Posted on 2009-04-01 08:42
S.l.e!ep.￠% 阅读(478)
评论(0) 编辑 收藏 引用 所属分类:
WinDbg
PEB（Process Environment Block，进程环境块）存放进程信息，每个进程都有自己的PEB信息。位于用户地址空间。
windbg 中使用 !peb 命令查看，当前进程的 PEB
PEB at 7ffd4000 <------ PEB 所在地址
InheritedAddressSpace: No
ReadImageFileExecOptions: No
BeingDebugged: Yes
ImageBaseAddress: 00400000
Ldr 015c6fd8
Ldr.Initialized: Yes
Ldr.InInitializationOrderModuleList: 015cafc0 . 01662fc0
Ldr.InLoadOrderModuleList: 015c8fb0 . 01662fb0
Ldr.InMemoryOrderModuleList: 015c8fb8 . 01662fb8
Base TimeStamp Module
ProcessHeap: 00140000 <------ 进程默认的堆句柄
使用 dt _PEB PEB所在地址 命令查看 PEB 中的相关信息
0:000> dt _PEB 7ffd4000
ntdll!_PEB
+0x000 InheritedAddressSpace : 0 ''
+0x001 ReadImageFileExecOptions : 0 ''
+0x002 BeingDebugged : 0x1 ''
+0x003 SpareBool : 0 ''
+0x004 Mutant : 0xffffffff
+0x008 ImageBaseAddress : 0x00400000
+0x00c Ldr : 0x015c6fd8 _PEB_LDR_DATA
+0x010 ProcessParameters : 0x00020000 _RTL_USER_PROCESS_PARAMETERS
+0x014 SubSystemData : (null)
+0x018 ProcessHeap : 0x00140000 <----- 进程（默认）堆句柄
+0x01c FastPebLock : 0x7c99e4c0 _RTL_CRITICAL_SECTION
+0x020 FastPebLockRoutine : 0x7c921005
+0x024 FastPebUnlockRoutine : 0x7c9210ed
+0x028 EnvironmentUpdateCount : 1
+0x02c KernelCallbackTable : 0x77d12970
+0x030 SystemReserved : [1] 0
+0x034 AtlThunkSListPtr32 : 0
+0x038 FreeList : (null)
+0x03c TlsExpansionCounter : 0
+0x040 TlsBitmap : 0x7c99e480
+0x044 TlsBitmapBits : [2] 0x1ffffff
+0x04c ReadOnlySharedMemoryBase : 0x7f6f0000
+0x050 ReadOnlySharedMemoryHeap : 0x7f6f0000
+0x054 ReadOnlyStaticServerData : 0x7f6f0688 -> (null)
+0x058 AnsiCodePageData : 0x7ffa0000
+0x05c OemCodePageData : 0x7ffa0000
+0x060 UnicodeCaseTableData : 0x7ffd1000
+0x064 NumberOfProcessors : 1
+0x068 NtGlobalFlag : 0x2100100
+0x070 CriticalSectionTimeout : _LARGE_INTEGER 0xffffe86d`079b8000
+0x078 HeapSegmentReserve : 0x100000 <----- 堆的默认保留大小，字节数 , 1M
+0x07c HeapSegmentCommit : 0x2000 <------堆的默认提交大小，8K
+0x080 HeapDeCommitTotalFreeThreshold : 0x10000
+0x084 HeapDeCommitFreeBlockThreshold : 0x1000
+0x088 NumberOfHeaps : 8
+0x08c MaximumNumberOfHeaps : 0x10
+0x090 ProcessHeaps : 0x7c99de80 -> 0x00240000
+0x094 GdiSharedHandleTable : 0x01a40000
+0x098 ProcessStarterHelper : (null)
+0x09c GdiDCAttributeList : 0x14
+0x0a0 LoaderLock : 0x7c99c0d8
+0x0a4 OSMajorVersion : 5
+0x0a8 OSMinorVersion : 1
+0x0ac OSBuildNumber : 0xa28
+0x0ae OSCSDVersion : 0x200
+0x0b0 OSPlatformId : 2
+0x0b4 ImageSubsystem : 2
+0x0b8 ImageSubsystemMajorVersion : 4
+0x0bc ImageSubsystemMinorVersion : 0
+0x0c0 ImageProcessAffinityMask : 0
+0x0c4 GdiHandleBuffer : [34] 0
+0x14c PostProcessInitRoutine : (null)
+0x150 TlsExpansionBitmap : 0x7c99e478
+0x154 TlsExpansionBitmapBits : [32] 0
+0x1d4 SessionId : 0
+0x1d8 AppCompatFlags : _ULARGE_INTEGER 0x0
+0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER 0x0
+0x1e8 pShimData : (null)
+0x1ec AppCompatInfo : (null)
+0x1f0 CSDVersion : _UNICODE_STRING "Service Pack 2"
+0x1f8 ActivationContextData : (null)
+0x1fc ProcessAssemblyStorageMap : (null)
+0x200 SystemDefaultActivationContextData : 0x00130000
+0x204 SystemAssemblyStorageMap : (null)
+0x208 MinimumStackCommit : 0
其它参数不详