Skip to content

Instantly share code, notes, and snippets.

@utkonos

utkonos/Generate _PEB32 x64dbg struct.ipynb Secret

Last active February 17, 2022 11:25
Show Gist options
  • Save utkonos/7f82d27a389222352a671b2135aacb38 to your computer and use it in GitHub Desktop.
Save utkonos/7f82d27a389222352a671b2135aacb38 to your computer and use it in GitHub Desktop.
Download ZIP
Generate types.json from documentation
Display the source blob
Display the rendered blob
Raw
Generate _PEB32 x64dbg struct.ipynb
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Raw
types.json
{
"structs": [
{
"members": [
{
"name": "InheritedAddressSpace",
"type": "bool"
},
{
"name": "ReadImageFileExecOptions",
"type": "bool"
},
{
"name": "BeingDebugged",
"type": "bool"
},
{
"name": "BitField",
"type": "unsigned char"
},
{
"name": "Mutant",
"type": "HANDLE"
},
{
"name": "ImageBaseAddress",
"type": "unsigned long"
},
{
"name": "Ldr",
"type": "_PEB32_LDR_DATA"
},
{
"name": "ProcessParameters",
"type": "unsigned long"
},
{
"name": "SubSystemData",
"type": "unsigned long"
},
{
"name": "ProcessHeap",
"type": "unsigned long"
},
{
"name": "FastPebLock",
"type": "unsigned long"
},
{
"name": "AtlThunkSListPtr",
"type": "unsigned long"
},
{
"name": "IFEOKey",
"type": "unsigned long"
},
{
"name": "CrossProcessFlags",
"type": "unsigned long"
},
{
"name": "KernelCallbackTable",
"type": "unsigned long"
},
{
"name": "SystemReserved",
"type": "unsigned long"
},
{
"name": "AtlThunkSListPtr32",
"type": "unsigned long"
},
{
"name": "ApiSetMap",
"type": "unsigned long"
},
{
"name": "TlsExpansionCounter",
"type": "unsigned long"
},
{
"name": "TlsBitmap",
"type": "unsigned long"
},
{
"arrsize": 2,
"name": "TlsBitmapBits",
"type": "unsigned long"
},
{
"name": "ReadOnlySharedMemoryBase",
"type": "unsigned long"
},
{
"name": "SharedData",
"type": "unsigned long"
},
{
"name": "ReadOnlyStaticServerData",
"type": "unsigned long"
},
{
"name": "AnsiCodePageData",
"type": "unsigned long"
},
{
"name": "OemCodePageData",
"type": "unsigned long"
},
{
"name": "UnicodeCaseTableData",
"type": "unsigned long"
},
{
"name": "NumberOfProcessors",
"type": "unsigned long"
},
{
"name": "NtGlobalFlag",
"type": "unsigned long"
},
{
"name": "PADDING",
"type": "unsigned long"
},
{
"name": "CriticalSectionTimeout",
"type": "_LARGE_INTEGER"
},
{
"name": "HeapSegmentReserve",
"type": "unsigned long"
},
{
"name": "HeapSegmentCommit",
"type": "unsigned long"
},
{
"name": "HeapDeCommitTotalFreeThreshold",
"type": "unsigned long"
},
{
"name": "HeapDeCommitFreeBlockThreshold",
"type": "unsigned long"
},
{
"name": "NumberOfHeaps",
"type": "unsigned long"
},
{
"name": "MaximumNumberOfHeaps",
"type": "unsigned long"
},
{
"name": "ProcessHeaps",
"type": "unsigned long"
},
{
"name": "GdiSharedHandleTable",
"type": "unsigned long"
},
{
"name": "ProcessStarterHelper",
"type": "unsigned long"
},
{
"name": "GdiDCAttributeList",
"type": "unsigned long"
},
{
"name": "LoaderLock",
"type": "unsigned long"
},
{
"name": "OSMajorVersion",
"type": "unsigned long"
},
{
"name": "OSMinorVersion",
"type": "unsigned long"
},
{
"name": "OSBuildNumber",
"type": "unsigned short"
},
{
"name": "OSCSDVersion",
"type": "unsigned short"
},
{
"name": "OSPlatformId",
"type": "unsigned long"
},
{
"name": "ImageSubsystem",
"type": "unsigned long"
},
{
"name": "ImageSubsystemMajorVersion",
"type": "unsigned long"
},
{
"name": "ImageSubsystemMinorVersion",
"type": "unsigned long"
},
{
"name": "ActiveProcessAffinityMask",
"type": "unsigned long"
},
{
"arrsize": 34,
"name": "GdiHandleBuffer",
"type": "unsigned long"
},
{
"name": "PostProcessInitRoutine",
"type": "unsigned long"
},
{
"name": "TlsExpansionBitmap",
"type": "unsigned long"
},
{
"arrsize": 32,
"name": "TlsExpansionBitmapBits",
"type": "unsigned long"
},
{
"name": "SessionId",
"type": "unsigned long"
},
{
"name": "AppCompatFlags",
"type": "_ULARGE_INTEGER"
},
{
"name": "AppCompatFlagsUser",
"type": "_ULARGE_INTEGER"
},
{
"name": "pShimData",
"type": "unsigned long"
},
{
"name": "AppCompatInfo",
"type": "unsigned long"
},
{
"name": "CSDVersion",
"type": "_STRING32"
},
{
"name": "ActivationContextData",
"type": "unsigned long"
},
{
"name": "ProcessAssemblyStorageMap",
"type": "unsigned long"
},
{
"name": "SystemDefaultActivationContextData",
"type": "unsigned long"
},
{
"name": "SystemAssemblyStorageMap",
"type": "unsigned long"
},
{
"name": "MinimumStackCommit",
"type": "unsigned long"
},
{
"arrsize": 4,
"name": "SparePointers",
"type": "unsigned long"
},
{
"arrsize": 5,
"name": "SpareUlongs",
"type": "unsigned long"
},
{
"name": "WerRegistrationData",
"type": "unsigned long"
},
{
"name": "WerShipAssertPtr",
"type": "unsigned long"
},
{
"name": "pUnused",
"type": "unsigned long"
},
{
"name": "pImageHeaderHash",
"type": "unsigned long"
},
{
"name": "TracingFlags",
"type": "unsigned long"
},
{
"name": "PADDING2",
"type": "unsigned long"
},
{
"name": "CsrServerReadOnlySharedMemoryBase",
"type": "unsigned long long"
},
{
"name": "TppWorkerpListLock",
"type": "unsigned long"
},
{
"name": "TppWorkerpList",
"type": "LIST_ENTRY32"
},
{
"arrsize": 128,
"name": "WaitOnAddressHashTable",
"type": "unsigned long"
},
{
"name": "TelemetryCoverageHeader",
"type": "unsigned long"
},
{
"name": "CloudFileFlags",
"type": "unsigned long"
},
{
"name": "CloudFileDiagFlags",
"type": "unsigned long"
},
{
"name": "PlaceholderCompatibilityMode",
"type": "unsigned char"
},
{
"arrsize": 7,
"name": "PlaceholderCompatibilityModeReserved",
"type": "unsigned char"
},
{
"name": "LeapSecondData",
"type": "unsigned long"
},
{
"name": "LeapSecondFlags",
"type": "unsigned long"
},
{
"name": "NtGlobalFlag2",
"type": "unsigned long"
}
],
"name": "_PEB32"
},
{
"members": [
{
"name": "Length",
"type": "unsigned short"
},
{
"name": "MaximumLength",
"type": "unsigned short"
},
{
"name": "Buffer",
"type": "unsigned long"
}
],
"name": "_STRING32"
},
{
"members": [
{
"name": "Flink",
"type": "unsigned long"
},
{
"name": "Blink",
"type": "unsigned long"
}
],
"name": "LIST_ENTRY32"
},
{
"members": [
{
"name": "LowPart",
"type": "unsigned long"
},
{
"name": "HighPart",
"type": "long"
}
],
"name": "__unnamed_1119"
},
{
"members": [
{
"name": "LowPart",
"type": "unsigned long"
},
{
"name": "HighPart",
"type": "unsigned long"
}
],
"name": "__unnamed_108b"
}
],
"types": [
{
"name": "HANDLE",
"type": "unsigned long"
},
{
"name": "_PEB32_LDR_DATA",
"type": "ptr"
}
],
"unions": [
{
"members": [
{
"name": "LowPart",
"type": "unsigned long"
},
{
"name": "QuadPart",
"type": "long long"
},
{
"name": "u",
"type": "__unnamed_1119"
},
{
"name": "HighPart",
"type": "long"
}
],
"name": "_LARGE_INTEGER"
},
{
"members": [
{
"name": "LowPart",
"type": "unsigned long"
},
{
"name": "QuadPart",
"type": "unsigned long long"
},
{
"name": "u",
"type": "__unnamed_108b"
},
{
"name": "HighPart",
"type": "unsigned long"
}
],
"name": "_ULARGE_INTEGER"
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment