in menu Main menu move to sidebar hide Navigation Main page Contents Current events Random article About Wikipedia Contact us Contribute Help Learn to edit Community portal Recent changes Upload file Special pages Search Search Appearance Donate Create account Log in Personal tools Donate Create account Log in Contents move to sidebar hide (Top) 1 References 2 External links Toggle the table of contents Process Environment Block 2 languages 한국어 中文 Edit links Article Talk English Read Edit View history Tools Tools move to sidebar hide Actions Read Edit View history General What links here Related changes Upload file Permanent link Page information Cite this page Get shortened URL Print/export Download as PDF Printable version In other projects Wikidata item Appearance move to sidebar hide From Wikipedia, the free encyclopedia Windows NT data structure In computing the Process Environment Block (abbreviated PEB ) is a data structure in the Windows NT operating system family. It is an opaque data structure that is used by the operating system internally, most of whose fields are not intended for use by anything other than the operating system. [ 1 ] Microsoft notes, in its MSDN Library documentation — which documents only a few of the fields — that the structure "may be altered in future versions of Windows". [ 2 ] The PEB contains data structures that apply across a whole process , including global context, startup parameters, data structures for the program image loader, the program image base address, and synchronization objects used to provide mutual exclusion for process-wide data structures. [ 1 ] The PEB is closely associated with the kernel mode EPROCESS data structure, as well as with per-process data structures managed within the address space of the Client-Server Runtime Sub-System process. However, (like the CSRSS data structures) the PEB is not a kernel mode data structure itself. It resides in the application mode address space of the process that it relates to. This is because it is designed to be used by the application-mode code in the operating system libraries, such as NTDLL , that executes outside of kernel mode, such as the code for the program image loader and the heap manager. [ 3 ] In WinDbg , the command that dumps the contents of a PEB is the !peb command, which is passed the address of the PEB within a process' application address space. That information, in turn, is obtained by the !process command, which displays the information from the EPROCESS data structure, one of whose fields is the address of the PEB. [ 3 ] Fields of the PEB that are documented by Microsoft [ 2 ] Field meaning notes BeingDebugged Whether the process is being debugged Microsoft recommends not using this field but using the official Win32 CheckRemoteDebuggerPresent () library function instead. [ 2 ] Ldr A pointer to a PEB_LDR_DATA structure providing information about loaded modules Contains the base address of kernel32 and ntdll . ProcessParameters A pointer to a RTL_USER_PROCESS_PARAMETERS structure providing information about process startup parameters The RTL_USER_PROCESS_PARAMETERS structure is also mostly opaque and not guaranteed to be consistent across multiple versions of Windows. [ 4 ] PostProcessInitRoutine A pointer to a callback function called after DLL initialization but before the main executable code is invoked This callback function is used on Windows 2000 , but is not guaranteed to be used on later versions of Windows NT. [ 2 ] SessionId The session ID of the Terminal Services session that the process is part of The NtCreateUserProcess () system call initializes this by calling the kernel's internal MmGetSessionId () function. [ 3 ] The contents of the PEB are initialized by the NtCreateUserProcess () system call, the Native API function that implements part of, and underpins, the Win32 CreateProcess () , CreateProcessAsUser () , CreateProcessWithTokenW () , and CreateProcessWithLogonW () library functions that are in the kernel32.dll and advapi32.dll libraries as well as underpinning the fork() function in the Windows NT POSIX library, posix.dll. [ 3 ] For Windows NT POSIX processes, the contents of a new process' PEB are initialized by NtCreateUserProcess () as simply a direct copy of the parent process' PEB, in line with how the fork () function operates. For Win32 processes, the initial contents of a new process' PEB are mainly taken from global variables maintained within the kernel. However, several fields may instead be taken from information provided within the process' image file, in particular information provided in the IMAGE_OPTIONAL_HEADER32 data structure within the PE file format (PE+ or PE32+ in 64 bit executable images). [ 3 ] Fields from a PEB that are initialized from kernel global variables [ 3 ] Field is initialized from overridable by PE information? NumberOfProcessors KeNumberOfProcessors No NtGlobalFlag NtGlobalFlag No CriticalSectionTimeout MmCriticalSectionTimeout No HeapSegmentReserve MmHeapSegmentReserve No HeapSegmentCommit MmHeapSegmentCommit No HeapDeCommitTotalFreeThreshold MmHeapDeCommitTotalFreeThreshold No HeapDeCommitFreeBlockThreshold MmHeapDeCommitFreeBlockThreshold No MinimumStackCommit MmMinimumStackCommitInBytes No ImageProcessAffinityMask KeActiveProcessors ImageLoadConfigDirectory . ProcessAffinityMask OSMajorVersion NtMajorVersion OptionalHeader . Win32VersionValue & 0xFF OSMinorVersion NtMinorVersion ( OptionalHeader . Win32VersionValue >> 8 ) & 0xFF OSBuildNumber NtBuildNumber & 0x3FFF combined with CmNtCSDVersion ( OptionalHeader . Win32VersionValue >> 16 ) & 0x3FFF combined with ImageLoadConfigDirectory . CmNtCSDVersion OSPlatformId VER_PLATFORM_WIN32_NT ( OptionalHeader . Win32VersionValue >> 30 ) ^ 0x2 The WineHQ project provides a fuller PEB definition in its version of winternl.h. [ 5 ] Later versions of Windows have adjusted the number and purpose of some fields. [ 6 ] References [ edit ] ^ a b Rajeev Nagar (1997). Windows NT file system internals: a developer's guide . O'Reilly Series. O'Reilly. pp.  129 . ISBN   9781565922495 . ^ a b c d "Process and Thread structures: PEB Structure" . MSDN Library . Microsoft . 2010-07-15. Archived from the original on 2012-10-22 . Retrieved 2010-07-15 . ^ a b c d e f Mark E. Russinovich , David A. Solomon, and Alex Ionescu (2009). Windows internals . Microsoft Press Series (5th ed.). Microsoft Press. pp.  335– 336, 341– 342, 348, 357– 358. ISBN   9780735625303 . {{ cite book }} : CS1 maint: multiple names: authors list ( link ) ^ "Process and Thread structures: RTL_USER_PROCESS_PARAMETERS Structure" . MSDN Library . Microsoft . 2010-07-15 . Retrieved 2010-07-15 . ^ "wine winternl.h: typedef struct _PEB" . GitHub . wine-mirror. 29 October 2019. ^ Chappel, Geoff. "PEB" . Retrieved 30 October 2019 . External links [ edit ] PEB definitions for various Windows versions Retrieved from " https://en.wikipedia.org/w/index.php?title=Process_Environment_Block&oldid=1238523892 " Categories : Windows NT architecture Data structures by computing platform Hidden categories: CS1 maint: multiple names: authors list Articles with short description Short description matches Wikidata This page was last edited on 4 August 2024, at 10:00  (UTC) . Text is available under the Creative Commons Attribution-ShareAlike 4.0 License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy . Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc. , a non-profit organization. Privacy policy About Wikipedia Disclaimers Contact Wikipedia Legal & safety contacts Code of Conduct Developers Statistics Cookie statement Mobile view Search Search Toggle the table of contents Process Environment Block 2 languages Add topic