PEB structure (winternl.h)

[This structure may be altered in future versions of Windows.]

Contains process information.

Syntax

typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  PVOID                         Reserved4[3];
  PVOID                         AtlThunkSListPtr;
  PVOID                         Reserved5;
  ULONG                         Reserved6;
  PVOID                         Reserved7;
  ULONG                         Reserved8;
  ULONG                         AtlThunkSListPtr32;
  PVOID                         Reserved9[45];
  BYTE                          Reserved10[96];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved11[128];
  PVOID                         Reserved12[1];
  ULONG                         SessionId;
} PEB, *PPEB;

Members

Reserved1[2]

Reserved for internal use by the operating system.

BeingDebugged

Indicates whether the specified process is currently being debugged. The PEB structure, however, is an internal operating-system structure whose layout may change in the future. It is best to use the CheckRemoteDebuggerPresent function instead.

Reserved2[1]

Reserved for internal use by the operating system.

Reserved3[2]

Reserved for internal use by the operating system.

Ldr

A pointer to a PEB_LDR_DATA structure that contains information about the loaded modules for the process.

ProcessParameters

A pointer to an RTL_USER_PROCESS_PARAMETERS structure that contains process parameter information such as the command line.

Reserved4[3]

Reserved for internal use by the operating system.

AtlThunkSListPtr

Reserved5

Reserved for internal use by the operating system.

Reserved6

Reserved for internal use by the operating system.

Reserved7

Reserved for internal use by the operating system.

Reserved8

AtlThunkSListPtr32

Reserved9[45]

Reserved10[96]

PostProcessInitRoutine

Not supported.

Reserved11[128]

Reserved12[1]

SessionId

The Terminal Services session identifier associated with the current process.

Remarks

The syntax for this structure on 64-bit Windows is as follows:

typedef struct _PEB {
    BYTE Reserved1[2];
    BYTE BeingDebugged;
    BYTE Reserved2[21];
    PPEB_LDR_DATA LoaderData;
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    BYTE Reserved3[520];
    PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
    BYTE Reserved4[136];
    ULONG SessionId;
} PEB;

Requirements

Requirement	Value
Minimum supported client	Windows XP [desktop apps only]
Minimum supported server	Windows Server 2003 [desktop apps only]
Header	winternl.h

See also

NtQueryInformationProcess

PEB_LDR_DATA

RTL_USER_PROCESS_PARAMETERS

ZwQueryInformationProcess