Introduction

The Windows SDK and Windows Driver Kit (WDK) expose the structures that Microsoft supports applications and drivers accessing directly. Other structures may be only partially documented, declared as opaque types, or omitted from the public headers entirely.

When Microsoft publishes only part of an internal structure, the undisclosed fields are commonly replaced with members such as Reserved, Reserved1, or Reserved2. These placeholders preserve the position of the documented members without exposing the names or purposes of the internal fields.

Reserved members should not be interpreted as unused memory. They often represent active internal fields that Microsoft does not consider part of the supported programming interface. Microsoft explicitly warns that structures such as the PEB are internal structures whose layouts may change.

Some later modules require access to internal structure members that are not present in the public Windows headers. In these cases, the course may use definitions obtained from Microsoft symbols, open-source header projects, or reverse-engineering research.

Structure Documentation Levels

Windows structures generally fall into one of the following categories:

The categories below are not official classifications defined by Microsoft. They are used throughout this course to distinguish structures based on how much of their layout and intended usage is publicly documented.

• Documented - The structure's members and their supported uses are published in the Windows SDK or WDK. Examples include UNICODE_STRING, OBJECT_ATTRIBUTES, and MEMORY_BASIC_INFORMATION.
• Partially documented - Selected members are exposed, while the remaining fields are represented by reserved arrays, reserved pointers, or unnamed padding. Examples include PEB, TEB, RTL_USER_PROCESS_PARAMETERS, and SYSTEM_PROCESS_INFORMATION.
• Opaque - The structure type may be declared, and pointers to it may be passed between functions, but its members are not exposed in the public SDK or WDK headers. Applications and drivers are expected to interact with the object through supported functions rather than directly accessing its fields. Examples include EPROCESS and ETHREAD.
• Internal - The structure is not publicly defined in the Windows SDK or WDK, or the public headers do not provide enough information to use it fully. Its definition may need to be obtained from Microsoft symbols, maintained third-party header projects, or reverse-engineering research. Examples include PS_CREATE_INFO, PS_ATTRIBUTE_LIST, and several structures used with Native API system-information classes.

A structure's classification may change over time. Microsoft occasionally documents structures, members, or information classes that were previously considered internal. Therefore, the latest Microsoft documentation and the definitions available in the installed Windows SDK or WDK should always be checked before relying on an alternative source.

PEB Structure Example

The PEB was introduced in the previous module. It is used here only to demonstrate the difference between a public structure definition and its complete internal layout.

Microsoft's public PEB structure contains several reserved members.

typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  PVOID                         Reserved4[3];
  PVOID                         AtlThunkSListPtr;
  PVOID                         Reserved5;
  ULONG                         Reserved6;
  PVOID                         Reserved7;
  ULONG                         Reserved8;
  ULONG                         AtlThunkSListPtr32;
  PVOID                         Reserved9[45];
  BYTE                          Reserved10[96];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved11[128];
  PVOID                         Reserved12[1];
  ULONG                         SessionId;
} PEB, *PPEB;

Although the definition preserves the offsets of the documented members, it does not identify the fields represented by members such as Reserved3, Reserved4, or Reserved9.

Inspecting the PEB With WinDbg

One way to determine what the PEB's reserved members hold is through the !peb command in WinDbg.