x000007ff`fffd0650 Void +0x0b8 NumberOfProcessors : 2 +0x0bc NtGlobalFlag : 0 +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER 0xffffe86d`079b8000 +0x0c8 HeapSegmentReserve : 0x100000 +0x0d0 HeapSegmentCommit : 0x2000 +0x0d8 HeapDeCommitTotalFreeThreshold : 0x10000 +0x0e0 HeapDeCommitFreeBlockThreshold : 0x1000 +0x0e8 NumberOfHeaps : 6 +0x0ec MaximumNumberOfHeaps : 0x10 +0x0f0 ProcessHeaps : 0x00000000`7701a6c0 -> 0x00000000`00350000 Void +0x0f8 GdiSharedHandleTable : 0x00000000`005e0000 Void +0x100 ProcessStarterHelper : (null) +0x108 GdiDCAttributeList : 0x14 +0x110 LoaderLock : 0x00000000`77017490 _RTL_CRITICAL_SECTION +0x118 OSMajorVersion : 6 +0x11c OSMinorVersion : 1 +0x120 OSBuildNumber : 0x1db1 +0x122 OSCSDVersion : 0x100 +0x124 OSPlatformId : 2 +0x128 ImageSubsystem : 2 +0x12c ImageSubsystemMajorVersion : 6 +0x130 ImageSubsystemMinorVersion : 1 +0x138 ActiveProcessAffinityMask : 3 +0x140 GdiHandleBuffer : [60] 0 +0x230 PostProcessInitRoutine : (null) +0x238 TlsExpansionBitmap : 0x00000000`77012580 Void +0x240 TlsExpansionBitmapBits : [32] 1 +0x2c0 SessionId : 1 +0x2c8 AppCompatFlags : _ULARGE_INTEGER 0x0 +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER 0x0 +0x2d8 pShimData : (null) +0x2e0 AppCompatInfo : (null) +0x2e8 CSDVersion : _UNICODE_STRING "Service Pack 1" +0x2f8 ActivationContextData : 0x00000000`00040000 _ACTIVATION_CONTEXT_DATA +0x300 ProcessAssemblyStorageMap : 0x00000000`00377f60 _ASSEMBLY_STORAGE_MAP +0x308 SystemDefaultActivationContextData : 0x00000000`00030000 _ACTIVATION_CONTEXT_DATA +0x310 SystemAssemblyStorageMap : 0x00000000`00377020 _ASSEMBLY_STORAGE_MAP +0x318 MinimumStackCommit : 0 +0x320 FlsCallback : 0x00000000`0037c220 _FLS_CALLBACK_INFO +0x328 FlsListHead : _LIST_ENTRY [ 0x00000000`0037be00 - 0x00000000`003d1610 ] +0x338 FlsBitmap : 0x00000000`77012570 Void +0x340 FlsBitmapBits : [4] 0xf +0x350 FlsHighIndex : 3 +0x358 WerRegistrationData : 0x00000000`00100000 Void +0x360 WerShipAssertPtr : (null) +0x368 pContextData : 0x00000000`00050000 Void +0x370 pImageHeaderHash : (null) +0x378 TracingFlags : 0 +0x378 HeapTracingEnabled : 0y0 +0x378 CritSecTracingEnabled : 0y0 +0x378 SpareTracingBits : 0y000000000000000000000000000000 (0)

      

  • 相关阅读:
    背水一战 Windows 10 (26)
    背水一战 Windows 10 (25)
    背水一战 Windows 10 (24)
    背水一战 Windows 10 (23)
    背水一战 Windows 10 (22)
    背水一战 Windows 10 (21)
    背水一战 Windows 10 (20)
    背水一战 Windows 10 (19)
    背水一战 Windows 10 (18)
    背水一战 Windows 10 (17)
  • 原文地址:https://www.cnblogs.com/M4ster/p/PEB.html
Copyright © 2011-2022 走看看