Mail Archives: cygwin/2009/10/15/20:46:47
Dave Korn wrote:
> I'd investigate phdl.
> Now is it just my imagination, or does Vista really insert an extra ULONG
> bitfield at offset 4 in the struct resulting in all subsequent members being
> offset by 4 relative to other versions of Windows? This needs verifying
> against the official MS headers.
Nope, just looks like an artifact of the way that HTML documentation was
generated; the supposed "ULONG :1" bitfields are actually just the bits of the
BitField UCHAR, and not actually ULONG at all:
http://forum.sysinternals.com/forum_posts.asp?TID=14624
> From WinDbg, in Vista SP1:
> 0:000> dt ntdll!_PEB
> +0x000 InheritedAddressSpace : UChar
> +0x001 ReadImageFileExecOptions : UChar
> +0x002 BeingDebugged : UChar
> +0x003 BitField : UChar
> +0x003 ImageUsesLargePages : Pos 0, 1 Bit
> +0x003 IsProtectedProcess : Pos 1, 1 Bit
> +0x003 IsLegacyProcess : Pos 2, 1 Bit
> +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
> +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
> +0x003 SpareBits : Pos 5, 3 Bits
> +0x004 Mutant : Ptr32 Void
> +0x008 ImageBaseAddress : Ptr32 Void
> +0x00c Ldr : Ptr32 _PEB_LDR_DATA
> +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
Ah well, sorry about the red herring.
(Mind you, it does also say
> // The PEB and TEB structures are subject to changes between Windows
> // releases, thus the fields offsets may change as well as the Reserved
> // fields. The Reserved fields are reserved for use only by the Windows
> // operating systems. Do not assume a maximum size for the structures.
but that doesn't seem to be a possibility here in particular right at the
start of the struct.)
cheers,
DaveK
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
- Raw text -