Win32 API 日本語リファレンス
ホーム › System.Threading › PEB

PEB

構造体
📘 Microsoft Learn (日本語) · English
サイズx64: 712 バイト / x86: 472 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド型サイズx64x86説明
Reserved1BYTE2+0+0システム内部用の予約バイト配列。直接使用しない。
BeingDebuggedBYTE1+2+2プロセスがデバッガにアタッチされていれば非0となるフラグ。
Reserved2BYTE1+3+3システム内部用の予約バイト配列。直接使用しない。
Reserved3void*16/8+8+4システム内部用の予約ポインタ配列。直接使用しない。
LdrPEB_LDR_DATA*8/4+24+12ロード済みモジュール情報を保持するPEB_LDR_DATAへのポインタ。
ProcessParametersRTL_USER_PROCESS_PARAMETERS*8/4+32+16プロセス起動パラメータを保持するRTL_USER_PROCESS_PARAMETERSへのポインタ。
Reserved4void*24/12+40+20システム内部用の予約ポインタ配列。直接使用しない。
AtlThunkSListPtrvoid*8/4+64+32ATLサンクのシングルリンクリストへのポインタ。
Reserved5void*8/4+72+36システム内部用の予約ポインタ。直接使用しない。
Reserved6DWORD4+80+40システム内部用の予約DWORD。直接使用しない。
Reserved7void*8/4+88+44システム内部用の予約ポインタ。直接使用しない。
Reserved8DWORD4+96+48システム内部用の予約DWORD。直接使用しない。
AtlThunkSListPtr32DWORD4+100+5232ビット用ATLサンクシングルリンクリストへのポインタ。
Reserved9void*360/180+104+56システム内部用の予約ポインタ配列。直接使用しない。
Reserved10BYTE96+464+236システム内部用の予約バイト配列。直接使用しない。
PostProcessInitRoutinePPS_POST_PROCESS_INIT_ROUTINE8/4+560+332プロセス初期化後に呼ばれるルーチンへのポインタ。
Reserved11BYTE128+568+336システム内部用の予約バイト配列。直接使用しない。
Reserved12void*8/4+696+464システム内部用の予約ポインタ配列。直接使用しない。
SessionIdDWORD4+704+468プロセスが属するターミナルサービスセッションのID。

各言語での定義

#include <windows.h>

// PEB  (x64 712 / x86 472 バイト)
typedef struct PEB {
    BYTE Reserved1[2];
    BYTE BeingDebugged;
    BYTE Reserved2[1];
    void* Reserved3[2];
    PEB_LDR_DATA* Ldr;
    RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
    void* Reserved4[3];
    void* AtlThunkSListPtr;
    void* Reserved5;
    DWORD Reserved6;
    void* Reserved7;
    DWORD Reserved8;
    DWORD AtlThunkSListPtr32;
    void* Reserved9[45];
    BYTE Reserved10[96];
    PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
    BYTE Reserved11[128];
    void* Reserved12[1];
    DWORD SessionId;
} PEB;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PEB
{
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public byte[] Reserved1;
    public byte BeingDebugged;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public byte[] Reserved2;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public IntPtr[] Reserved3;
    public IntPtr Ldr;
    public IntPtr ProcessParameters;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] public IntPtr[] Reserved4;
    public IntPtr AtlThunkSListPtr;
    public IntPtr Reserved5;
    public uint Reserved6;
    public IntPtr Reserved7;
    public uint Reserved8;
    public uint AtlThunkSListPtr32;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 45)] public IntPtr[] Reserved9;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 96)] public byte[] Reserved10;
    public IntPtr PostProcessInitRoutine;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 128)] public byte[] Reserved11;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public IntPtr[] Reserved12;
    public uint SessionId;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PEB
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=2)> Public Reserved1() As Byte
    Public BeingDebugged As Byte
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public Reserved2() As Byte
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=2)> Public Reserved3() As IntPtr
    Public Ldr As IntPtr
    Public ProcessParameters As IntPtr
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=3)> Public Reserved4() As IntPtr
    Public AtlThunkSListPtr As IntPtr
    Public Reserved5 As IntPtr
    Public Reserved6 As UInteger
    Public Reserved7 As IntPtr
    Public Reserved8 As UInteger
    Public AtlThunkSListPtr32 As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=45)> Public Reserved9() As IntPtr
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=96)> Public Reserved10() As Byte
    Public PostProcessInitRoutine As IntPtr
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=128)> Public Reserved11() As Byte
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public Reserved12() As IntPtr
    Public SessionId As UInteger
End Structure
import ctypes
from ctypes import wintypes

class PEB(ctypes.Structure):
    _fields_ = [
        ("Reserved1", ctypes.c_ubyte * 2),
        ("BeingDebugged", ctypes.c_ubyte),
        ("Reserved2", ctypes.c_ubyte * 1),
        ("Reserved3", ctypes.c_void_p * 2),
        ("Ldr", ctypes.c_void_p),
        ("ProcessParameters", ctypes.c_void_p),
        ("Reserved4", ctypes.c_void_p * 3),
        ("AtlThunkSListPtr", ctypes.c_void_p),
        ("Reserved5", ctypes.c_void_p),
        ("Reserved6", wintypes.DWORD),
        ("Reserved7", ctypes.c_void_p),
        ("Reserved8", wintypes.DWORD),
        ("AtlThunkSListPtr32", wintypes.DWORD),
        ("Reserved9", ctypes.c_void_p * 45),
        ("Reserved10", ctypes.c_ubyte * 96),
        ("PostProcessInitRoutine", ctypes.c_void_p),
        ("Reserved11", ctypes.c_ubyte * 128),
        ("Reserved12", ctypes.c_void_p * 1),
        ("SessionId", wintypes.DWORD),
    ]
#[repr(C)]
pub struct PEB {
    pub Reserved1: [u8; 2],
    pub BeingDebugged: u8,
    pub Reserved2: [u8; 1],
    pub Reserved3: [*mut core::ffi::c_void; 2],
    pub Ldr: *mut core::ffi::c_void,
    pub ProcessParameters: *mut core::ffi::c_void,
    pub Reserved4: [*mut core::ffi::c_void; 3],
    pub AtlThunkSListPtr: *mut core::ffi::c_void,
    pub Reserved5: *mut core::ffi::c_void,
    pub Reserved6: u32,
    pub Reserved7: *mut core::ffi::c_void,
    pub Reserved8: u32,
    pub AtlThunkSListPtr32: u32,
    pub Reserved9: [*mut core::ffi::c_void; 45],
    pub Reserved10: [u8; 96],
    pub PostProcessInitRoutine: *mut core::ffi::c_void,
    pub Reserved11: [u8; 128],
    pub Reserved12: [*mut core::ffi::c_void; 1],
    pub SessionId: u32,
}
import "golang.org/x/sys/windows"

type PEB struct {
	Reserved1 [2]byte
	BeingDebugged byte
	Reserved2 [1]byte
	Reserved3 [2]uintptr
	Ldr uintptr
	ProcessParameters uintptr
	Reserved4 [3]uintptr
	AtlThunkSListPtr uintptr
	Reserved5 uintptr
	Reserved6 uint32
	Reserved7 uintptr
	Reserved8 uint32
	AtlThunkSListPtr32 uint32
	Reserved9 [45]uintptr
	Reserved10 [96]byte
	PostProcessInitRoutine uintptr
	Reserved11 [128]byte
	Reserved12 [1]uintptr
	SessionId uint32
}
type
  PEB = record
    Reserved1: array[0..1] of Byte;
    BeingDebugged: Byte;
    Reserved2: array[0..0] of Byte;
    Reserved3: array[0..1] of Pointer;
    Ldr: Pointer;
    ProcessParameters: Pointer;
    Reserved4: array[0..2] of Pointer;
    AtlThunkSListPtr: Pointer;
    Reserved5: Pointer;
    Reserved6: DWORD;
    Reserved7: Pointer;
    Reserved8: DWORD;
    AtlThunkSListPtr32: DWORD;
    Reserved9: array[0..44] of Pointer;
    Reserved10: array[0..95] of Byte;
    PostProcessInitRoutine: Pointer;
    Reserved11: array[0..127] of Byte;
    Reserved12: array[0..0] of Pointer;
    SessionId: DWORD;
  end;
const PEB = extern struct {
    Reserved1: [2]u8,
    BeingDebugged: u8,
    Reserved2: [1]u8,
    Reserved3: [2]?*anyopaque,
    Ldr: ?*anyopaque,
    ProcessParameters: ?*anyopaque,
    Reserved4: [3]?*anyopaque,
    AtlThunkSListPtr: ?*anyopaque,
    Reserved5: ?*anyopaque,
    Reserved6: u32,
    Reserved7: ?*anyopaque,
    Reserved8: u32,
    AtlThunkSListPtr32: u32,
    Reserved9: [45]?*anyopaque,
    Reserved10: [96]u8,
    PostProcessInitRoutine: ?*anyopaque,
    Reserved11: [128]u8,
    Reserved12: [1]?*anyopaque,
    SessionId: u32,
};
type
  PEB {.bycopy.} = object
    Reserved1: array[2, uint8]
    BeingDebugged: uint8
    Reserved2: array[1, uint8]
    Reserved3: array[2, pointer]
    Ldr: pointer
    ProcessParameters: pointer
    Reserved4: array[3, pointer]
    AtlThunkSListPtr: pointer
    Reserved5: pointer
    Reserved6: uint32
    Reserved7: pointer
    Reserved8: uint32
    AtlThunkSListPtr32: uint32
    Reserved9: array[45, pointer]
    Reserved10: array[96, uint8]
    PostProcessInitRoutine: pointer
    Reserved11: array[128, uint8]
    Reserved12: array[1, pointer]
    SessionId: uint32
struct PEB
{
    ubyte[2] Reserved1;
    ubyte BeingDebugged;
    ubyte[1] Reserved2;
    void*[2] Reserved3;
    void* Ldr;
    void* ProcessParameters;
    void*[3] Reserved4;
    void* AtlThunkSListPtr;
    void* Reserved5;
    uint Reserved6;
    void* Reserved7;
    uint Reserved8;
    uint AtlThunkSListPtr32;
    void*[45] Reserved9;
    ubyte[96] Reserved10;
    void* PostProcessInitRoutine;
    ubyte[128] Reserved11;
    void*[1] Reserved12;
    uint SessionId;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PEB サイズ: 472 バイト(x86)
dim st, 118    ; 4byte整数×118(構造体サイズ 472 / 4 切り上げ)
; Reserved1 : BYTE (+0, 2byte)  varptr(st)+0 を基点に操作(2byte:入れ子/配列)
; BeingDebugged : BYTE (+2, 1byte)  poke st,2,値  /  値 = peek(st,2)
; Reserved2 : BYTE (+3, 1byte)  varptr(st)+3 を基点に操作(1byte:入れ子/配列)
; Reserved3 : void* (+4, 8byte)  varptr(st)+4 を基点に操作(8byte:入れ子/配列)
; Ldr : PEB_LDR_DATA* (+12, 4byte)  varptr(st)+12 を基点に操作(4byte:入れ子/配列)
; ProcessParameters : RTL_USER_PROCESS_PARAMETERS* (+16, 4byte)  varptr(st)+16 を基点に操作(4byte:入れ子/配列)
; Reserved4 : void* (+20, 12byte)  varptr(st)+20 を基点に操作(12byte:入れ子/配列)
; AtlThunkSListPtr : void* (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; Reserved5 : void* (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; Reserved6 : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; Reserved7 : void* (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; Reserved8 : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; AtlThunkSListPtr32 : DWORD (+52, 4byte)  st.13 = 値  /  値 = st.13   (lpoke/lpeek も可)
; Reserved9 : void* (+56, 180byte)  varptr(st)+56 を基点に操作(180byte:入れ子/配列)
; Reserved10 : BYTE (+236, 96byte)  varptr(st)+236 を基点に操作(96byte:入れ子/配列)
; PostProcessInitRoutine : PPS_POST_PROCESS_INIT_ROUTINE (+332, 4byte)  st.83 = 値  /  値 = st.83   (lpoke/lpeek も可)
; Reserved11 : BYTE (+336, 128byte)  varptr(st)+336 を基点に操作(128byte:入れ子/配列)
; Reserved12 : void* (+464, 4byte)  varptr(st)+464 を基点に操作(4byte:入れ子/配列)
; SessionId : DWORD (+468, 4byte)  st.117 = 値  /  値 = st.117   (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PEB サイズ: 712 バイト(x64)
dim st, 178    ; 4byte整数×178(構造体サイズ 712 / 4 切り上げ)
; Reserved1 : BYTE (+0, 2byte)  varptr(st)+0 を基点に操作(2byte:入れ子/配列)
; BeingDebugged : BYTE (+2, 1byte)  poke st,2,値  /  値 = peek(st,2)
; Reserved2 : BYTE (+3, 1byte)  varptr(st)+3 を基点に操作(1byte:入れ子/配列)
; Reserved3 : void* (+8, 16byte)  varptr(st)+8 を基点に操作(16byte:入れ子/配列)
; Ldr : PEB_LDR_DATA* (+24, 8byte)  varptr(st)+24 を基点に操作(8byte:入れ子/配列)
; ProcessParameters : RTL_USER_PROCESS_PARAMETERS* (+32, 8byte)  varptr(st)+32 を基点に操作(8byte:入れ子/配列)
; Reserved4 : void* (+40, 24byte)  varptr(st)+40 を基点に操作(24byte:入れ子/配列)
; AtlThunkSListPtr : void* (+64, 8byte)  qpoke st,64,値 / qpeek(st,64)  ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; Reserved5 : void* (+72, 8byte)  qpoke st,72,値 / qpeek(st,72)  ※IronHSPのみ。3.7/3.8は lpoke st,72,下位 : lpoke st,76,上位
; Reserved6 : DWORD (+80, 4byte)  st.20 = 値  /  値 = st.20   (lpoke/lpeek も可)
; Reserved7 : void* (+88, 8byte)  qpoke st,88,値 / qpeek(st,88)  ※IronHSPのみ。3.7/3.8は lpoke st,88,下位 : lpoke st,92,上位
; Reserved8 : DWORD (+96, 4byte)  st.24 = 値  /  値 = st.24   (lpoke/lpeek も可)
; AtlThunkSListPtr32 : DWORD (+100, 4byte)  st.25 = 値  /  値 = st.25   (lpoke/lpeek も可)
; Reserved9 : void* (+104, 360byte)  varptr(st)+104 を基点に操作(360byte:入れ子/配列)
; Reserved10 : BYTE (+464, 96byte)  varptr(st)+464 を基点に操作(96byte:入れ子/配列)
; PostProcessInitRoutine : PPS_POST_PROCESS_INIT_ROUTINE (+560, 8byte)  qpoke st,560,値 / qpeek(st,560)  ※IronHSPのみ。3.7/3.8は lpoke st,560,下位 : lpoke st,564,上位
; Reserved11 : BYTE (+568, 128byte)  varptr(st)+568 を基点に操作(128byte:入れ子/配列)
; Reserved12 : void* (+696, 8byte)  varptr(st)+696 を基点に操作(8byte:入れ子/配列)
; SessionId : DWORD (+704, 4byte)  st.176 = 値  /  値 = st.176   (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
#defstruct global PEB
    #field byte Reserved1 2
    #field byte BeingDebugged
    #field byte Reserved2 1
    #field intptr Reserved3 2
    #field intptr Ldr
    #field intptr ProcessParameters
    #field intptr Reserved4 3
    #field intptr AtlThunkSListPtr
    #field intptr Reserved5
    #field int Reserved6
    #field intptr Reserved7
    #field int Reserved8
    #field int AtlThunkSListPtr32
    #field intptr Reserved9 45
    #field byte Reserved10 96
    #field intptr PostProcessInitRoutine
    #field byte Reserved11 128
    #field intptr Reserved12 1
    #field int SessionId
#endstruct

stdim st, PEB        ; NSTRUCT 変数を確保
st->BeingDebugged = 100
mes "BeingDebugged=" + st->BeingDebugged