Dave Korn wrote: > I'd investigate phdl.
> Now is it just my imagination, or does Vista really insert an extra ULONG > bitfield at offset 4 in the struct resulting in all subsequent members being > offset by 4 relative to other versions of Windows? This needs verifying > against the official MS headers. Nope, just looks like an artifact of the way that HTML documentation was generated; the supposed "ULONG :1" bitfields are actually just the bits of the BitField UCHAR, and not actually ULONG at all: http://forum.sysinternals.com/forum_posts.asp?TID=14624 > From WinDbg, in Vista SP1: > 0:000> dt ntdll!_PEB > +0x000 InheritedAddressSpace : UChar > +0x001 ReadImageFileExecOptions : UChar > +0x002 BeingDebugged : UChar > +0x003 BitField : UChar > +0x003 ImageUsesLargePages : Pos 0, 1 Bit > +0x003 IsProtectedProcess : Pos 1, 1 Bit > +0x003 IsLegacyProcess : Pos 2, 1 Bit > +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit > +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit > +0x003 SpareBits : Pos 5, 3 Bits > +0x004 Mutant : Ptr32 Void > +0x008 ImageBaseAddress : Ptr32 Void > +0x00c Ldr : Ptr32 _PEB_LDR_DATA > +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS Ah well, sorry about the red herring. (Mind you, it does also say > // The PEB and TEB structures are subject to changes between Windows > // releases, thus the fields offsets may change as well as the Reserved > // fields. The Reserved fields are reserved for use only by the Windows > // operating systems. Do not assume a maximum size for the structures. but that doesn't seem to be a possibility here in particular right at the start of the struct.) cheers, DaveK -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
