├── PE-Runtime.graffle
├── PE-Runtime.jpg
├── PE-Runtime.pdf
└── README.md


/PE-Runtime.graffle:
--------------------------------------------------------------------------------
   1 | <?xml version="1.0" encoding="UTF-8"?>
   2 | <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   3 | <plist version="1.0">
   4 | <dict>
   5 | 	<key>ActiveLayerIndex</key>
   6 | 	<integer>0</integer>
   7 | 	<key>ApplicationVersion</key>
   8 | 	<array>
   9 | 		<string>com.omnigroup.OmniGrafflePro</string>
  10 | 		<string>139.18.0.187838</string>
  11 | 	</array>
  12 | 	<key>AutoAdjust</key>
  13 | 	<true/>
  14 | 	<key>BackgroundGraphic</key>
  15 | 	<dict>
  16 | 		<key>Bounds</key>
  17 | 		<string>{{0, 0}, {3688, 5348}}</string>
  18 | 		<key>Class</key>
  19 | 		<string>SolidGraphic</string>
  20 | 		<key>ID</key>
  21 | 		<integer>2</integer>
  22 | 		<key>Style</key>
  23 | 		<dict>
  24 | 			<key>fill</key>
  25 | 			<dict>
  26 | 				<key>FillType</key>
  27 | 				<integer>2</integer>
  28 | 				<key>GradientAngle</key>
  29 | 				<real>90</real>
  30 | 				<key>GradientColor</key>
  31 | 				<dict>
  32 | 					<key>w</key>
  33 | 					<string>0.666667</string>
  34 | 				</dict>
  35 | 				<key>MiddleFraction</key>
  36 | 				<real>0.59021580219268799</real>
  37 | 			</dict>
  38 | 			<key>shadow</key>
  39 | 			<dict>
  40 | 				<key>Draws</key>
  41 | 				<string>NO</string>
  42 | 			</dict>
  43 | 			<key>stroke</key>
  44 | 			<dict>
  45 | 				<key>Draws</key>
  46 | 				<string>NO</string>
  47 | 			</dict>
  48 | 		</dict>
  49 | 	</dict>
  50 | 	<key>BaseZoom</key>
  51 | 	<integer>0</integer>
  52 | 	<key>CanvasOrigin</key>
  53 | 	<string>{0, 0}</string>
  54 | 	<key>CanvasSize</key>
  55 | 	<string>{3688, 5348}</string>
  56 | 	<key>ColumnAlign</key>
  57 | 	<integer>1</integer>
  58 | 	<key>ColumnSpacing</key>
  59 | 	<real>36</real>
  60 | 	<key>CreationDate</key>
  61 | 	<string>2013-07-19 20:50:54 +0000</string>
  62 | 	<key>Creator</key>
  63 | 	<string>Malware</string>
  64 | 	<key>DisplayScale</key>
  65 | 	<string>1 0/72 in = 1 0/72 in</string>
  66 | 	<key>GraphDocumentVersion</key>
  67 | 	<integer>8</integer>
  68 | 	<key>GraphicsList</key>
  69 | 	<array>
  70 | 		<dict>
  71 | 			<key>Bounds</key>
  72 | 			<string>{{200.5, 1076}, {245, 128}}</string>
  73 | 			<key>Class</key>
  74 | 			<string>ShapedGraphic</string>
  75 | 			<key>ID</key>
  76 | 			<integer>91</integer>
  77 | 			<key>Shape</key>
  78 | 			<string>Rectangle</string>
  79 | 			<key>Style</key>
  80 | 			<dict>
  81 | 				<key>fill</key>
  82 | 				<dict>
  83 | 					<key>Color</key>
  84 | 					<dict>
  85 | 						<key>b</key>
  86 | 						<string>0.84153</string>
  87 | 						<key>g</key>
  88 | 						<string>1</string>
  89 | 						<key>r</key>
  90 | 						<string>0.991234</string>
  91 | 					</dict>
  92 | 				</dict>
  93 | 			</dict>
  94 | 		</dict>
  95 | 		<dict>
  96 | 			<key>AllowConnections</key>
  97 | 			<string>NO</string>
  98 | 			<key>AllowToConnect</key>
  99 | 			<false/>
 100 | 			<key>Class</key>
 101 | 			<string>LineGraphic</string>
 102 | 			<key>ID</key>
 103 | 			<integer>89</integer>
 104 | 			<key>Points</key>
 105 | 			<array>
 106 | 				<string>{1083, 5006}</string>
 107 | 				<string>{1332, 4923}</string>
 108 | 			</array>
 109 | 			<key>Style</key>
 110 | 			<dict>
 111 | 				<key>stroke</key>
 112 | 				<dict>
 113 | 					<key>HeadArrow</key>
 114 | 					<string>FilledArrow</string>
 115 | 					<key>Legacy</key>
 116 | 					<true/>
 117 | 					<key>TailArrow</key>
 118 | 					<string>0</string>
 119 | 					<key>Width</key>
 120 | 					<real>4</real>
 121 | 				</dict>
 122 | 			</dict>
 123 | 		</dict>
 124 | 		<dict>
 125 | 			<key>AllowConnections</key>
 126 | 			<string>NO</string>
 127 | 			<key>AllowToConnect</key>
 128 | 			<false/>
 129 | 			<key>Class</key>
 130 | 			<string>LineGraphic</string>
 131 | 			<key>ID</key>
 132 | 			<integer>88</integer>
 133 | 			<key>OrthogonalBarAutomatic</key>
 134 | 			<true/>
 135 | 			<key>OrthogonalBarPoint</key>
 136 | 			<string>{0, 0}</string>
 137 | 			<key>OrthogonalBarPosition</key>
 138 | 			<real>-1</real>
 139 | 			<key>Points</key>
 140 | 			<array>
 141 | 				<string>{3548, 1901}</string>
 142 | 				<string>{3628, 1904}</string>
 143 | 				<string>{3583, 4336}</string>
 144 | 				<string>{1863, 4336}</string>
 145 | 			</array>
 146 | 			<key>Style</key>
 147 | 			<dict>
 148 | 				<key>stroke</key>
 149 | 				<dict>
 150 | 					<key>HeadArrow</key>
 151 | 					<string>FilledArrow</string>
 152 | 					<key>Legacy</key>
 153 | 					<true/>
 154 | 					<key>LineType</key>
 155 | 					<integer>2</integer>
 156 | 					<key>TailArrow</key>
 157 | 					<string>0</string>
 158 | 					<key>Width</key>
 159 | 					<real>4</real>
 160 | 				</dict>
 161 | 			</dict>
 162 | 		</dict>
 163 | 		<dict>
 164 | 			<key>Bounds</key>
 165 | 			<string>{{170.5, 882}, {291, 128}}</string>
 166 | 			<key>Class</key>
 167 | 			<string>ShapedGraphic</string>
 168 | 			<key>ID</key>
 169 | 			<integer>84</integer>
 170 | 			<key>Shape</key>
 171 | 			<string>Circle</string>
 172 | 			<key>Style</key>
 173 | 			<dict>
 174 | 				<key>fill</key>
 175 | 				<dict>
 176 | 					<key>Color</key>
 177 | 					<dict>
 178 | 						<key>b</key>
 179 | 						<string>1</string>
 180 | 						<key>g</key>
 181 | 						<string>0.970601</string>
 182 | 						<key>r</key>
 183 | 						<string>0.476019</string>
 184 | 					</dict>
 185 | 				</dict>
 186 | 			</dict>
 187 | 			<key>Text</key>
 188 | 			<dict>
 189 | 				<key>Align</key>
 190 | 				<integer>0</integer>
 191 | 				<key>Text</key>
 192 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 193 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 194 | {\colortbl;\red255\green255\blue255;\red0\green128\blue0;}
 195 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 196 | 
 197 | \f0\fs31 \cf2 // find BeingDebugged
 198 | \fs36 \cf0 \
 199 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qj
 200 | \cf0 mov eax, dword ptr fs:[0x30\
 201 | mov eax, [eax + 2]}</string>
 202 | 				<key>VerticalPad</key>
 203 | 				<integer>0</integer>
 204 | 			</dict>
 205 | 		</dict>
 206 | 		<dict>
 207 | 			<key>AllowConnections</key>
 208 | 			<string>NO</string>
 209 | 			<key>AllowToConnect</key>
 210 | 			<false/>
 211 | 			<key>Class</key>
 212 | 			<string>LineGraphic</string>
 213 | 			<key>ID</key>
 214 | 			<integer>83</integer>
 215 | 			<key>Points</key>
 216 | 			<array>
 217 | 				<string>{1840, 2026.881583054228}</string>
 218 | 				<string>{2081, 2404}</string>
 219 | 			</array>
 220 | 			<key>Style</key>
 221 | 			<dict>
 222 | 				<key>stroke</key>
 223 | 				<dict>
 224 | 					<key>GapRatio</key>
 225 | 					<real>0.5</real>
 226 | 					<key>HeadArrow</key>
 227 | 					<string>FilledArrow</string>
 228 | 					<key>Legacy</key>
 229 | 					<true/>
 230 | 					<key>TailArrow</key>
 231 | 					<string>0</string>
 232 | 					<key>Width</key>
 233 | 					<real>16</real>
 234 | 				</dict>
 235 | 			</dict>
 236 | 		</dict>
 237 | 		<dict>
 238 | 			<key>Bounds</key>
 239 | 			<string>{{1730.5, 1863}, {205, 200}}</string>
 240 | 			<key>Class</key>
 241 | 			<string>ShapedGraphic</string>
 242 | 			<key>ID</key>
 243 | 			<integer>81</integer>
 244 | 			<key>Shape</key>
 245 | 			<string>AdjustableStar</string>
 246 | 			<key>ShapeData</key>
 247 | 			<dict/>
 248 | 			<key>Style</key>
 249 | 			<dict>
 250 | 				<key>fill</key>
 251 | 				<dict>
 252 | 					<key>Color</key>
 253 | 					<dict>
 254 | 						<key>b</key>
 255 | 						<string>0.0941176</string>
 256 | 						<key>g</key>
 257 | 						<string>0.917647</string>
 258 | 						<key>r</key>
 259 | 						<string>1</string>
 260 | 					</dict>
 261 | 				</dict>
 262 | 			</dict>
 263 | 			<key>Text</key>
 264 | 			<dict>
 265 | 				<key>Text</key>
 266 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 267 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 268 | {\colortbl;\red255\green255\blue255;}
 269 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
 270 | 
 271 | \f0\fs36 \cf0 \
 272 | mov eax, fs:[0]
 273 | \fs72 \
 274 | }</string>
 275 | 				<key>VerticalPad</key>
 276 | 				<integer>0</integer>
 277 | 			</dict>
 278 | 			<key>TextRelativeArea</key>
 279 | 			<string>{{0.13500000000000001, 0.115}, {0.75, 0.75}}</string>
 280 | 		</dict>
 281 | 		<dict>
 282 | 			<key>AllowConnections</key>
 283 | 			<string>NO</string>
 284 | 			<key>AllowToConnect</key>
 285 | 			<false/>
 286 | 			<key>Class</key>
 287 | 			<string>LineGraphic</string>
 288 | 			<key>ID</key>
 289 | 			<integer>80</integer>
 290 | 			<key>Points</key>
 291 | 			<array>
 292 | 				<string>{2813.4590355951404, 2265.440791527114}</string>
 293 | 				<string>{3018, 2422}</string>
 294 | 			</array>
 295 | 			<key>Style</key>
 296 | 			<dict>
 297 | 				<key>stroke</key>
 298 | 				<dict>
 299 | 					<key>GapRatio</key>
 300 | 					<real>0.5</real>
 301 | 					<key>HeadArrow</key>
 302 | 					<string>FilledArrow</string>
 303 | 					<key>Legacy</key>
 304 | 					<true/>
 305 | 					<key>TailArrow</key>
 306 | 					<string>0</string>
 307 | 					<key>Width</key>
 308 | 					<real>16</real>
 309 | 				</dict>
 310 | 			</dict>
 311 | 		</dict>
 312 | 		<dict>
 313 | 			<key>Bounds</key>
 314 | 			<string>{{2520, 2127.5}, {337, 164}}</string>
 315 | 			<key>Class</key>
 316 | 			<string>ShapedGraphic</string>
 317 | 			<key>ID</key>
 318 | 			<integer>79</integer>
 319 | 			<key>Shape</key>
 320 | 			<string>Circle</string>
 321 | 			<key>Style</key>
 322 | 			<dict>
 323 | 				<key>fill</key>
 324 | 				<dict>
 325 | 					<key>Color</key>
 326 | 					<dict>
 327 | 						<key>b</key>
 328 | 						<string>1</string>
 329 | 						<key>g</key>
 330 | 						<string>0.970601</string>
 331 | 						<key>r</key>
 332 | 						<string>0.476019</string>
 333 | 					</dict>
 334 | 				</dict>
 335 | 			</dict>
 336 | 			<key>Text</key>
 337 | 			<dict>
 338 | 				<key>Align</key>
 339 | 				<integer>0</integer>
 340 | 				<key>Text</key>
 341 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 342 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 343 | {\colortbl;\red255\green255\blue255;\red0\green128\blue0;}
 344 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 345 | 
 346 | \f0\fs31 \cf2 // Install custom SEH at 0x010061c0
 347 | \fs36 \cf0 \
 348 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qj
 349 | \cf0 push offset 0x010061c0\
 350 | mov eax, dword ptr fs:[0]\
 351 | push eax\
 352 | mov fs[0], esp}</string>
 353 | 				<key>VerticalPad</key>
 354 | 				<integer>0</integer>
 355 | 			</dict>
 356 | 		</dict>
 357 | 		<dict>
 358 | 			<key>AllowConnections</key>
 359 | 			<string>NO</string>
 360 | 			<key>AllowToConnect</key>
 361 | 			<false/>
 362 | 			<key>Class</key>
 363 | 			<string>LineGraphic</string>
 364 | 			<key>ID</key>
 365 | 			<integer>78</integer>
 366 | 			<key>Points</key>
 367 | 			<array>
 368 | 				<string>{1630.6476342279529, 3126}</string>
 369 | 				<string>{1686, 2956}</string>
 370 | 			</array>
 371 | 			<key>Style</key>
 372 | 			<dict>
 373 | 				<key>stroke</key>
 374 | 				<dict>
 375 | 					<key>GapRatio</key>
 376 | 					<real>0.5</real>
 377 | 					<key>HeadArrow</key>
 378 | 					<string>FilledArrow</string>
 379 | 					<key>Legacy</key>
 380 | 					<true/>
 381 | 					<key>TailArrow</key>
 382 | 					<string>0</string>
 383 | 					<key>Width</key>
 384 | 					<real>16</real>
 385 | 				</dict>
 386 | 			</dict>
 387 | 		</dict>
 388 | 		<dict>
 389 | 			<key>Bounds</key>
 390 | 			<string>{{1493, 3098}, {593.5, 218}}</string>
 391 | 			<key>Class</key>
 392 | 			<string>ShapedGraphic</string>
 393 | 			<key>ID</key>
 394 | 			<integer>77</integer>
 395 | 			<key>Shape</key>
 396 | 			<string>Circle</string>
 397 | 			<key>Style</key>
 398 | 			<dict>
 399 | 				<key>fill</key>
 400 | 				<dict>
 401 | 					<key>Color</key>
 402 | 					<dict>
 403 | 						<key>b</key>
 404 | 						<string>1</string>
 405 | 						<key>g</key>
 406 | 						<string>0.970601</string>
 407 | 						<key>r</key>
 408 | 						<string>0.476019</string>
 409 | 					</dict>
 410 | 				</dict>
 411 | 			</dict>
 412 | 			<key>Text</key>
 413 | 			<dict>
 414 | 				<key>Align</key>
 415 | 				<integer>3</integer>
 416 | 				<key>Text</key>
 417 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 418 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 419 | {\colortbl;\red255\green255\blue255;\red0\green128\blue0;}
 420 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 421 | 
 422 | \f0\fs31 \cf2 // find base addr of kernel32.dll\cf0 \
 423 |   mov ebx, fs:[edx + 0x30]  ;ebx = ADDRESS of PEB\
 424 |   mov ecx, [ebx + 0xc]      ;ecx = pointer to loader data\
 425 |   mov ecx, [ecx + 0x1c]     ;ecx = first entry in initialization order list\
 426 |   mov ecx, [ecx]            ;ecx = second entry in list (kernelab.dll)\
 427 |   mov ecx, [ecx]            ;ecx = third entry in list (kernel32.dll)\
 428 |   mov ebp, [ecx + 0x08]     ;ebp = base ADDRESS of kernel32.dll}</string>
 429 | 				<key>VerticalPad</key>
 430 | 				<integer>0</integer>
 431 | 			</dict>
 432 | 		</dict>
 433 | 		<dict>
 434 | 			<key>AllowConnections</key>
 435 | 			<string>NO</string>
 436 | 			<key>AllowToConnect</key>
 437 | 			<false/>
 438 | 			<key>Class</key>
 439 | 			<string>LineGraphic</string>
 440 | 			<key>ID</key>
 441 | 			<integer>76</integer>
 442 | 			<key>Points</key>
 443 | 			<array>
 444 | 				<string>{1622.9180711902809, 2295}</string>
 445 | 				<string>{1681.9180717468262, 2630}</string>
 446 | 			</array>
 447 | 			<key>Style</key>
 448 | 			<dict>
 449 | 				<key>stroke</key>
 450 | 				<dict>
 451 | 					<key>GapRatio</key>
 452 | 					<real>0.5</real>
 453 | 					<key>HeadArrow</key>
 454 | 					<string>FilledArrow</string>
 455 | 					<key>Legacy</key>
 456 | 					<true/>
 457 | 					<key>TailArrow</key>
 458 | 					<string>0</string>
 459 | 					<key>Width</key>
 460 | 					<real>16</real>
 461 | 				</dict>
 462 | 			</dict>
 463 | 		</dict>
 464 | 		<dict>
 465 | 			<key>AllowConnections</key>
 466 | 			<string>NO</string>
 467 | 			<key>AllowToConnect</key>
 468 | 			<false/>
 469 | 			<key>Class</key>
 470 | 			<string>LineGraphic</string>
 471 | 			<key>ID</key>
 472 | 			<integer>75</integer>
 473 | 			<key>Points</key>
 474 | 			<array>
 475 | 				<string>{1003.9069364097368, 2281}</string>
 476 | 				<string>{1053, 2420}</string>
 477 | 			</array>
 478 | 			<key>Style</key>
 479 | 			<dict>
 480 | 				<key>stroke</key>
 481 | 				<dict>
 482 | 					<key>GapRatio</key>
 483 | 					<real>0.5</real>
 484 | 					<key>HeadArrow</key>
 485 | 					<string>FilledArrow</string>
 486 | 					<key>Legacy</key>
 487 | 					<true/>
 488 | 					<key>TailArrow</key>
 489 | 					<string>0</string>
 490 | 					<key>Width</key>
 491 | 					<real>16</real>
 492 | 				</dict>
 493 | 			</dict>
 494 | 		</dict>
 495 | 		<dict>
 496 | 			<key>Bounds</key>
 497 | 			<string>{{862, 2162}, {337, 119}}</string>
 498 | 			<key>Class</key>
 499 | 			<string>ShapedGraphic</string>
 500 | 			<key>ID</key>
 501 | 			<integer>74</integer>
 502 | 			<key>Shape</key>
 503 | 			<string>Circle</string>
 504 | 			<key>Style</key>
 505 | 			<dict>
 506 | 				<key>fill</key>
 507 | 				<dict>
 508 | 					<key>Color</key>
 509 | 					<dict>
 510 | 						<key>b</key>
 511 | 						<string>1</string>
 512 | 						<key>g</key>
 513 | 						<string>0.970601</string>
 514 | 						<key>r</key>
 515 | 						<string>0.476019</string>
 516 | 					</dict>
 517 | 				</dict>
 518 | 			</dict>
 519 | 			<key>Text</key>
 520 | 			<dict>
 521 | 				<key>Align</key>
 522 | 				<integer>0</integer>
 523 | 				<key>Text</key>
 524 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 525 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 526 | {\colortbl;\red255\green255\blue255;\red0\green128\blue0;}
 527 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 528 | 
 529 | \f0\fs31 \cf2 // find BeingDebugged
 530 | \fs36 \cf0 \
 531 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qj
 532 | \cf0 mov eax, dword ptr fs:[0x30\
 533 | mov eax, [eax + 2]}</string>
 534 | 				<key>VerticalPad</key>
 535 | 				<integer>0</integer>
 536 | 			</dict>
 537 | 		</dict>
 538 | 		<dict>
 539 | 			<key>Bounds</key>
 540 | 			<string>{{1437.5, 2176}, {337, 119}}</string>
 541 | 			<key>Class</key>
 542 | 			<string>ShapedGraphic</string>
 543 | 			<key>ID</key>
 544 | 			<integer>73</integer>
 545 | 			<key>Shape</key>
 546 | 			<string>Circle</string>
 547 | 			<key>Style</key>
 548 | 			<dict>
 549 | 				<key>fill</key>
 550 | 				<dict>
 551 | 					<key>Color</key>
 552 | 					<dict>
 553 | 						<key>b</key>
 554 | 						<string>1</string>
 555 | 						<key>g</key>
 556 | 						<string>0.970601</string>
 557 | 						<key>r</key>
 558 | 						<string>0.476019</string>
 559 | 					</dict>
 560 | 				</dict>
 561 | 			</dict>
 562 | 			<key>Text</key>
 563 | 			<dict>
 564 | 				<key>Align</key>
 565 | 				<integer>0</integer>
 566 | 				<key>Text</key>
 567 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 568 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 569 | {\colortbl;\red255\green255\blue255;\red0\green128\blue0;}
 570 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 571 | 
 572 | \f0\fs31 \cf2 // PEB_LDR_DATA
 573 | \fs36 \cf0 \
 574 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qj
 575 | \cf0 mov eax, dword ptr fs:[0x30]\
 576 | mov eax, [eax + 0xc]}</string>
 577 | 				<key>VerticalPad</key>
 578 | 				<integer>0</integer>
 579 | 			</dict>
 580 | 		</dict>
 581 | 		<dict>
 582 | 			<key>AllowConnections</key>
 583 | 			<string>NO</string>
 584 | 			<key>AllowToConnect</key>
 585 | 			<false/>
 586 | 			<key>Class</key>
 587 | 			<string>LineGraphic</string>
 588 | 			<key>ID</key>
 589 | 			<integer>72</integer>
 590 | 			<key>Points</key>
 591 | 			<array>
 592 | 				<string>{2017, 2744}</string>
 593 | 				<string>{2070, 2744}</string>
 594 | 				<string>{2070, 2934}</string>
 595 | 				<string>{2011, 2933}</string>
 596 | 			</array>
 597 | 			<key>Style</key>
 598 | 			<dict>
 599 | 				<key>stroke</key>
 600 | 				<dict>
 601 | 					<key>HeadArrow</key>
 602 | 					<string>FilledArrow</string>
 603 | 					<key>Legacy</key>
 604 | 					<true/>
 605 | 					<key>TailArrow</key>
 606 | 					<string>0</string>
 607 | 					<key>Width</key>
 608 | 					<real>4</real>
 609 | 				</dict>
 610 | 			</dict>
 611 | 		</dict>
 612 | 		<dict>
 613 | 			<key>Bounds</key>
 614 | 			<string>{{1686, 2853}, {331, 164}}</string>
 615 | 			<key>Class</key>
 616 | 			<string>ShapedGraphic</string>
 617 | 			<key>ID</key>
 618 | 			<integer>71</integer>
 619 | 			<key>Shape</key>
 620 | 			<string>Rectangle</string>
 621 | 			<key>Text</key>
 622 | 			<dict>
 623 | 				<key>Text</key>
 624 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 625 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 626 | {\colortbl;\red255\green255\blue255;}
 627 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
 628 | 
 629 | \f0\fs48 \cf0 LDR_MODULE\
 630 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 631 | 
 632 | \fs24   \
 633 |    +0x000 InLoadOrder : LIST_ENTRY\
 634 |    +0x008 InMemOrder  : LIST_ENTRY\
 635 | 
 636 | \b    +0x010 InInitOrder : LIST_ENTRY\
 637 | 
 638 | \b0    +0x018 DllBase     : uint32_t\
 639 |    +0x01c EntryPoint  : uint32_t\
 640 |    +0x01f Reserved    : uint32_t\
 641 |    +0x024 FullDllName : UNICODE_STRING\
 642 |    +0x02c BaseDllName : UNICODE_STRING}</string>
 643 | 			</dict>
 644 | 		</dict>
 645 | 		<dict>
 646 | 			<key>AllowConnections</key>
 647 | 			<string>NO</string>
 648 | 			<key>AllowToConnect</key>
 649 | 			<false/>
 650 | 			<key>Class</key>
 651 | 			<string>LineGraphic</string>
 652 | 			<key>ID</key>
 653 | 			<integer>70</integer>
 654 | 			<key>Points</key>
 655 | 			<array>
 656 | 				<string>{1572, 2631}</string>
 657 | 				<string>{1686, 2646}</string>
 658 | 			</array>
 659 | 			<key>Style</key>
 660 | 			<dict>
 661 | 				<key>stroke</key>
 662 | 				<dict>
 663 | 					<key>HeadArrow</key>
 664 | 					<string>FilledArrow</string>
 665 | 					<key>Legacy</key>
 666 | 					<true/>
 667 | 					<key>TailArrow</key>
 668 | 					<string>0</string>
 669 | 					<key>Width</key>
 670 | 					<real>4</real>
 671 | 				</dict>
 672 | 			</dict>
 673 | 		</dict>
 674 | 		<dict>
 675 | 			<key>Bounds</key>
 676 | 			<string>{{1686, 2614}, {331, 200}}</string>
 677 | 			<key>Class</key>
 678 | 			<string>ShapedGraphic</string>
 679 | 			<key>ID</key>
 680 | 			<integer>69</integer>
 681 | 			<key>Shape</key>
 682 | 			<string>Rectangle</string>
 683 | 			<key>Text</key>
 684 | 			<dict>
 685 | 				<key>Text</key>
 686 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 687 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 688 | {\colortbl;\red255\green255\blue255;}
 689 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
 690 | 
 691 | \f0\fs48 \cf0 PEB_LDR_DATA\
 692 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 693 | 
 694 | \fs24    \
 695 |    +0x000 Length           : Uint4B\
 696 |    +0x004 Initialized      : UChar\
 697 |    +0x008 SsHandle         : Ptr64 Void\
 698 |    +0x010 InLoadOrderModuleList :            LIST_ENTRY\
 699 |    +0x020 InMemoryOrderModuleList :       LIST_ENTRY\
 700 |    
 701 | \b +0x030 InInitializationOrderModuleList : LIST_ENTRY\
 702 | 
 703 | \b0    +0x040 EntryInProgress  : Ptr64 Void\
 704 |    +0x048 ShutdownInProgress : UChar\
 705 |    +0x050 ShutdownThreadId : Ptr64 Void\
 706 | }</string>
 707 | 			</dict>
 708 | 		</dict>
 709 | 		<dict>
 710 | 			<key>AllowConnections</key>
 711 | 			<string>NO</string>
 712 | 			<key>AllowLabelDrop</key>
 713 | 			<false/>
 714 | 			<key>AllowToConnect</key>
 715 | 			<false/>
 716 | 			<key>Class</key>
 717 | 			<string>LineGraphic</string>
 718 | 			<key>ID</key>
 719 | 			<integer>67</integer>
 720 | 			<key>Points</key>
 721 | 			<array>
 722 | 				<string>{1825, 2245}</string>
 723 | 				<string>{2094, 2445}</string>
 724 | 			</array>
 725 | 			<key>Style</key>
 726 | 			<dict>
 727 | 				<key>stroke</key>
 728 | 				<dict>
 729 | 					<key>Color</key>
 730 | 					<dict>
 731 | 						<key>a</key>
 732 | 						<string>0</string>
 733 | 						<key>b</key>
 734 | 						<string>1</string>
 735 | 						<key>g</key>
 736 | 						<string>1</string>
 737 | 						<key>r</key>
 738 | 						<string>0.507692</string>
 739 | 					</dict>
 740 | 					<key>HeadArrow</key>
 741 | 					<string>FilledArrow</string>
 742 | 					<key>Legacy</key>
 743 | 					<true/>
 744 | 					<key>TailArrow</key>
 745 | 					<string>0</string>
 746 | 					<key>Width</key>
 747 | 					<real>4</real>
 748 | 				</dict>
 749 | 			</dict>
 750 | 		</dict>
 751 | 		<dict>
 752 | 			<key>Class</key>
 753 | 			<string>Group</string>
 754 | 			<key>Graphics</key>
 755 | 			<array>
 756 | 				<dict>
 757 | 					<key>AllowConnections</key>
 758 | 					<string>NO</string>
 759 | 					<key>AllowLabelDrop</key>
 760 | 					<false/>
 761 | 					<key>AllowToConnect</key>
 762 | 					<false/>
 763 | 					<key>Class</key>
 764 | 					<string>LineGraphic</string>
 765 | 					<key>ID</key>
 766 | 					<integer>86</integer>
 767 | 					<key>Points</key>
 768 | 					<array>
 769 | 						<string>{236, 752.61248779296875}</string>
 770 | 						<string>{408, 726.9999885559082}</string>
 771 | 					</array>
 772 | 					<key>Style</key>
 773 | 					<dict>
 774 | 						<key>stroke</key>
 775 | 						<dict>
 776 | 							<key>HeadArrow</key>
 777 | 							<string>0</string>
 778 | 							<key>Legacy</key>
 779 | 							<true/>
 780 | 							<key>Pattern</key>
 781 | 							<integer>1</integer>
 782 | 							<key>TailArrow</key>
 783 | 							<string>0</string>
 784 | 							<key>Width</key>
 785 | 							<real>4</real>
 786 | 						</dict>
 787 | 					</dict>
 788 | 				</dict>
 789 | 				<dict>
 790 | 					<key>AllowConnections</key>
 791 | 					<string>NO</string>
 792 | 					<key>AllowLabelDrop</key>
 793 | 					<false/>
 794 | 					<key>AllowToConnect</key>
 795 | 					<false/>
 796 | 					<key>Class</key>
 797 | 					<string>LineGraphic</string>
 798 | 					<key>ID</key>
 799 | 					<integer>87</integer>
 800 | 					<key>Points</key>
 801 | 					<array>
 802 | 						<string>{236, 771.61248779296875}</string>
 803 | 						<string>{404, 807.61248779296875}</string>
 804 | 					</array>
 805 | 					<key>Style</key>
 806 | 					<dict>
 807 | 						<key>stroke</key>
 808 | 						<dict>
 809 | 							<key>HeadArrow</key>
 810 | 							<string>0</string>
 811 | 							<key>Legacy</key>
 812 | 							<true/>
 813 | 							<key>Pattern</key>
 814 | 							<integer>1</integer>
 815 | 							<key>TailArrow</key>
 816 | 							<string>0</string>
 817 | 							<key>Width</key>
 818 | 							<real>4</real>
 819 | 						</dict>
 820 | 					</dict>
 821 | 				</dict>
 822 | 			</array>
 823 | 			<key>ID</key>
 824 | 			<integer>85</integer>
 825 | 		</dict>
 826 | 		<dict>
 827 | 			<key>AllowConnections</key>
 828 | 			<string>NO</string>
 829 | 			<key>AllowLabelDrop</key>
 830 | 			<false/>
 831 | 			<key>AllowToConnect</key>
 832 | 			<false/>
 833 | 			<key>Class</key>
 834 | 			<string>LineGraphic</string>
 835 | 			<key>ID</key>
 836 | 			<integer>63</integer>
 837 | 			<key>Points</key>
 838 | 			<array>
 839 | 				<string>{225, 594}</string>
 840 | 				<string>{419, 595}</string>
 841 | 			</array>
 842 | 			<key>Style</key>
 843 | 			<dict>
 844 | 				<key>stroke</key>
 845 | 				<dict>
 846 | 					<key>HeadArrow</key>
 847 | 					<string>FilledArrow</string>
 848 | 					<key>Legacy</key>
 849 | 					<true/>
 850 | 					<key>TailArrow</key>
 851 | 					<string>0</string>
 852 | 					<key>Width</key>
 853 | 					<real>4</real>
 854 | 				</dict>
 855 | 			</dict>
 856 | 		</dict>
 857 | 		<dict>
 858 | 			<key>Bounds</key>
 859 | 			<string>{{164, 511}, {781, 845}}</string>
 860 | 			<key>Class</key>
 861 | 			<string>ShapedGraphic</string>
 862 | 			<key>ID</key>
 863 | 			<integer>61</integer>
 864 | 			<key>Shape</key>
 865 | 			<string>Rectangle</string>
 866 | 			<key>Style</key>
 867 | 			<dict>
 868 | 				<key>fill</key>
 869 | 				<dict>
 870 | 					<key>FillType</key>
 871 | 					<integer>2</integer>
 872 | 					<key>GradientAngle</key>
 873 | 					<real>90</real>
 874 | 					<key>GradientColor</key>
 875 | 					<dict>
 876 | 						<key>w</key>
 877 | 						<string>0.666667</string>
 878 | 					</dict>
 879 | 					<key>MiddleFraction</key>
 880 | 					<real>0.819072425365448</real>
 881 | 				</dict>
 882 | 			</dict>
 883 | 			<key>Text</key>
 884 | 			<dict>
 885 | 				<key>Align</key>
 886 | 				<integer>0</integer>
 887 | 				<key>Text</key>
 888 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 889 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 890 | {\colortbl;\red255\green255\blue255;}
 891 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
 892 | 
 893 | \f0\fs96 \cf0                          \
 894 | \
 895 |                          
 896 | \b Pointed to 
 897 | \b0  \
 898 | \
 899 | \
 900 |                         
 901 | \b  Contained within\
 902 | \
 903 |                         \
 904 |                          Shellcode\
 905 | \
 906 |                          \
 907 |                          User space\
 908 | \
 909 | \
 910 | \
 911 | }</string>
 912 | 			</dict>
 913 | 		</dict>
 914 | 		<dict>
 915 | 			<key>Bounds</key>
 916 | 			<string>{{748, 98}, {2188, 173}}</string>
 917 | 			<key>Class</key>
 918 | 			<string>ShapedGraphic</string>
 919 | 			<key>FitText</key>
 920 | 			<string>Vertical</string>
 921 | 			<key>Flow</key>
 922 | 			<string>Resize</string>
 923 | 			<key>ID</key>
 924 | 			<integer>60</integer>
 925 | 			<key>Shape</key>
 926 | 			<string>Rectangle</string>
 927 | 			<key>Style</key>
 928 | 			<dict>
 929 | 				<key>fill</key>
 930 | 				<dict>
 931 | 					<key>Draws</key>
 932 | 					<string>NO</string>
 933 | 				</dict>
 934 | 				<key>shadow</key>
 935 | 				<dict>
 936 | 					<key>Draws</key>
 937 | 					<string>NO</string>
 938 | 				</dict>
 939 | 				<key>stroke</key>
 940 | 				<dict>
 941 | 					<key>Draws</key>
 942 | 					<string>NO</string>
 943 | 				</dict>
 944 | 			</dict>
 945 | 			<key>Text</key>
 946 | 			<dict>
 947 | 				<key>Pad</key>
 948 | 				<integer>0</integer>
 949 | 				<key>Text</key>
 950 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
 951 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 952 | {\colortbl;\red255\green255\blue255;}
 953 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
 954 | 
 955 | \f0\b\fs288 \cf0 PE Execution Data Structures}</string>
 956 | 				<key>VerticalPad</key>
 957 | 				<integer>0</integer>
 958 | 			</dict>
 959 | 		</dict>
 960 | 		<dict>
 961 | 			<key>AllowConnections</key>
 962 | 			<string>NO</string>
 963 | 			<key>AllowToConnect</key>
 964 | 			<false/>
 965 | 			<key>Class</key>
 966 | 			<string>LineGraphic</string>
 967 | 			<key>ID</key>
 968 | 			<integer>59</integer>
 969 | 			<key>Points</key>
 970 | 			<array>
 971 | 				<string>{2626, 796}</string>
 972 | 				<string>{3002, 540}</string>
 973 | 			</array>
 974 | 			<key>Style</key>
 975 | 			<dict>
 976 | 				<key>stroke</key>
 977 | 				<dict>
 978 | 					<key>HeadArrow</key>
 979 | 					<string>0</string>
 980 | 					<key>Legacy</key>
 981 | 					<true/>
 982 | 					<key>Pattern</key>
 983 | 					<integer>1</integer>
 984 | 					<key>TailArrow</key>
 985 | 					<string>0</string>
 986 | 					<key>Width</key>
 987 | 					<real>4</real>
 988 | 				</dict>
 989 | 			</dict>
 990 | 		</dict>
 991 | 		<dict>
 992 | 			<key>AllowConnections</key>
 993 | 			<string>NO</string>
 994 | 			<key>AllowToConnect</key>
 995 | 			<false/>
 996 | 			<key>Class</key>
 997 | 			<string>LineGraphic</string>
 998 | 			<key>ID</key>
 999 | 			<integer>58</integer>
1000 | 			<key>Points</key>
1001 | 			<array>
1002 | 				<string>{2626, 811}</string>
1003 | 				<string>{3018, 2228}</string>
1004 | 			</array>
1005 | 			<key>Style</key>
1006 | 			<dict>
1007 | 				<key>stroke</key>
1008 | 				<dict>
1009 | 					<key>HeadArrow</key>
1010 | 					<string>0</string>
1011 | 					<key>Legacy</key>
1012 | 					<true/>
1013 | 					<key>Pattern</key>
1014 | 					<integer>1</integer>
1015 | 					<key>TailArrow</key>
1016 | 					<string>0</string>
1017 | 					<key>Width</key>
1018 | 					<real>4</real>
1019 | 				</dict>
1020 | 			</dict>
1021 | 		</dict>
1022 | 		<dict>
1023 | 			<key>AllowConnections</key>
1024 | 			<string>NO</string>
1025 | 			<key>AllowToConnect</key>
1026 | 			<false/>
1027 | 			<key>Class</key>
1028 | 			<string>LineGraphic</string>
1029 | 			<key>ID</key>
1030 | 			<integer>57</integer>
1031 | 			<key>Points</key>
1032 | 			<array>
1033 | 				<string>{1577, 1660}</string>
1034 | 				<string>{2094, 780}</string>
1035 | 			</array>
1036 | 			<key>Style</key>
1037 | 			<dict>
1038 | 				<key>stroke</key>
1039 | 				<dict>
1040 | 					<key>HeadArrow</key>
1041 | 					<string>FilledArrow</string>
1042 | 					<key>Legacy</key>
1043 | 					<true/>
1044 | 					<key>TailArrow</key>
1045 | 					<string>0</string>
1046 | 					<key>Width</key>
1047 | 					<real>4</real>
1048 | 				</dict>
1049 | 			</dict>
1050 | 		</dict>
1051 | 		<dict>
1052 | 			<key>AllowConnections</key>
1053 | 			<string>NO</string>
1054 | 			<key>AllowToConnect</key>
1055 | 			<false/>
1056 | 			<key>Class</key>
1057 | 			<string>LineGraphic</string>
1058 | 			<key>ID</key>
1059 | 			<integer>56</integer>
1060 | 			<key>Points</key>
1061 | 			<array>
1062 | 				<string>{2105, 2555}</string>
1063 | 				<string>{1579, 2424}</string>
1064 | 			</array>
1065 | 			<key>Style</key>
1066 | 			<dict>
1067 | 				<key>stroke</key>
1068 | 				<dict>
1069 | 					<key>HeadArrow</key>
1070 | 					<string>FilledArrow</string>
1071 | 					<key>Legacy</key>
1072 | 					<true/>
1073 | 					<key>TailArrow</key>
1074 | 					<string>0</string>
1075 | 					<key>Width</key>
1076 | 					<real>4</real>
1077 | 				</dict>
1078 | 			</dict>
1079 | 		</dict>
1080 | 		<dict>
1081 | 			<key>AllowConnections</key>
1082 | 			<string>NO</string>
1083 | 			<key>AllowToConnect</key>
1084 | 			<false/>
1085 | 			<key>Class</key>
1086 | 			<string>LineGraphic</string>
1087 | 			<key>ID</key>
1088 | 			<integer>54</integer>
1089 | 			<key>Points</key>
1090 | 			<array>
1091 | 				<string>{2629, 2481}</string>
1092 | 				<string>{3028, 2595}</string>
1093 | 			</array>
1094 | 			<key>Style</key>
1095 | 			<dict>
1096 | 				<key>stroke</key>
1097 | 				<dict>
1098 | 					<key>HeadArrow</key>
1099 | 					<string>0</string>
1100 | 					<key>Legacy</key>
1101 | 					<true/>
1102 | 					<key>Pattern</key>
1103 | 					<integer>1</integer>
1104 | 					<key>TailArrow</key>
1105 | 					<string>0</string>
1106 | 					<key>Width</key>
1107 | 					<real>4</real>
1108 | 				</dict>
1109 | 			</dict>
1110 | 		</dict>
1111 | 		<dict>
1112 | 			<key>AllowConnections</key>
1113 | 			<string>NO</string>
1114 | 			<key>AllowToConnect</key>
1115 | 			<false/>
1116 | 			<key>Class</key>
1117 | 			<string>LineGraphic</string>
1118 | 			<key>ID</key>
1119 | 			<integer>53</integer>
1120 | 			<key>Points</key>
1121 | 			<array>
1122 | 				<string>{2629, 2468}</string>
1123 | 				<string>{3022, 2404}</string>
1124 | 			</array>
1125 | 			<key>Style</key>
1126 | 			<dict>
1127 | 				<key>stroke</key>
1128 | 				<dict>
1129 | 					<key>HeadArrow</key>
1130 | 					<string>0</string>
1131 | 					<key>Legacy</key>
1132 | 					<true/>
1133 | 					<key>Pattern</key>
1134 | 					<integer>1</integer>
1135 | 					<key>TailArrow</key>
1136 | 					<string>0</string>
1137 | 					<key>Width</key>
1138 | 					<real>4</real>
1139 | 				</dict>
1140 | 			</dict>
1141 | 		</dict>
1142 | 		<dict>
1143 | 			<key>AllowConnections</key>
1144 | 			<string>NO</string>
1145 | 			<key>AllowToConnect</key>
1146 | 			<false/>
1147 | 			<key>Class</key>
1148 | 			<string>LineGraphic</string>
1149 | 			<key>Head</key>
1150 | 			<dict>
1151 | 				<key>ID</key>
1152 | 				<integer>36</integer>
1153 | 			</dict>
1154 | 			<key>ID</key>
1155 | 			<integer>52</integer>
1156 | 			<key>OrthogonalBarAutomatic</key>
1157 | 			<true/>
1158 | 			<key>OrthogonalBarPoint</key>
1159 | 			<string>{0, 0}</string>
1160 | 			<key>OrthogonalBarPosition</key>
1161 | 			<real>-1</real>
1162 | 			<key>Points</key>
1163 | 			<array>
1164 | 				<string>{594, 2019}</string>
1165 | 				<string>{803.31408408675975, 4289.5021112331478}</string>
1166 | 			</array>
1167 | 			<key>Style</key>
1168 | 			<dict>
1169 | 				<key>stroke</key>
1170 | 				<dict>
1171 | 					<key>HeadArrow</key>
1172 | 					<string>FilledArrow</string>
1173 | 					<key>Legacy</key>
1174 | 					<true/>
1175 | 					<key>LineType</key>
1176 | 					<integer>2</integer>
1177 | 					<key>TailArrow</key>
1178 | 					<string>0</string>
1179 | 					<key>Width</key>
1180 | 					<real>4</real>
1181 | 				</dict>
1182 | 			</dict>
1183 | 		</dict>
1184 | 		<dict>
1185 | 			<key>AllowConnections</key>
1186 | 			<string>NO</string>
1187 | 			<key>AllowToConnect</key>
1188 | 			<false/>
1189 | 			<key>Class</key>
1190 | 			<string>LineGraphic</string>
1191 | 			<key>ID</key>
1192 | 			<integer>48</integer>
1193 | 			<key>Points</key>
1194 | 			<array>
1195 | 				<string>{594, 1587}</string>
1196 | 				<string>{1046, 1549.5}</string>
1197 | 			</array>
1198 | 			<key>Style</key>
1199 | 			<dict>
1200 | 				<key>stroke</key>
1201 | 				<dict>
1202 | 					<key>HeadArrow</key>
1203 | 					<string>0</string>
1204 | 					<key>Legacy</key>
1205 | 					<true/>
1206 | 					<key>Pattern</key>
1207 | 					<integer>1</integer>
1208 | 					<key>TailArrow</key>
1209 | 					<string>0</string>
1210 | 					<key>Width</key>
1211 | 					<real>4</real>
1212 | 				</dict>
1213 | 			</dict>
1214 | 		</dict>
1215 | 		<dict>
1216 | 			<key>AllowConnections</key>
1217 | 			<string>NO</string>
1218 | 			<key>AllowToConnect</key>
1219 | 			<false/>
1220 | 			<key>Class</key>
1221 | 			<string>LineGraphic</string>
1222 | 			<key>ID</key>
1223 | 			<integer>41</integer>
1224 | 			<key>Points</key>
1225 | 			<array>
1226 | 				<string>{594, 2432}</string>
1227 | 				<string>{1046, 2432}</string>
1228 | 			</array>
1229 | 			<key>Style</key>
1230 | 			<dict>
1231 | 				<key>stroke</key>
1232 | 				<dict>
1233 | 					<key>HeadArrow</key>
1234 | 					<string>FilledArrow</string>
1235 | 					<key>Legacy</key>
1236 | 					<true/>
1237 | 					<key>TailArrow</key>
1238 | 					<string>0</string>
1239 | 					<key>Width</key>
1240 | 					<real>4</real>
1241 | 				</dict>
1242 | 			</dict>
1243 | 		</dict>
1244 | 		<dict>
1245 | 			<key>AllowConnections</key>
1246 | 			<string>NO</string>
1247 | 			<key>AllowToConnect</key>
1248 | 			<false/>
1249 | 			<key>Class</key>
1250 | 			<string>LineGraphic</string>
1251 | 			<key>ID</key>
1252 | 			<integer>40</integer>
1253 | 			<key>Points</key>
1254 | 			<array>
1255 | 				<string>{594, 1604}</string>
1256 | 				<string>{1046, 2069}</string>
1257 | 			</array>
1258 | 			<key>Style</key>
1259 | 			<dict>
1260 | 				<key>stroke</key>
1261 | 				<dict>
1262 | 					<key>HeadArrow</key>
1263 | 					<string>0</string>
1264 | 					<key>Legacy</key>
1265 | 					<true/>
1266 | 					<key>Pattern</key>
1267 | 					<integer>1</integer>
1268 | 					<key>TailArrow</key>
1269 | 					<string>0</string>
1270 | 					<key>Width</key>
1271 | 					<real>4</real>
1272 | 				</dict>
1273 | 			</dict>
1274 | 		</dict>
1275 | 		<dict>
1276 | 			<key>Bounds</key>
1277 | 			<string>{{1332, 4888}, {526, 188}}</string>
1278 | 			<key>Class</key>
1279 | 			<string>ShapedGraphic</string>
1280 | 			<key>ID</key>
1281 | 			<integer>39</integer>
1282 | 			<key>Shape</key>
1283 | 			<string>Rectangle</string>
1284 | 			<key>Text</key>
1285 | 			<dict>
1286 | 				<key>Text</key>
1287 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1288 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1289 | {\colortbl;\red255\green255\blue255;}
1290 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1291 | 
1292 | \f0\fs72 \cf0 CSR_THREAD\
1293 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1294 | 
1295 | \fs24 \cf0    +0x000 CreateTime       : _LARGE_INTEGER\
1296 |    +0x008 Link             : _LIST_ENTRY \
1297 |    +0x018 HashLinks        : _LIST_ENTRY\
1298 |    +0x028 ClientId         : _CLIENT_ID\
1299 |    +0x038 Process          : \
1300 |    +0x040 ThreadHandle     : \
1301 |    +0x048 Flags            : \
1302 |    +0x04c ReferenceCount   : \
1303 |    +0x050 ImpersonateCount :}</string>
1304 | 			</dict>
1305 | 		</dict>
1306 | 		<dict>
1307 | 			<key>Bounds</key>
1308 | 			<string>{{1332, 4302}, {526, 407}}</string>
1309 | 			<key>Class</key>
1310 | 			<string>ShapedGraphic</string>
1311 | 			<key>ID</key>
1312 | 			<integer>38</integer>
1313 | 			<key>Shape</key>
1314 | 			<string>Rectangle</string>
1315 | 			<key>Text</key>
1316 | 			<dict>
1317 | 				<key>Text</key>
1318 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1319 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1320 | {\colortbl;\red255\green255\blue255;}
1321 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1322 | 
1323 | \f0\fs72 \cf0 W32THREAD\
1324 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1325 | 
1326 | \fs24 \cf0    +0x000 pEThread         : Ptr64 _ETHREAD\
1327 |    +0x008 RefCount         : Uint4B\
1328 |    +0x010 ptlW32           : Ptr64 _TL\
1329 |    +0x018 pgdiDcattr       : Ptr64 Void\
1330 |    +0x020 pgdiBrushAttr    : Ptr64 Void\
1331 |    +0x028 pUMPDObjs        : Ptr64 Void\
1332 |    +0x030 pUMPDHeap        : Ptr64 Void\
1333 |    +0x038 pUMPDObj         : Ptr64 Void\
1334 |    +0x040 pProxyPort       : Ptr64 Void\
1335 |    +0x048 pClientID        : Ptr64 Void\
1336 |    +0x050 GdiTmpTgoList    : _LIST_ENTRY\
1337 |    +0x060 pRBRecursionCount : Uint4B\
1338 |    +0x064 pNonRBRecursionCount : Uint4B\
1339 |    +0x068 tlSpriteState    : _TLSPRITESTATE\
1340 |    +0x110 pSpriteState     : Ptr64 Void\
1341 |    +0x118 pDevHTInfo       : Ptr64 Void\
1342 |    +0x120 ulDevHTInfoUniqueness : Uint4B\
1343 |    +0x128 pdcoAA           : Ptr64 Void\
1344 |    +0x130 pdcoRender       : Ptr64 Void\
1345 |    +0x138 pdcoSrc          : Ptr64 Void\
1346 |    +0x140 bEnableEngUpdateDeviceSurface : UChar\
1347 |    +0x141 bIncludeSprites  : UChar\
1348 |    +0x144 ulWindowSystemRendering : Uint4B\
1349 |    +0x148 iVisRgnUniqueness : Uint4B}</string>
1350 | 			</dict>
1351 | 		</dict>
1352 | 		<dict>
1353 | 			<key>Bounds</key>
1354 | 			<string>{{557, 4892}, {526, 384}}</string>
1355 | 			<key>Class</key>
1356 | 			<string>ShapedGraphic</string>
1357 | 			<key>ID</key>
1358 | 			<integer>37</integer>
1359 | 			<key>Shape</key>
1360 | 			<string>Rectangle</string>
1361 | 			<key>Text</key>
1362 | 			<dict>
1363 | 				<key>Text</key>
1364 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1365 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1366 | {\colortbl;\red255\green255\blue255;}
1367 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1368 | 
1369 | \f0\fs72 \cf0 CSR_PROCESS\
1370 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1371 | 
1372 | \fs24 \cf0    \
1373 |    +0x000 ClientId         : _CLIENT_ID\
1374 |    +0x010 ListLink         : _LIST_ENTRY \
1375 | 
1376 | \b    +0x020 ThreadList       : _LIST_ENTRY 
1377 | \b0 \
1378 |    +0x030 NtSession        :  _CSR_NT_SESSION\
1379 |    +0x038 ClientPort       : \
1380 |    +0x040 ClientViewBase   :\
1381 |    +0x048 ClientViewBounds : \
1382 |    +0x050 ProcessHandle    :  \
1383 |    +0x058 SequenceNumber   : \
1384 |    +0x05c Flags            : \
1385 |    +0x060 DebugFlags       : \
1386 |    +0x064 ReferenceCount   : \
1387 |    +0x068 ProcessGroupId   : \
1388 |    +0x06c ProcessGroupSequence : \
1389 |    +0x070 LastMessageSequence : \
1390 |    +0x074 NumOutstandingMessages : \
1391 |    +0x078 ShutdownLevel    : \
1392 |    +0x07c ShutdownFlags    : \
1393 |    +0x080 Luid             : _LUID\
1394 |    +0x088 ServerDllPerProcessData :  }</string>
1395 | 			</dict>
1396 | 		</dict>
1397 | 		<dict>
1398 | 			<key>Bounds</key>
1399 | 			<string>{{557, 4290}, {526, 361}}</string>
1400 | 			<key>Class</key>
1401 | 			<string>ShapedGraphic</string>
1402 | 			<key>ID</key>
1403 | 			<integer>36</integer>
1404 | 			<key>Shape</key>
1405 | 			<string>Rectangle</string>
1406 | 			<key>Text</key>
1407 | 			<dict>
1408 | 				<key>Text</key>
1409 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1410 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1411 | {\colortbl;\red255\green255\blue255;}
1412 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1413 | 
1414 | \f0\fs72 \cf0 W32PROCESS\
1415 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1416 | 
1417 | \fs24    +0x000 Process          : Ptr64 _EPROCESS\
1418 |    +0x008 RefCount         : Uint4B\
1419 |    +0x00c W32PF_Flags      : Uint4B\
1420 |    +0x010 InputIdleEvent   : Ptr64 _KEVENT\
1421 |    +0x018 StartCursorHideTime : Uint4B\
1422 |    +0x020 NextStart        : Ptr64 _W32PROCESS\
1423 |    +0x028 pDCAttrList      : Ptr64 Void\
1424 |    +0x030 pBrushAttrList   : Ptr64 Void\
1425 |    +0x038 W32Pid           : Uint4B\
1426 |    +0x03c GDIHandleCount   : Int4B\
1427 |    +0x040 GDIHandleCountPeak : Uint4B\
1428 |    +0x044 UserHandleCount  : Int4B\
1429 |    +0x048 UserHandleCountPeak : Uint4B\
1430 |    +0x050 GDIPushLock      : _EX_PUSH_LOCK\
1431 |    +0x058 GDIEngUserMemAllocTable : _RTL_AVL_TABLE\
1432 |    +0x0c0 GDIDcAttrFreeList : _LIST_ENTRY\
1433 |    +0x0d0 GDIBrushAttrFreeList : _LIST_ENTRY\
1434 |    +0x0e0 GDIW32PIDLockedBitmaps : _LIST_ENTRY\
1435 |    +0x0f0 hSecureGdiSharedHandleTable : Ptr64 Void\
1436 |    +0x0f8 DxProcess        : Ptr64 Void}</string>
1437 | 			</dict>
1438 | 		</dict>
1439 | 		<dict>
1440 | 			<key>Bounds</key>
1441 | 			<string>{{3022, 2392}, {526, 194}}</string>
1442 | 			<key>Class</key>
1443 | 			<string>ShapedGraphic</string>
1444 | 			<key>ID</key>
1445 | 			<integer>29</integer>
1446 | 			<key>Shape</key>
1447 | 			<string>Rectangle</string>
1448 | 			<key>Text</key>
1449 | 			<dict>
1450 | 				<key>Text</key>
1451 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1452 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1453 | {\colortbl;\red255\green255\blue255;}
1454 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1455 | 
1456 | \f0\fs72 \cf0 TIB
1457 | \fs24 \
1458 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1459 | \
1460 |    +0x000 ExceptionList    : Ptr32 _EXCEPTION_REGISTRATION_RECORD\
1461 |    +0x004 StackBase        : Ptr32 Void\
1462 |    +0x008 StackLimit       : Ptr32 Void\
1463 |    +0x00c SubSystemTib     : Ptr32 Void\
1464 |    +0x010 FiberData        : Ptr32 Void\
1465 |    +0x010 Version          : Uint4B\
1466 |    +0x014 ArbitraryUserPointer : Ptr32 Void\
1467 |    +0x018 Self             : Ptr32 _NT_TIB}</string>
1468 | 			</dict>
1469 | 		</dict>
1470 | 		<dict>
1471 | 			<key>Bounds</key>
1472 | 			<string>{{2098, 2392}, {526, 1498}}</string>
1473 | 			<key>Class</key>
1474 | 			<string>ShapedGraphic</string>
1475 | 			<key>ID</key>
1476 | 			<integer>28</integer>
1477 | 			<key>Shape</key>
1478 | 			<string>Rectangle</string>
1479 | 			<key>Text</key>
1480 | 			<dict>
1481 | 				<key>Text</key>
1482 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1483 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1484 | {\colortbl;\red255\green255\blue255;}
1485 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1486 | 
1487 | \f0\fs72 \cf0 TEB
1488 | \fs24 \
1489 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1490 | \
1491 | 
1492 | \b    +0x000 NtTib            : _NT_TIB
1493 | \b0 \
1494 |    +0x01c EnvironmentPointer : Ptr32 Void\
1495 |    +0x020 ClientId         : _CLIENT_ID\
1496 |    +0x028 ActiveRpcHandle  : Ptr32 Void\
1497 |    +0x02c ThreadLocalStoragePointer : Ptr32 Void\
1498 | 
1499 | \b    +0x030 ProcessEnvironmentBlock : Ptr32 _PEB
1500 | \b0 \
1501 |    +0x034 LastErrorValue   : Uint4B\
1502 |    +0x038 CountOfOwnedCriticalSections : Uint4B\
1503 |    +0x03c CsrClientThread  : Ptr32 Void\
1504 |    +0x040 Win32ThreadInfo  : Ptr32 Void\
1505 |    +0x044 User32Reserved   : [26] Uint4B\
1506 |    +0x0ac UserReserved     : [5] Uint4B\
1507 |    +0x0c0 WOW32Reserved    : Ptr32 Void\
1508 |    +0x0c4 CurrentLocale    : Uint4B\
1509 |    +0x0c8 FpSoftwareStatusRegister : Uint4B\
1510 |    +0x0cc SystemReserved1  : [54] Ptr32 Void\
1511 |    +0x1a4 ExceptionCode    : Int4B\
1512 |    +0x1a8 ActivationContextStackPointer : Ptr32 _ACTIVATION_CONTEXT_STACK\
1513 |    +0x1ac SpareBytes       : [36] UChar\
1514 |    +0x1d0 TxFsContext      : Uint4B\
1515 |    +0x1d4 GdiTebBatch      : _GDI_TEB_BATCH\
1516 |    +0x6b4 RealClientId     : _CLIENT_ID\
1517 |    +0x6bc GdiCachedProcessHandle : Ptr32 Void\
1518 |    +0x6c0 GdiClientPID     : Uint4B\
1519 |    +0x6c4 GdiClientTID     : Uint4B\
1520 |    +0x6c8 GdiThreadLocalInfo : Ptr32 Void\
1521 |    +0x6cc Win32ClientInfo  : [62] Uint4B\
1522 |    +0x7c4 glDispatchTable  : [233] Ptr32 Void\
1523 |    +0xb68 glReserved1      : [29] Uint4B\
1524 |    +0xbdc glReserved2      : Ptr32 Void\
1525 |    +0xbe0 glSectionInfo    : Ptr32 Void\
1526 |    +0xbe4 glSection        : Ptr32 Void\
1527 |    +0xbe8 glTable          : Ptr32 Void\
1528 |    +0xbec glCurrentRC      : Ptr32 Void\
1529 |    +0xbf0 glContext        : Ptr32 Void\
1530 |    +0xbf4 LastStatusValue  : Uint4B\
1531 |    +0xbf8 StaticUnicodeString : _UNICODE_STRING\
1532 |    +0xc00 StaticUnicodeBuffer : [261] Wchar\
1533 |    +0xe0c DeallocationStack : Ptr32 Void\
1534 |    +0xe10 TlsSlots         : [64] Ptr32 Void\
1535 |    +0xf10 TlsLinks         : _LIST_ENTRY\
1536 |    +0xf18 Vdm              : Ptr32 Void\
1537 |    +0xf1c ReservedForNtRpc : Ptr32 Void\
1538 |    +0xf20 DbgSsReserved    : [2] Ptr32 Void\
1539 |    +0xf28 HardErrorMode    : Uint4B\
1540 |    +0xf2c Instrumentation  : [9] Ptr32 Void\
1541 |    +0xf50 ActivityId       : _GUID\
1542 |    +0xf60 SubProcessTag    : Ptr32 Void\
1543 |    +0xf64 EtwLocalData     : Ptr32 Void\
1544 |    +0xf68 EtwTraceData     : Ptr32 Void\
1545 |    +0xf6c WinSockData      : Ptr32 Void\
1546 |    +0xf70 GdiBatchCount    : Uint4B\
1547 |    +0xf74 CurrentIdealProcessor : _PROCESSOR_NUMBER\
1548 |    +0xf74 IdealProcessorValue : Uint4B\
1549 |    +0xf74 ReservedPad0     : UChar\
1550 |    +0xf75 ReservedPad1     : UChar\
1551 |    +0xf76 ReservedPad2     : UChar\
1552 |    +0xf77 IdealProcessor   : UChar\
1553 |    +0xf78 GuaranteedStackBytes : Uint4B\
1554 |    +0xf7c ReservedForPerf  : Ptr32 Void\
1555 |    +0xf80 ReservedForOle   : Ptr32 Void\
1556 |    +0xf84 WaitingOnLoaderLock : Uint4B\
1557 |    +0xf88 SavedPriorityState : Ptr32 Void\
1558 |    +0xf8c SoftPatchPtr1    : Uint4B\
1559 |    +0xf90 ThreadPoolData   : Ptr32 Void\
1560 |    +0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void\
1561 |    +0xf98 MuiGeneration    : Uint4B\
1562 |    +0xf9c IsImpersonating  : Uint4B\
1563 |    +0xfa0 NlsCache         : Ptr32 Void\
1564 |    +0xfa4 pShimData        : Ptr32 Void\
1565 |    +0xfa8 HeapVirtualAffinity : Uint4B\
1566 |    +0xfac CurrentTransactionHandle : Ptr32 Void\
1567 |    +0xfb0 ActiveFrame      : Ptr32 _TEB_ACTIVE_FRAME\
1568 |    +0xfb4 FlsData          : Ptr32 Void\
1569 |    +0xfb8 PreferredLanguages : Ptr32 Void\
1570 |    +0xfbc UserPrefLanguages : Ptr32 Void\
1571 |    +0xfc0 MergedPrefLanguages : Ptr32 Void\
1572 |    +0xfc4 MuiImpersonation : Uint4B\
1573 |    +0xfc8 CrossTebFlags    : Uint2B\
1574 |    +0xfc8 SpareCrossTebBits : Pos 0, 16 Bits\
1575 |    +0xfca SameTebFlags     : Uint2B\
1576 |    +0xfca SafeThunkCall    : Pos 0, 1 Bit\
1577 |    +0xfca InDebugPrint     : Pos 1, 1 Bit\
1578 |    +0xfca HasFiberData     : Pos 2, 1 Bit\
1579 |    +0xfca SkipThreadAttach : Pos 3, 1 Bit\
1580 |    +0xfca WerInShipAssertCode : Pos 4, 1 Bit\
1581 |    +0xfca RanProcessInit   : Pos 5, 1 Bit\
1582 |    +0xfca ClonedThread     : Pos 6, 1 Bit\
1583 |    +0xfca SuppressDebugMsg : Pos 7, 1 Bit\
1584 |    +0xfca DisableUserStackWalk : Pos 8, 1 Bit\
1585 |    +0xfca RtlExceptionAttached : Pos 9, 1 Bit\
1586 |    +0xfca InitialThread    : Pos 10, 1 Bit\
1587 |    +0xfca SpareSameTebBits : Pos 11, 5 Bits\
1588 |    +0xfcc TxnScopeEnterCallback : Ptr32 Void\
1589 |    +0xfd0 TxnScopeExitCallback : Ptr32 Void\
1590 |    +0xfd4 TxnScopeContext  : Ptr32 Void\
1591 |    +0xfd8 LockCount        : Uint4B\
1592 |    +0xfdc SpareUlong0      : Uint4B\
1593 |    +0xfe0 ResourceRetValue : Ptr32 Void}</string>
1594 | 			</dict>
1595 | 		</dict>
1596 | 		<dict>
1597 | 			<key>Bounds</key>
1598 | 			<string>{{3022, 528}, {526, 1713}}</string>
1599 | 			<key>Class</key>
1600 | 			<string>ShapedGraphic</string>
1601 | 			<key>ID</key>
1602 | 			<integer>27</integer>
1603 | 			<key>Shape</key>
1604 | 			<string>Rectangle</string>
1605 | 			<key>Text</key>
1606 | 			<dict>
1607 | 				<key>Text</key>
1608 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1609 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1610 | {\colortbl;\red255\green255\blue255;}
1611 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1612 | 
1613 | \f0\fs72 \cf0 Tcb : KTHREAD
1614 | \fs24 \
1615 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1616 | \
1617 |    +0x000 Header           : _DISPATCHER_HEADER\
1618 |    +0x010 CycleTime        : Uint8B\
1619 |    +0x018 HighCycleTime    : Uint4B\
1620 |    +0x020 QuantumTarget    : Uint8B\
1621 |    +0x028 InitialStack     : Ptr32 Void\
1622 |    +0x02c StackLimit       : Ptr32 Void\
1623 |    +0x030 KernelStack      : Ptr32 Void\
1624 |    +0x034 ThreadLock       : Uint4B\
1625 |    +0x038 WaitRegister     : _KWAIT_STATUS_REGISTER\
1626 |    +0x039 Running          : UChar\
1627 |    +0x03a Alerted          : [2] UChar\
1628 |    +0x03c KernelStackResident : Pos 0, 1 Bit\
1629 |    +0x03c ReadyTransition  : Pos 1, 1 Bit\
1630 |    +0x03c ProcessReadyQueue : Pos 2, 1 Bit\
1631 |    +0x03c WaitNext         : Pos 3, 1 Bit\
1632 |    +0x03c SystemAffinityActive : Pos 4, 1 Bit\
1633 |    +0x03c Alertable        : Pos 5, 1 Bit\
1634 |    +0x03c GdiFlushActive   : Pos 6, 1 Bit\
1635 |    +0x03c UserStackWalkActive : Pos 7, 1 Bit\
1636 |    +0x03c ApcInterruptRequest : Pos 8, 1 Bit\
1637 |    +0x03c ForceDeferSchedule : Pos 9, 1 Bit\
1638 |    +0x03c QuantumEndMigrate : Pos 10, 1 Bit\
1639 |    +0x03c UmsDirectedSwitchEnable : Pos 11, 1 Bit\
1640 |    +0x03c TimerActive      : Pos 12, 1 Bit\
1641 |    +0x03c SystemThread     : Pos 13, 1 Bit\
1642 |    +0x03c Reserved         : Pos 14, 18 Bits\
1643 |    +0x03c MiscFlags        : Int4B\
1644 |    +0x040 ApcState         : _KAPC_STATE\
1645 |    +0x040 ApcStateFill     : [23] UChar\
1646 |    +0x057 Priority         : Char\
1647 |    +0x058 NextProcessor    : Uint4B\
1648 |    +0x05c DeferredProcessor : Uint4B\
1649 |    +0x060 ApcQueueLock     : Uint4B\
1650 |    +0x064 ContextSwitches  : Uint4B\
1651 |    +0x068 State            : UChar\
1652 |    +0x069 NpxState         : Char\
1653 |    +0x06a WaitIrql         : UChar\
1654 |    +0x06b WaitMode         : Char\
1655 |    +0x06c WaitStatus       : Int4B\
1656 |    +0x070 WaitBlockList    : Ptr32 _KWAIT_BLOCK\
1657 |    +0x074 WaitListEntry    : _LIST_ENTRY\
1658 |    +0x074 SwapListEntry    : _SINGLE_LIST_ENTRY\
1659 |    +0x07c Queue            : Ptr32 _KQUEUE\
1660 |    +0x080 WaitTime         : Uint4B\
1661 |    +0x084 KernelApcDisable : Int2B\
1662 |    +0x086 SpecialApcDisable : Int2B\
1663 |    +0x084 CombinedApcDisable : Uint4B\
1664 |    +0x088 Teb              : Ptr32 Void\
1665 |    +0x090 Timer            : _KTIMER\
1666 |    +0x0b8 AutoAlignment    : Pos 0, 1 Bit\
1667 |    +0x0b8 DisableBoost     : Pos 1, 1 Bit\
1668 |    +0x0b8 EtwStackTraceApc1Inserted : Pos 2, 1 Bit\
1669 |    +0x0b8 EtwStackTraceApc2Inserted : Pos 3, 1 Bit\
1670 |    +0x0b8 CalloutActive    : Pos 4, 1 Bit\
1671 |    +0x0b8 ApcQueueable     : Pos 5, 1 Bit\
1672 |    +0x0b8 EnableStackSwap  : Pos 6, 1 Bit\
1673 |    +0x0b8 GuiThread        : Pos 7, 1 Bit\
1674 |    +0x0b8 UmsPerformingSyscall : Pos 8, 1 Bit\
1675 |    +0x0b8 VdmSafe          : Pos 9, 1 Bit\
1676 |    +0x0b8 UmsDispatched    : Pos 10, 1 Bit\
1677 |    +0x0b8 ReservedFlags    : Pos 11, 21 Bits\
1678 |    +0x0b8 ThreadFlags      : Int4B\
1679 |    +0x0bc ServiceTable     : Ptr32 Void\
1680 |    +0x0c0 WaitBlock        : [4] _KWAIT_BLOCK\
1681 |    +0x120 QueueListEntry   : _LIST_ENTRY\
1682 |    +0x128 TrapFrame        : Ptr32 _KTRAP_FRAME\
1683 |    +0x12c FirstArgument    : Ptr32 Void\
1684 |    +0x130 CallbackStack    : Ptr32 Void\
1685 |    +0x130 CallbackDepth    : Uint4B\
1686 |    +0x134 ApcStateIndex    : UChar\
1687 |    +0x135 BasePriority     : Char\
1688 |    +0x136 PriorityDecrement : Char\
1689 |    +0x136 ForegroundBoost  : Pos 0, 4 Bits\
1690 |    +0x136 UnusualBoost     : Pos 4, 4 Bits\
1691 |    +0x137 Preempted        : UChar\
1692 |    +0x138 AdjustReason     : UChar\
1693 |    +0x139 AdjustIncrement  : Char\
1694 |    +0x13a PreviousMode     : Char\
1695 |    +0x13b Saturation       : Char\
1696 |    +0x13c SystemCallNumber : Uint4B\
1697 |    +0x140 FreezeCount      : Uint4B\
1698 |    +0x144 UserAffinity     : _GROUP_AFFINITY\
1699 |    +0x150 Process          : Ptr32 _KPROCESS\
1700 |    +0x154 Affinity         : _GROUP_AFFINITY\
1701 |    +0x160 IdealProcessor   : Uint4B\
1702 |    +0x164 UserIdealProcessor : Uint4B\
1703 |    +0x168 ApcStatePointer  : [2] Ptr32 _KAPC_STATE\
1704 |    +0x170 SavedApcState    : _KAPC_STATE\
1705 |    +0x170 SavedApcStateFill : [23] UChar\
1706 |    +0x187 WaitReason       : UChar\
1707 |    +0x188 SuspendCount     : Char\
1708 |    +0x189 Spare1           : Char\
1709 |    +0x18a OtherPlatformFill : UChar\
1710 | 
1711 | \b    +0x18c Win32Thread      : Ptr32 Void
1712 | \b0 \
1713 |    +0x190 StackBase        : Ptr32 Void\
1714 |    +0x194 SuspendApc       : _KAPC\
1715 |    +0x194 SuspendApcFill0  : [1] UChar\
1716 |    +0x195 ResourceIndex    : UChar\
1717 |    +0x194 SuspendApcFill1  : [3] UChar\
1718 |    +0x197 QuantumReset     : UChar\
1719 |    +0x194 SuspendApcFill2  : [4] UChar\
1720 |    +0x198 KernelTime       : Uint4B\
1721 |    +0x194 SuspendApcFill3  : [36] UChar\
1722 |    +0x1b8 WaitPrcb         : Ptr32 _KPRCB\
1723 |    +0x194 SuspendApcFill4  : [40] UChar\
1724 |    +0x1bc LegoData         : Ptr32 Void\
1725 |    +0x194 SuspendApcFill5  : [47] UChar\
1726 |    +0x1c3 LargeStack       : UChar\
1727 |    +0x1c4 UserTime         : Uint4B\
1728 |    +0x1c8 SuspendSemaphore : _KSEMAPHORE\
1729 |    +0x1c8 SuspendSemaphorefill : [20] UChar\
1730 |    +0x1dc SListFaultCount  : Uint4B\
1731 |    +0x1e0 ThreadListEntry  : _LIST_ENTRY\
1732 |    +0x1e8 MutantListHead   : _LIST_ENTRY\
1733 |    +0x1f0 SListFaultAddress : Ptr32 Void\
1734 |    +0x1f4 ThreadCounters   : Ptr32 _KTHREAD_COUNTERS\
1735 |    +0x1f8 XStateSave       : Ptr32 _XSTATE_SAVE}</string>
1736 | 			</dict>
1737 | 		</dict>
1738 | 		<dict>
1739 | 			<key>Bounds</key>
1740 | 			<string>{{2094, 727}, {526, 1342}}</string>
1741 | 			<key>Class</key>
1742 | 			<string>ShapedGraphic</string>
1743 | 			<key>ID</key>
1744 | 			<integer>26</integer>
1745 | 			<key>Shape</key>
1746 | 			<string>Rectangle</string>
1747 | 			<key>Text</key>
1748 | 			<dict>
1749 | 				<key>Text</key>
1750 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1751 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1752 | {\colortbl;\red255\green255\blue255;}
1753 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1754 | 
1755 | \f0\fs24 \cf0  
1756 | \fs72 ETHREAD
1757 | \fs24   \
1758 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1759 | \
1760 | 
1761 | \b    +0x000 Tcb              : _KTHREAD
1762 | \b0 \
1763 |    +0x200 CreateTime       : _LARGE_INTEGER\
1764 |    +0x208 ExitTime         : _LARGE_INTEGER\
1765 |    +0x208 KeyedWaitChain   : _LIST_ENTRY\
1766 |    +0x210 ExitStatus       : Int4B\
1767 |    +0x214 PostBlockList    : _LIST_ENTRY\
1768 |    +0x214 ForwardLinkShadow : Ptr32 Void\
1769 |    +0x218 StartAddress     : Ptr32 Void\
1770 |    +0x21c TerminationPort  : Ptr32 _TERMINATION_PORT\
1771 |    +0x21c ReaperLink       : Ptr32 _ETHREAD\
1772 |    +0x21c KeyedWaitValue   : Ptr32 Void\
1773 |    +0x220 ActiveTimerListLock : Uint4B\
1774 |    +0x224 ActiveTimerListHead : _LIST_ENTRY\
1775 |    +0x22c Cid              : _CLIENT_ID\
1776 |    +0x234 KeyedWaitSemaphore : _KSEMAPHORE\
1777 |    +0x234 AlpcWaitSemaphore : _KSEMAPHORE\
1778 |    +0x248 ClientSecurity   : _PS_CLIENT_SECURITY_CONTEXT\
1779 |    +0x24c IrpList          : _LIST_ENTRY\
1780 |    +0x254 TopLevelIrp      : Uint4B\
1781 |    +0x258 DeviceToVerify   : Ptr32 _DEVICE_OBJECT\
1782 |    +0x25c CpuQuotaApc      : Ptr32 _PSP_CPU_QUOTA_APC\
1783 |    +0x260 Win32StartAddress : Ptr32 Void\
1784 |    +0x264 LegacyPowerObject : Ptr32 Void\
1785 |    +0x268 ThreadListEntry  : _LIST_ENTRY\
1786 |    +0x270 RundownProtect   : _EX_RUNDOWN_REF\
1787 |    +0x274 ThreadLock       : _EX_PUSH_LOCK\
1788 |    +0x278 ReadClusterSize  : Uint4B\
1789 |    +0x27c MmLockOrdering   : Int4B\
1790 |    +0x280 CrossThreadFlags : Uint4B\
1791 |    +0x280 Terminated       : Pos 0, 1 Bit\
1792 |    +0x280 ThreadInserted   : Pos 1, 1 Bit\
1793 |    +0x280 HideFromDebugger : Pos 2, 1 Bit\
1794 |    +0x280 ActiveImpersonationInfo : Pos 3, 1 Bit\
1795 |    +0x280 Reserved         : Pos 4, 1 Bit\
1796 |    +0x280 HardErrorsAreDisabled : Pos 5, 1 Bit\
1797 |    +0x280 BreakOnTermination : Pos 6, 1 Bit\
1798 |    +0x280 SkipCreationMsg  : Pos 7, 1 Bit\
1799 |    +0x280 SkipTerminationMsg : Pos 8, 1 Bit\
1800 |    +0x280 CopyTokenOnOpen  : Pos 9, 1 Bit\
1801 |    +0x280 ThreadIoPriority : Pos 10, 3 Bits\
1802 |    +0x280 ThreadPagePriority : Pos 13, 3 Bits\
1803 |    +0x280 RundownFail      : Pos 16, 1 Bit\
1804 |    +0x280 NeedsWorkingSetAging : Pos 17, 1 Bit\
1805 |    +0x284 SameThreadPassiveFlags : Uint4B\
1806 |    +0x284 ActiveExWorker   : Pos 0, 1 Bit\
1807 |    +0x284 ExWorkerCanWaitUser : Pos 1, 1 Bit\
1808 |    +0x284 MemoryMaker      : Pos 2, 1 Bit\
1809 |    +0x284 ClonedThread     : Pos 3, 1 Bit\
1810 |    +0x284 KeyedEventInUse  : Pos 4, 1 Bit\
1811 |    +0x284 RateApcState     : Pos 5, 2 Bits\
1812 |    +0x284 SelfTerminate    : Pos 7, 1 Bit\
1813 |    +0x288 SameThreadApcFlags : Uint4B\
1814 |    +0x288 Spare            : Pos 0, 1 Bit\
1815 |    +0x288 StartAddressInvalid : Pos 1, 1 Bit\
1816 |    +0x288 EtwPageFaultCalloutActive : Pos 2, 1 Bit\
1817 |    +0x288 OwnsProcessWorkingSetExclusive : Pos 3, 1 Bit\
1818 |    +0x288 OwnsProcessWorkingSetShared : Pos 4, 1 Bit\
1819 |    +0x288 OwnsSystemCacheWorkingSetExclusive : Pos 5, 1 Bit\
1820 |    +0x288 OwnsSystemCacheWorkingSetShared : Pos 6, 1 Bit\
1821 |    +0x288 OwnsSessionWorkingSetExclusive : Pos 7, 1 Bit\
1822 |    +0x289 OwnsSessionWorkingSetShared : Pos 0, 1 Bit\
1823 |    +0x289 OwnsProcessAddressSpaceExclusive : Pos 1, 1 Bit\
1824 |    +0x289 OwnsProcessAddressSpaceShared : Pos 2, 1 Bit\
1825 |    +0x289 SuppressSymbolLoad : Pos 3, 1 Bit\
1826 |    +0x289 Prefetching      : Pos 4, 1 Bit\
1827 |    +0x289 OwnsDynamicMemoryShared : Pos 5, 1 Bit\
1828 |    +0x289 OwnsChangeControlAreaExclusive : Pos 6, 1 Bit\
1829 |    +0x289 OwnsChangeControlAreaShared : Pos 7, 1 Bit\
1830 |    +0x28a OwnsPagedPoolWorkingSetExclusive : Pos 0, 1 Bit\
1831 |    +0x28a OwnsPagedPoolWorkingSetShared : Pos 1, 1 Bit\
1832 |    +0x28a OwnsSystemPtesWorkingSetExclusive : Pos 2, 1 Bit\
1833 |    +0x28a OwnsSystemPtesWorkingSetShared : Pos 3, 1 Bit\
1834 |    +0x28a TrimTrigger      : Pos 4, 2 Bits\
1835 |    +0x28a Spare1           : Pos 6, 2 Bits\
1836 |    +0x28b PriorityRegionActive : UChar\
1837 |    +0x28c CacheManagerActive : UChar\
1838 |    +0x28d DisablePageFaultClustering : UChar\
1839 |    +0x28e ActiveFaultCount : UChar\
1840 |    +0x28f LockOrderState   : UChar\
1841 |    +0x290 AlpcMessageId    : Uint4B\
1842 |    +0x294 AlpcMessage      : Ptr32 Void\
1843 |    +0x294 AlpcReceiveAttributeSet : Uint4B\
1844 |    +0x298 AlpcWaitListEntry : _LIST_ENTRY\
1845 |    +0x2a0 CacheManagerCount : Uint4B\
1846 |    +0x2a4 IoBoostCount     : Uint4B\
1847 |    +0x2a8 IrpListLock      : Uint4B\
1848 |    +0x2ac ReservedForSynchTracking : Ptr32 Void\
1849 |    +0x2b0 CmCallbackListHead : _SINGLE_LIST_ENTRY}</string>
1850 | 			</dict>
1851 | 		</dict>
1852 | 		<dict>
1853 | 			<key>Bounds</key>
1854 | 			<string>{{1046, 2381}, {526, 1372}}</string>
1855 | 			<key>Class</key>
1856 | 			<string>ShapedGraphic</string>
1857 | 			<key>ID</key>
1858 | 			<integer>25</integer>
1859 | 			<key>Shape</key>
1860 | 			<string>Rectangle</string>
1861 | 			<key>Text</key>
1862 | 			<dict>
1863 | 				<key>Text</key>
1864 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1865 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1866 | {\colortbl;\red255\green255\blue255;\red0\green0\blue0;}
1867 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1868 | 
1869 | \f0\fs24 \cf0    
1870 | \fs72 PEB
1871 | \fs24 \
1872 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1873 | \
1874 |    +0x000 InheritedAddressSpace : UChar\
1875 |    +0x001 ReadImageFileExecOptions : UChar\
1876 |    +0x002 BeingDebugged    : UChar\
1877 |    +0x003 BitField         : UChar\
1878 |    +0x003 ImageUsesLargePages : Pos 0, 1 Bit\
1879 |    +0x003 IsProtectedProcess : Pos 1, 1 Bit\
1880 |    +0x003 IsLegacyProcess  : Pos 2, 1 Bit\
1881 |    +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit\
1882 |    +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit\
1883 |    +0x003 SpareBits        : Pos 5, 3 Bits\
1884 |    +0x004 Mutant           : Ptr32 Void\
1885 |    +0x008 ImageBaseAddress : Ptr32 Void\
1886 |   \cf2  
1887 | \b +0x00c Ldr              : Ptr32 _PEB_LDR_DATA\cf0 \
1888 | 
1889 | \b0    +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS\
1890 |    +0x014 SubSystemData    : Ptr32 Void\
1891 |    +0x018 ProcessHeap      : Ptr32 Void\
1892 |    +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION\
1893 |    +0x020 AtlThunkSListPtr : Ptr32 Void\
1894 |    +0x024 IFEOKey          : Ptr32 Void\
1895 |    +0x028 CrossProcessFlags : Uint4B\
1896 |    +0x028 ProcessInJob     : Pos 0, 1 Bit\
1897 |    +0x028 ProcessInitializing : Pos 1, 1 Bit\
1898 |    +0x028 ProcessUsingVEH  : Pos 2, 1 Bit\
1899 |    +0x028 ProcessUsingVCH  : Pos 3, 1 Bit\
1900 |    +0x028 ProcessUsingFTH  : Pos 4, 1 Bit\
1901 |    +0x028 ReservedBits0    : Pos 5, 27 Bits\
1902 |    +0x02c KernelCallbackTable : Ptr32 Void\
1903 |    +0x02c UserSharedInfoPtr : Ptr32 Void\
1904 |    +0x030 SystemReserved   : [1] Uint4B\
1905 |    +0x034 AtlThunkSListPtr32 : Uint4B\
1906 |    +0x038 ApiSetMap        : Ptr32 Void\
1907 |    +0x03c TlsExpansionCounter : Uint4B\
1908 |    +0x040 TlsBitmap        : Ptr32 Void\
1909 |    +0x044 TlsBitmapBits    : [2] Uint4B\
1910 |    +0x04c ReadOnlySharedMemoryBase : Ptr32 Void\
1911 |    +0x050 HotpatchInformation : Ptr32 Void\
1912 |    +0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void\
1913 |    +0x058 AnsiCodePageData : Ptr32 Void\
1914 |    +0x05c OemCodePageData  : Ptr32 Void\
1915 |    +0x060 UnicodeCaseTableData : Ptr32 Void\
1916 |    +0x064 NumberOfProcessors : Uint4B\
1917 |    +0x068 NtGlobalFlag     : Uint4B\
1918 |    +0x070 CriticalSectionTimeout : _LARGE_INTEGER\
1919 |    +0x078 HeapSegmentReserve : Uint4B\
1920 |    +0x07c HeapSegmentCommit : Uint4B\
1921 |    +0x080 HeapDeCommitTotalFreeThreshold : Uint4B\
1922 |    +0x084 HeapDeCommitFreeBlockThreshold : Uint4B\
1923 |    +0x088 NumberOfHeaps    : Uint4B\
1924 |    +0x08c MaximumNumberOfHeaps : Uint4B\
1925 |    +0x090 ProcessHeaps     : Ptr32 Ptr32 Void\
1926 |    +0x094 GdiSharedHandleTable : Ptr32 Void\
1927 |    +0x098 ProcessStarterHelper : Ptr32 Void\
1928 |    +0x09c GdiDCAttributeList : Uint4B\
1929 |    +0x0a0 LoaderLock       : Ptr32 _RTL_CRITICAL_SECTION\
1930 |    +0x0a4 OSMajorVersion   : Uint4B\
1931 |    +0x0a8 OSMinorVersion   : Uint4B\
1932 |    +0x0ac OSBuildNumber    : Uint2B\
1933 |    +0x0ae OSCSDVersion     : Uint2B\
1934 |    +0x0b0 OSPlatformId     : Uint4B\
1935 |    +0x0b4 ImageSubsystem   : Uint4B\
1936 |    +0x0b8 ImageSubsystemMajorVersion : Uint4B\
1937 |    +0x0bc ImageSubsystemMinorVersion : Uint4B\
1938 |    +0x0c0 ActiveProcessAffinityMask : Uint4B\
1939 |    +0x0c4 GdiHandleBuffer  : [34] Uint4B\
1940 |    +0x14c PostProcessInitRoutine : Ptr32     void \
1941 |    +0x150 TlsExpansionBitmap : Ptr32 Void\
1942 |    +0x154 TlsExpansionBitmapBits : [32] Uint4B\
1943 |    +0x1d4 SessionId        : Uint4B\
1944 |    +0x1d8 AppCompatFlags   : _ULARGE_INTEGER\
1945 |    +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER\
1946 |    +0x1e8 pShimData        : Ptr32 Void\
1947 |    +0x1ec AppCompatInfo    : Ptr32 Void\
1948 |    +0x1f0 CSDVersion       : _UNICODE_STRING\
1949 |    +0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA\
1950 |    +0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP\
1951 |    +0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA\
1952 |    +0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP\
1953 |    +0x208 MinimumStackCommit : Uint4B\
1954 |    +0x20c FlsCallback      : Ptr32 _FLS_CALLBACK_INFO\
1955 |    +0x210 FlsListHead      : _LIST_ENTRY\
1956 |    +0x218 FlsBitmap        : Ptr32 Void\
1957 |    +0x21c FlsBitmapBits    : [4] Uint4B\
1958 |    +0x22c FlsHighIndex     : Uint4B\
1959 |    +0x230 WerRegistrationData : Ptr32 Void\
1960 |    +0x234 WerShipAssertPtr : Ptr32 Void\
1961 |    +0x238 pContextData     : Ptr32 Void\
1962 |    +0x23c pImageHeaderHash : Ptr32 Void\
1963 |    +0x240 TracingFlags     : Uint4B\
1964 |    +0x240 HeapTracingEnabled : Pos 0, 1 Bit\
1965 |    +0x240 CritSecTracingEnabled : Pos 1, 1 Bit\
1966 |    +0x240 SpareTracingBits : Pos 2, 30 Bits}</string>
1967 | 			</dict>
1968 | 		</dict>
1969 | 		<dict>
1970 | 			<key>Bounds</key>
1971 | 			<string>{{1046, 1522}, {526, 547}}</string>
1972 | 			<key>Class</key>
1973 | 			<string>ShapedGraphic</string>
1974 | 			<key>ID</key>
1975 | 			<integer>22</integer>
1976 | 			<key>Shape</key>
1977 | 			<string>Rectangle</string>
1978 | 			<key>Text</key>
1979 | 			<dict>
1980 | 				<key>Align</key>
1981 | 				<integer>0</integer>
1982 | 				<key>Text</key>
1983 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
1984 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
1985 | {\colortbl;\red255\green255\blue255;}
1986 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1987 | 
1988 | \f0\fs24 \cf0 
\
1989 |    \
1990 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
1991 | 
1992 | \fs72 Pcb : KPROCESS
1993 | \fs24 \
1994 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
1995 |    \
1996 |    +0x000 Header           : _DISPATCHER_HEADER
\
1997 |    +0x010 ProfileListHead  : _LIST_ENTRY
\
1998 |    +0x018 DirectoryTableBase : Uint4B
\
1999 |    +0x01c LdtDescriptor    : _KGDTENTRY
\
2000 |    +0x024 Int21Descriptor  : _KIDTENTRY
\
2001 |    +0x02c ThreadListHead   : _LIST_ENTRY
\
2002 |    +0x034 ProcessLock      : Uint4B
\
2003 |    +0x038 Affinity         : _KAFFINITY_EX
\
2004 |    +0x050 ReadyListHead    : _LIST_ENTRY
\
2005 |    +0x058 SwapListEntry    : _SINGLE_LIST_ENTRY
\
2006 |    +0x05c ActiveProcessors : _KAFFINITY_EX
\
2007 |    +0x074 AutoAlignment    : Pos 0, 1 Bit
\
2008 |    +0x074 DisableBoost     : Pos 1, 1 Bit
\
2009 |    +0x074 DisableQuantum   : Pos 2, 1 Bit
\
2010 |    +0x074 ActiveGroupsMask : Pos 3, 4 Bits
\
2011 |    +0x074 ReservedFlags    : Pos 7, 25 Bits
\
2012 |    +0x074 ProcessFlags     : Int4B
\
2013 |    +0x078 BasePriority     : Char
\
2014 |    +0x079 QuantumReset     : Char
\
2015 |    +0x07a Visited          : UChar
\
2016 |    +0x07b Unused3          : UChar
\
2017 |    +0x07c ThreadSeed       : [4] Uint4B
\
2018 |    +0x08c IdealNode        : [4] Uint2B
\
2019 |    +0x094 IdealGlobalNode  : Uint2B
\
2020 |    +0x096 Flags            : _KEXECUTE_OPTIONS
\
2021 |    +0x097 Unused1          : UChar
\
2022 |    +0x098 IopmOffset       : Uint2B
\
2023 |    +0x09c Unused4          : Uint4B
\
2024 |    +0x0a0 StackCount       : _KSTACK_COUNT
\
2025 |    +0x0a4 ProcessListEntry : _LIST_ENTRY
\
2026 |    +0x0b0 CycleTime        : Uint8B
\
2027 |    +0x0b8 KernelTime       : Uint4B
\
2028 |    +0x0bc UserTime         : Uint4B
\
2029 |    +0x0c0 VdmTrapcHandler  : Ptr32 Void
\
2030 | }</string>
2031 | 			</dict>
2032 | 		</dict>
2033 | 		<dict>
2034 | 			<key>Bounds</key>
2035 | 			<string>{{60, 1537}, {526, 1945}}</string>
2036 | 			<key>Class</key>
2037 | 			<string>ShapedGraphic</string>
2038 | 			<key>ID</key>
2039 | 			<integer>1</integer>
2040 | 			<key>Shape</key>
2041 | 			<string>Rectangle</string>
2042 | 			<key>Style</key>
2043 | 			<dict>
2044 | 				<key>fill</key>
2045 | 				<dict>
2046 | 					<key>Color</key>
2047 | 					<dict>
2048 | 						<key>b</key>
2049 | 						<string>0.999878</string>
2050 | 						<key>g</key>
2051 | 						<string>1</string>
2052 | 						<key>r</key>
2053 | 						<string>0.99991</string>
2054 | 					</dict>
2055 | 				</dict>
2056 | 			</dict>
2057 | 			<key>Text</key>
2058 | 			<dict>
2059 | 				<key>Text</key>
2060 | 				<string>{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390
2061 | \cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
2062 | {\colortbl;\red255\green255\blue255;}
2063 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc
2064 | 
2065 | \f0\fs24 \cf0    \
2066 | 
2067 | \fs72 EPROCESS\
2068 | 
2069 | \fs24 \
2070 | \pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural
2071 | 
2072 | \b    +0x000 Pcb              : _KPROCESS
2073 | \b0 \
2074 |    +0x0c8 ProcessLock      : _EX_PUSH_LOCK\
2075 |    +0x0d0 CreateTime       : _LARGE_INTEGER\
2076 |    +0x0d8 ExitTime         : _LARGE_INTEGER\
2077 |    +0x0e0 RundownProtect   : _EX_RUNDOWN_REF\
2078 |    +0x0e4 UniqueProcessId  : Ptr32 Void\
2079 |    +0x0e8 ActiveProcessLinks : _LIST_ENTRY\
2080 |    +0x0f0 ProcessQuotaUsage : [2] Uint4B\
2081 |    +0x0f8 ProcessQuotaPeak : [2] Uint4B\
2082 |    +0x100 CommitCharge     : Uint4B\
2083 |    +0x104 QuotaBlock       : Ptr32 _EPROCESS_QUOTA_BLOCK\
2084 |    +0x108 CpuQuotaBlock    : Ptr32 _PS_CPU_QUOTA_BLOCK\
2085 |    +0x10c PeakVirtualSize  : Uint4B\
2086 |    +0x110 VirtualSize      : Uint4B\
2087 |    +0x114 SessionProcessLinks : _LIST_ENTRY\
2088 |    +0x11c DebugPort        : Ptr32 Void\
2089 |    +0x120 ExceptionPortData : Ptr32 Void\
2090 |    +0x120 ExceptionPortValue : Uint4B\
2091 |    +0x120 ExceptionPortState : Pos 0, 3 Bits\
2092 |    +0x124 ObjectTable      : Ptr32 _HANDLE_TABLE\
2093 |    +0x128 Token            : _EX_FAST_REF\
2094 |    +0x12c WorkingSetPage   : Uint4B\
2095 |    +0x130 AddressCreationLock : _EX_PUSH_LOCK\
2096 |    +0x134 RotateInProgress : Ptr32 _ETHREAD\
2097 |    +0x138 ForkInProgress   : Ptr32 _ETHREAD\
2098 |    +0x13c HardwareTrigger  : Uint4B\
2099 |    +0x140 PhysicalVadRoot  : Ptr32 _MM_AVL_TABLE\
2100 |    +0x144 CloneRoot        : Ptr32 Void\
2101 |    +0x148 NumberOfPrivatePages : Uint4B\
2102 |    +0x14c NumberOfLockedPages : Uint4B\
2103 |   
2104 | \b  +0x150 Win32Process     : Ptr32 Void
2105 | \b0 \
2106 |    +0x154 Job              : Ptr32 _EJOB\
2107 |    +0x158 SectionObject    : Ptr32 Void\
2108 |    +0x15c SectionBaseAddress : Ptr32 Void\
2109 |    +0x160 Cookie           : Uint4B\
2110 |    +0x164 Spare8           : Uint4B\
2111 |    +0x168 WorkingSetWatch  : Ptr32 _PAGEFAULT_HISTORY\
2112 |    +0x16c Win32WindowStation : Ptr32 Void\
2113 |    +0x170 InheritedFromUniqueProcessId : Ptr32 Void\
2114 |    +0x174 LdtInformation   : Ptr32 Void\
2115 |    +0x178 VdmObjects       : Ptr32 Void\
2116 |    +0x17c ConsoleHostProcess : Uint4B\
2117 |    +0x180 DeviceMap        : Ptr32 Void\
2118 |    +0x184 EtwDataSource    : Ptr32 Void\
2119 |    +0x188 FreeTebHint      : Ptr32 Void\
2120 |    +0x190 PageDirectoryPte : _HARDWARE_PTE_X86\
2121 |    +0x190 Filler           : Uint8B\
2122 |    +0x198 Session          : Ptr32 Void\
2123 |    +0x19c ImageFileName    : [15] UChar\
2124 |    +0x1ab PriorityClass    : UChar\
2125 |    +0x1ac JobLinks         : _LIST_ENTRY\
2126 |    +0x1b4 LockedPagesList  : Ptr32 Void\
2127 |    +0x1b8 ThreadListHead   : _LIST_ENTRY\
2128 |    +0x1c0 SecurityPort     : Ptr32 Void\
2129 |    +0x1c4 PaeTop           : Ptr32 Void\
2130 |    +0x1c8 ActiveThreads    : Uint4B\
2131 |    +0x1cc ImagePathHash    : Uint4B\
2132 |    +0x1d0 DefaultHardErrorProcessing : Uint4B\
2133 |    +0x1d4 LastThreadExitStatus : Int4B\
2134 |  
2135 | \b   +0x1d8 Peb              : Ptr32 _PEB
2136 | \b0 \
2137 |    +0x1dc PrefetchTrace    : _EX_FAST_REF\
2138 |    +0x1e0 ReadOperationCount : _LARGE_INTEGER\
2139 |    +0x1e8 WriteOperationCount : _LARGE_INTEGER\
2140 |    +0x1f0 OtherOperationCount : _LARGE_INTEGER\
2141 |    +0x1f8 ReadTransferCount : _LARGE_INTEGER\
2142 |    +0x200 WriteTransferCount : _LARGE_INTEGER\
2143 |    +0x208 OtherTransferCount : _LARGE_INTEGER\
2144 |    +0x210 CommitChargeLimit : Uint4B\
2145 |    +0x214 CommitChargePeak : Uint4B\
2146 |    +0x218 AweInfo          : Ptr32 Void\
2147 |    +0x21c SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO\
2148 |    +0x220 Vm               : _MMSUPPORT\
2149 |    +0x28c MmProcessLinks   : _LIST_ENTRY\
2150 |    +0x294 HighestUserAddress : Ptr32 Void\
2151 |    +0x298 ModifiedPageCount : Uint4B\
2152 |    +0x29c Flags2           : Uint4B\
2153 |    +0x29c JobNotReallyActive : Pos 0, 1 Bit\
2154 |    +0x29c AccountingFolded : Pos 1, 1 Bit\
2155 |    +0x29c NewProcessReported : Pos 2, 1 Bit\
2156 |    +0x29c ExitProcessReported : Pos 3, 1 Bit\
2157 |    +0x29c ReportCommitChanges : Pos 4, 1 Bit\
2158 |    +0x29c LastReportMemory : Pos 5, 1 Bit\
2159 |    +0x29c ReportPhysicalPageChanges : Pos 6, 1 Bit\
2160 |    +0x29c HandleTableRundown : Pos 7, 1 Bit\
2161 |    +0x29c NeedsHandleRundown : Pos 8, 1 Bit\
2162 |    +0x29c RefTraceEnabled  : Pos 9, 1 Bit\
2163 |    +0x29c NumaAware        : Pos 10, 1 Bit\
2164 |    +0x29c ProtectedProcess : Pos 11, 1 Bit\
2165 |    +0x29c DefaultPagePriority : Pos 12, 3 Bits\
2166 |    +0x29c PrimaryTokenFrozen : Pos 15, 1 Bit\
2167 |    +0x29c ProcessVerifierTarget : Pos 16, 1 Bit\
2168 |    +0x29c StackRandomizationDisabled : Pos 17, 1 Bit\
2169 |    +0x29c AffinityPermanent : Pos 18, 1 Bit\
2170 |    +0x29c AffinityUpdateEnable : Pos 19, 1 Bit\
2171 |    +0x29c PropagateNode    : Pos 20, 1 Bit\
2172 |    +0x29c ExplicitAffinity : Pos 21, 1 Bit\
2173 |    +0x2a0 Flags            : Uint4B\
2174 |    +0x2a0 CreateReported   : Pos 0, 1 Bit\
2175 |    +0x2a0 NoDebugInherit   : Pos 1, 1 Bit\
2176 |    +0x2a0 ProcessExiting   : Pos 2, 1 Bit\
2177 |    +0x2a0 ProcessDelete    : Pos 3, 1 Bit\
2178 |    +0x2a0 Wow64SplitPages  : Pos 4, 1 Bit\
2179 |    +0x2a0 VmDeleted        : Pos 5, 1 Bit\
2180 |    +0x2a0 OutswapEnabled   : Pos 6, 1 Bit\
2181 |    +0x2a0 Outswapped       : Pos 7, 1 Bit\
2182 |    +0x2a0 ForkFailed       : Pos 8, 1 Bit\
2183 |    +0x2a0 Wow64VaSpace4Gb  : Pos 9, 1 Bit\
2184 |    +0x2a0 AddressSpaceInitialized : Pos 10, 2 Bits\
2185 |    +0x2a0 SetTimerResolution : Pos 12, 1 Bit\
2186 |    +0x2a0 BreakOnTermination : Pos 13, 1 Bit\
2187 |    +0x2a0 DeprioritizeViews : Pos 14, 1 Bit\
2188 |    +0x2a0 WriteWatch       : Pos 15, 1 Bit\
2189 |    +0x2a0 ProcessInSession : Pos 16, 1 Bit\
2190 |    +0x2a0 OverrideAddressSpace : Pos 17, 1 Bit\
2191 |    +0x2a0 HasAddressSpace  : Pos 18, 1 Bit\
2192 |    +0x2a0 LaunchPrefetched : Pos 19, 1 Bit\
2193 |    +0x2a0 InjectInpageErrors : Pos 20, 1 Bit\
2194 |    +0x2a0 VmTopDown        : Pos 21, 1 Bit\
2195 |    +0x2a0 ImageNotifyDone  : Pos 22, 1 Bit\
2196 |    +0x2a0 PdeUpdateNeeded  : Pos 23, 1 Bit\
2197 |    +0x2a0 VdmAllowed       : Pos 24, 1 Bit\
2198 |    +0x2a0 CrossSessionCreate : Pos 25, 1 Bit\
2199 |    +0x2a0 ProcessInserted  : Pos 26, 1 Bit\
2200 |    +0x2a0 DefaultIoPriority : Pos 27, 3 Bits\
2201 |    +0x2a0 ProcessSelfDelete : Pos 30, 1 Bit\
2202 |    +0x2a0 SetTimerResolutionLink : Pos 31, 1 Bit\
2203 |    +0x2a4 ExitStatus       : Int4B\
2204 |    +0x2a8 VadRoot          : _MM_AVL_TABLE\
2205 |    +0x2c8 AlpcContext      : _ALPC_PROCESS_CONTEXT\
2206 |    +0x2d8 TimerResolutionLink : _LIST_ENTRY\
2207 |    +0x2e0 RequestedTimerResolution : Uint4B\
2208 |    +0x2e4 ActiveThreadsHighWatermark : Uint4B\
2209 |    +0x2e8 SmallestTimerResolution : Uint4B\
2210 |    +0x2ec TimerResolutionStackRecord : Ptr32 _PO_DIAG_STACK_RECORD\
2211 | }</string>
2212 | 			</dict>
2213 | 		</dict>
2214 | 		<dict>
2215 | 			<key>Bounds</key>
2216 | 			<string>{{878, 2308}, {2712, 1915}}</string>
2217 | 			<key>Class</key>
2218 | 			<string>ShapedGraphic</string>
2219 | 			<key>ID</key>
2220 | 			<integer>90</integer>
2221 | 			<key>Shape</key>
2222 | 			<string>Rectangle</string>
2223 | 			<key>Style</key>
2224 | 			<dict>
2225 | 				<key>fill</key>
2226 | 				<dict>
2227 | 					<key>Color</key>
2228 | 					<dict>
2229 | 						<key>b</key>
2230 | 						<string>0.84153</string>
2231 | 						<key>g</key>
2232 | 						<string>1</string>
2233 | 						<key>r</key>
2234 | 						<string>0.991234</string>
2235 | 					</dict>
2236 | 				</dict>
2237 | 			</dict>
2238 | 		</dict>
2239 | 	</array>
2240 | 	<key>GridInfo</key>
2241 | 	<dict>
2242 | 		<key>DrawMajorGrid</key>
2243 | 		<string>NO</string>
2244 | 	</dict>
2245 | 	<key>GuidesLocked</key>
2246 | 	<string>NO</string>
2247 | 	<key>GuidesVisible</key>
2248 | 	<string>YES</string>
2249 | 	<key>HPages</key>
2250 | 	<integer>7</integer>
2251 | 	<key>ImageCounter</key>
2252 | 	<integer>1</integer>
2253 | 	<key>KeepToScale</key>
2254 | 	<false/>
2255 | 	<key>Layers</key>
2256 | 	<array>
2257 | 		<dict>
2258 | 			<key>Lock</key>
2259 | 			<string>NO</string>
2260 | 			<key>Name</key>
2261 | 			<string>Layer 1</string>
2262 | 			<key>Print</key>
2263 | 			<string>YES</string>
2264 | 			<key>View</key>
2265 | 			<string>YES</string>
2266 | 		</dict>
2267 | 	</array>
2268 | 	<key>LayoutInfo</key>
2269 | 	<dict>
2270 | 		<key>Animate</key>
2271 | 		<string>NO</string>
2272 | 		<key>circoMinDist</key>
2273 | 		<real>18</real>
2274 | 		<key>circoSeparation</key>
2275 | 		<real>0.0</real>
2276 | 		<key>layoutEngine</key>
2277 | 		<string>dot</string>
2278 | 		<key>neatoSeparation</key>
2279 | 		<real>0.0</real>
2280 | 		<key>twopiSeparation</key>
2281 | 		<real>0.0</real>
2282 | 	</dict>
2283 | 	<key>LinksVisible</key>
2284 | 	<string>NO</string>
2285 | 	<key>MagnetsVisible</key>
2286 | 	<string>NO</string>
2287 | 	<key>MasterSheets</key>
2288 | 	<array/>
2289 | 	<key>ModificationDate</key>
2290 | 	<string>2013-07-22 19:43:29 +0000</string>
2291 | 	<key>Modifier</key>
2292 | 	<string>Malware</string>
2293 | 	<key>NotesVisible</key>
2294 | 	<string>NO</string>
2295 | 	<key>Orientation</key>
2296 | 	<integer>2</integer>
2297 | 	<key>OriginVisible</key>
2298 | 	<string>NO</string>
2299 | 	<key>PageBreaks</key>
2300 | 	<string>NO</string>
2301 | 	<key>PrintInfo</key>
2302 | 	<dict>
2303 | 		<key>NSBottomMargin</key>
2304 | 		<array>
2305 | 			<string>float</string>
2306 | 			<string>41</string>
2307 | 		</array>
2308 | 		<key>NSHorizonalPagination</key>
2309 | 		<array>
2310 | 			<string>coded</string>
2311 | 			<string>BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG</string>
2312 | 		</array>
2313 | 		<key>NSLeftMargin</key>
2314 | 		<array>
2315 | 			<string>float</string>
2316 | 			<string>18</string>
2317 | 		</array>
2318 | 		<key>NSPaperSize</key>
2319 | 		<array>
2320 | 			<string>size</string>
2321 | 			<string>{612, 792}</string>
2322 | 		</array>
2323 | 		<key>NSPrintReverseOrientation</key>
2324 | 		<array>
2325 | 			<string>int</string>
2326 | 			<string>0</string>
2327 | 		</array>
2328 | 		<key>NSRightMargin</key>
2329 | 		<array>
2330 | 			<string>float</string>
2331 | 			<string>18</string>
2332 | 		</array>
2333 | 		<key>NSTopMargin</key>
2334 | 		<array>
2335 | 			<string>float</string>
2336 | 			<string>18</string>
2337 | 		</array>
2338 | 	</dict>
2339 | 	<key>PrintOnePage</key>
2340 | 	<false/>
2341 | 	<key>ReadOnly</key>
2342 | 	<string>NO</string>
2343 | 	<key>RowAlign</key>
2344 | 	<integer>1</integer>
2345 | 	<key>RowSpacing</key>
2346 | 	<real>36</real>
2347 | 	<key>SheetTitle</key>
2348 | 	<string>Canvas 1</string>
2349 | 	<key>SmartAlignmentGuidesActive</key>
2350 | 	<string>YES</string>
2351 | 	<key>SmartDistanceGuidesActive</key>
2352 | 	<string>YES</string>
2353 | 	<key>UniqueID</key>
2354 | 	<integer>1</integer>
2355 | 	<key>UseEntirePage</key>
2356 | 	<false/>
2357 | 	<key>VPages</key>
2358 | 	<integer>8</integer>
2359 | 	<key>WindowInfo</key>
2360 | 	<dict>
2361 | 		<key>CurrentSheet</key>
2362 | 		<integer>0</integer>
2363 | 		<key>ExpandedCanvases</key>
2364 | 		<array>
2365 | 			<dict>
2366 | 				<key>name</key>
2367 | 				<string>Canvas 1</string>
2368 | 			</dict>
2369 | 		</array>
2370 | 		<key>Frame</key>
2371 | 		<string>{{-128, 108}, {2597, 1438}}</string>
2372 | 		<key>ListView</key>
2373 | 		<true/>
2374 | 		<key>OutlineWidth</key>
2375 | 		<integer>142</integer>
2376 | 		<key>RightSidebar</key>
2377 | 		<false/>
2378 | 		<key>ShowRuler</key>
2379 | 		<true/>
2380 | 		<key>Sidebar</key>
2381 | 		<true/>
2382 | 		<key>SidebarWidth</key>
2383 | 		<integer>159</integer>
2384 | 		<key>VisibleRegion</key>
2385 | 		<string>{{-2974, 32}, {9636, 5196}}</string>
2386 | 		<key>Zoom</key>
2387 | 		<real>0.25</real>
2388 | 		<key>ZoomValues</key>
2389 | 		<array>
2390 | 			<array>
2391 | 				<string>Canvas 1</string>
2392 | 				<real>0.25</real>
2393 | 				<real>0.5</real>
2394 | 			</array>
2395 | 		</array>
2396 | 	</dict>
2397 | </dict>
2398 | </plist>
2399 | 


--------------------------------------------------------------------------------
/PE-Runtime.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/JeremyBlackthorne/PE-Runtime-Data-Structures/8bddd60ba4a177afe2150d90fb73d96d0ac6a285/PE-Runtime.jpg


--------------------------------------------------------------------------------
/PE-Runtime.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/JeremyBlackthorne/PE-Runtime-Data-Structures/8bddd60ba4a177afe2150d90fb73d96d0ac6a285/PE-Runtime.pdf


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | <p align="center">
 2 | <img src="https://github.com/JeremyBlackthorne/PE-Runtime-Data-Structures/blob/master/PE-Runtime.jpg" width=555 height=800/>
 3 | </p>
 4 | 
 5 | Originally posted by me in 2013: http://uncomputable.blogspot.com/2013/08/pe-runtime-data-structures-v1.html, just migrating it to a better home.
 6 | 
 7 | This is a diagram of PE runtime data structures created using WinDbg and OmniGraffle. I have included jpg and PDF versions in the repository.
 8 | 
 9 | I was inspired by Ero Carrera's [1] diagrams and Corkami [2]. I made this diagram because I was teaching myself Windows data structures and was unsatisfied with what was out there. The information for these structures was obtained from WinDbg and Windows Internals 6 by Russinovich, Solomon, and Ionescu [3].
10 | 
11 | I figured I should just upload it now instead of whenever I get around to finishing it. Hopefully I haven't made any mistakes. It will probably go through many iterations, maybe end up being interactive.
12 | 
13 | # References
14 | 
15 | [1] Ero Carrea - http://blog.dkbza.org/2012/08/pe-file-format-graphs.html <br>
16 | [2] Corkami - https://code.google.com/p/corkami/ <br>
17 | [3] Windows Internals -http://www.amazon.com/Windows-Internals-Part-Covering-Server/dp/0735648735
18 | 


--------------------------------------------------------------------------------