1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
use core::mem::size_of;
use crate::ntapi_base::CLIENT_ID32;
use crate::ntldr::{LDR_DDAG_STATE, LDR_DLL_LOAD_REASON};
use crate::ntpsapi::GDI_HANDLE_BUFFER32;
use crate::ntrtl::RTL_MAX_DRIVE_LETTERS;
use crate::string::{UTF16Const, UTF8Const};
use winapi::shared::guiddef::GUID;
use winapi::shared::ntdef::{
    BOOLEAN, CHAR, LARGE_INTEGER, LCID, LIST_ENTRY32, LONG, NTSTATUS, PROCESSOR_NUMBER,
    SINGLE_LIST_ENTRY32, STRING32, UCHAR, ULARGE_INTEGER, ULONG, ULONGLONG, UNICODE_STRING,
    UNICODE_STRING32, USHORT, WCHAR,
};
use winapi::um::winnt::{FLS_MAXIMUM_AVAILABLE, NT_TIB32};
pub const WOW64_SYSTEM_DIRECTORY: UTF8Const = UTF8Const("SysWOW64\0");
/// "SysWOW64"
pub const WOW64_SYSTEM_DIRECTORY_U: UTF16Const = UTF16Const(&[
    0x0053, 0x0079, 0x0073, 0x0057, 0x004F, 0x0057, 0x0036, 0x0034, 0u16,
]);
pub const WOW64_X86_TAG: UTF8Const = UTF8Const(" (x86)\0");
/// " (x86)"
pub const WOW64_X86_TAG_U: UTF16Const = UTF16Const(&[
    0x0020, 0x0028, 0x0078, 0x0038, 0x0036, 0x0029, 0u16,
]);
ENUM!{enum WOW64_SHARED_INFORMATION {
    SharedNtdll32LdrInitializeThunk = 0,
    SharedNtdll32KiUserExceptionDispatcher = 1,
    SharedNtdll32KiUserApcDispatcher = 2,
    SharedNtdll32KiUserCallbackDispatcher = 3,
    SharedNtdll32ExpInterlockedPopEntrySListFault = 4,
    SharedNtdll32ExpInterlockedPopEntrySListResume = 5,
    SharedNtdll32ExpInterlockedPopEntrySListEnd = 6,
    SharedNtdll32RtlUserThreadStart = 7,
    SharedNtdll32pQueryProcessDebugInformationRemote = 8,
    SharedNtdll32BaseAddress = 9,
    SharedNtdll32LdrSystemDllInitBlock = 10,
    Wow64SharedPageEntriesCount = 11,
}}
STRUCT!{struct RTL_BALANCED_NODE32_u_s {
    Left: ULONG, // WOW64_POINTER
    Right: ULONG, // WOW64_POINTER
}}
UNION!{union RTL_BALANCED_NODE32_u {
    Children: [ULONG; 2], // WOW64_POINTER
    s: RTL_BALANCED_NODE32_u_s,
}}
STRUCT!{struct RTL_BALANCED_NODE32 {
    u: RTL_BALANCED_NODE32_u,
    ParentValue: ULONG,
}}
pub type PRTL_BALANCED_NODE32 = *mut RTL_BALANCED_NODE32;
STRUCT!{struct RTL_RB_TREE32 {
    Root: ULONG, // WOW64_POINTER
    Min: ULONG, // WOW64_POINTER
}}
pub type PRTL_RB_TREE32 = *mut RTL_RB_TREE32;
STRUCT!{struct PEB_LDR_DATA32 {
    Length: ULONG,
    Initialized: BOOLEAN,
    SsHandle: ULONG,
    InLoadOrderModuleList: LIST_ENTRY32,
    InMemoryOrderModuleList: LIST_ENTRY32,
    InInitializationOrderModuleList: LIST_ENTRY32,
    EntryInProgress: ULONG,
    ShutdownInProgress: BOOLEAN,
    ShutdownThreadId: ULONG,
}}
pub type PPEB_LDR_DATA32 = *mut PEB_LDR_DATA32;
STRUCT!{struct LDR_SERVICE_TAG_RECORD32 {
    Next: ULONG,
    ServiceTag: ULONG,
}}
pub type PLDR_SERVICE_TAG_RECORD32 = *mut LDR_SERVICE_TAG_RECORD32;
STRUCT!{struct LDRP_CSLIST32 {
    Tail: ULONG, // WOW64_POINTER
}}
pub type PLDRP_CSLIST32 = *mut LDRP_CSLIST32;
UNION!{union LDR_DDAG_NODE32_u {
    Dependencies: LDRP_CSLIST32,
    RemovalLink: SINGLE_LIST_ENTRY32,
}}
STRUCT!{struct LDR_DDAG_NODE32 {
    Modules: LIST_ENTRY32,
    ServiceTagList: ULONG, // WOW64_POINTER
    LoadCount: ULONG,
    LoadWhileUnloadingCount: ULONG,
    LowestLink: ULONG,
    u: LDR_DDAG_NODE32_u,
    IncomingDependencies: LDRP_CSLIST32,
    State: LDR_DDAG_STATE,
    CondenseLink: SINGLE_LIST_ENTRY32,
    PreorderNumber: ULONG,
}}
pub type PLDR_DDAG_NODE32 = *mut LDR_DDAG_NODE32;
pub const LDR_DATA_TABLE_ENTRY_SIZE_WINXP_32: usize = 80;
pub const LDR_DATA_TABLE_ENTRY_SIZE_WIN7_32: usize = 144;
pub const LDR_DATA_TABLE_ENTRY_SIZE_WIN8_32: usize = 152;
UNION!{union LDR_DATA_TABLE_ENTRY32_u1 {
    InInitializationOrderLinks: LIST_ENTRY32,
    InProgressLinks: LIST_ENTRY32,
}}
UNION!{union LDR_DATA_TABLE_ENTRY32_u2 {
    FlagGroup: [UCHAR; 4],
    Flags: ULONG,
}}
STRUCT!{struct LDR_DATA_TABLE_ENTRY32 {
    InLoadOrderLinks: LIST_ENTRY32,
    InMemoryOrderLinks: LIST_ENTRY32,
    u1: LDR_DATA_TABLE_ENTRY32_u1,
    DllBase: ULONG, // WOW64_POINTER
    EntryPoint: ULONG, // WOW64_POINTER
    SizeOfImage: ULONG,
    FullDllName: UNICODE_STRING32,
    BaseDllName: UNICODE_STRING32,
    u2: LDR_DATA_TABLE_ENTRY32_u2,
    ObsoleteLoadCount: USHORT,
    TlsIndex: USHORT,
    HashLinks: LIST_ENTRY32,
    TimeDateStamp: ULONG,
    EntryPointActivationContext: ULONG, // WOW64_POINTER
    Lock: ULONG, // WOW64_POINTER
    DdagNode: ULONG, // WOW64_POINTER
    NodeModuleLink: LIST_ENTRY32,
    LoadContext: ULONG, // WOW64_POINTER
    ParentDllBase: ULONG, // WOW64_POINTER
    SwitchBackContext: ULONG, // WOW64_POINTER
    BaseAddressIndexNode: RTL_BALANCED_NODE32,
    MappingInfoIndexNode: RTL_BALANCED_NODE32,
    OriginalBase: ULONG,
    LoadTime: LARGE_INTEGER,
    BaseNameHashValue: ULONG,
    LoadReason: LDR_DLL_LOAD_REASON,
    ImplicitPathOptions: ULONG,
    ReferenceCount: ULONG,
    DependentLoadFlags: ULONG,
    SigningLevel: UCHAR,
}}
BITFIELD!{unsafe LDR_DATA_TABLE_ENTRY32_u2 Flags: ULONG [
    PackagedBinary set_PackagedBinary[0..1],
    MarkedForRemoval set_MarkedForRemoval[1..2],
    ImageDll set_ImageDll[2..3],
    LoadNotificationsSent set_LoadNotificationsSent[3..4],
    TelemetryEntryProcessed set_TelemetryEntryProcessed[4..5],
    ProcessStaticImport set_ProcessStaticImport[5..6],
    InLegacyLists set_InLegacyLists[6..7],
    InIndexes set_InIndexes[7..8],
    ShimDll set_ShimDll[8..9],
    InExceptionTable set_InExceptionTable[9..10],
    ReservedFlags1 set_ReservedFlags1[10..12],
    LoadInProgress set_LoadInProgress[12..13],
    LoadConfigProcessed set_LoadConfigProcessed[13..14],
    EntryProcessed set_EntryProcessed[14..15],
    ProtectDelayLoad set_ProtectDelayLoad[15..16],
    ReservedFlags3 set_ReservedFlags3[16..18],
    DontCallForThreads set_DontCallForThreads[18..19],
    ProcessAttachCalled set_ProcessAttachCalled[19..20],
    ProcessAttachFailed set_ProcessAttachFailed[20..21],
    CorDeferredValidate set_CorDeferredValidate[21..22],
    CorImage set_CorImage[22..23],
    DontRelocate set_DontRelocate[23..24],
    CorILOnly set_CorILOnly[24..25],
    ReservedFlags5 set_ReservedFlags5[25..28],
    Redirected set_Redirected[28..29],
    ReservedFlags6 set_ReservedFlags6[29..31],
    CompatDatabaseProcessed set_CompatDatabaseProcessed[31..32],
]}
pub type PLDR_DATA_TABLE_ENTRY32 = *mut LDR_DATA_TABLE_ENTRY32;
STRUCT!{struct CURDIR32 {
    DosPath: UNICODE_STRING32,
    Handle: ULONG, // WOW64_POINTER
}}
pub type PCURDIR32 = *mut CURDIR32;
STRUCT!{struct RTL_DRIVE_LETTER_CURDIR32 {
    Flags: USHORT,
    Length: USHORT,
    TimeStamp: ULONG,
    DosPath: STRING32,
}}
pub type PRTL_DRIVE_LETTER_CURDIR32 = *mut RTL_DRIVE_LETTER_CURDIR32;
STRUCT!{struct RTL_USER_PROCESS_PARAMETERS32 {
    MaximumLength: ULONG,
    Length: ULONG,
    Flags: ULONG,
    DebugFlags: ULONG,
    ConsoleHandle: ULONG, // WOW64_POINTER
    ConsoleFlags: ULONG,
    StandardInput: ULONG, // WOW64_POINTER
    StandardOutput: ULONG, // WOW64_POINTER
    StandardError: ULONG, // WOW64_POINTER
    CurrentDirectory: CURDIR32,
    DllPath: UNICODE_STRING32,
    ImagePathName: UNICODE_STRING32,
    CommandLine: UNICODE_STRING32,
    Environment: ULONG, // WOW64_POINTER
    StartingX: ULONG,
    StartingY: ULONG,
    CountX: ULONG,
    CountY: ULONG,
    CountCharsX: ULONG,
    CountCharsY: ULONG,
    FillAttribute: ULONG,
    WindowFlags: ULONG,
    ShowWindowFlags: ULONG,
    WindowTitle: UNICODE_STRING32,
    DesktopInfo: UNICODE_STRING32,
    ShellInfo: UNICODE_STRING32,
    RuntimeData: UNICODE_STRING32,
    CurrentDirectories: [RTL_DRIVE_LETTER_CURDIR32; RTL_MAX_DRIVE_LETTERS],
    EnvironmentSize: ULONG,
    EnvironmentVersion: ULONG,
    PackageDependencyData: ULONG, // WOW64_POINTER
    ProcessGroupId: ULONG,
    LoaderThreads: ULONG,
}}
pub type PRTL_USER_PROCESS_PARAMETERS32 = *mut RTL_USER_PROCESS_PARAMETERS32;
UNION!{union PEB32_u {
    KernelCallbackTable: ULONG, // WOW64_POINTER
    UserSharedInfoPtr: ULONG, // WOW64_POINTER
}}
STRUCT!{struct PEB32 {
    InheritedAddressSpace: BOOLEAN,
    ReadImageFileExecOptions: BOOLEAN,
    BeingDebugged: BOOLEAN,
    BitField: BOOLEAN,
    Mutant: ULONG, // WOW64_POINTER
    ImageBaseAddress: ULONG, // WOW64_POINTER
    Ldr: ULONG, // WOW64_POINTER
    ProcessParameters: ULONG, // WOW64_POINTER
    SubSystemData: ULONG, // WOW64_POINTER
    ProcessHeap: ULONG, // WOW64_POINTER
    FastPebLock: ULONG, // WOW64_POINTER
    AtlThunkSListPtr: ULONG, // WOW64_POINTER
    IFEOKey: ULONG, // WOW64_POINTER
    CrossProcessFlags: ULONG,
    u: PEB32_u,
    SystemReserved: [ULONG; 1],
    AtlThunkSListPtr32: ULONG,
    ApiSetMap: ULONG, // WOW64_POINTER
    TlsExpansionCounter: ULONG,
    TlsBitmap: ULONG, // WOW64_POINTER
    TlsBitmapBits: [ULONG; 2],
    ReadOnlySharedMemoryBase: ULONG, // WOW64_POINTER
    HotpatchInformation: ULONG, // WOW64_POINTER
    ReadOnlyStaticServerData: ULONG, // WOW64_POINTER
    AnsiCodePageData: ULONG, // WOW64_POINTER
    OemCodePageData: ULONG, // WOW64_POINTER
    UnicodeCaseTableData: ULONG, // WOW64_POINTER
    NumberOfProcessors: ULONG,
    NtGlobalFlag: ULONG,
    CriticalSectionTimeout: LARGE_INTEGER,
    HeapSegmentReserve: ULONG,
    HeapSegmentCommit: ULONG,
    HeapDeCommitTotalFreeThreshold: ULONG,
    HeapDeCommitFreeBlockThreshold: ULONG,
    NumberOfHeaps: ULONG,
    MaximumNumberOfHeaps: ULONG,
    ProcessHeaps: ULONG, // WOW64_POINTER
    GdiSharedHandleTable: ULONG, // WOW64_POINTER
    ProcessStarterHelper: ULONG, // WOW64_POINTER
    GdiDCAttributeList: ULONG,
    LoaderLock: ULONG, // WOW64_POINTER
    OSMajorVersion: ULONG,
    OSMinorVersion: ULONG,
    OSBuildNumber: USHORT,
    OSCSDVersion: USHORT,
    OSPlatformId: ULONG,
    ImageSubsystem: ULONG,
    ImageSubsystemMajorVersion: ULONG,
    ImageSubsystemMinorVersion: ULONG,
    ActiveProcessAffinityMask: ULONG,
    GdiHandleBuffer: GDI_HANDLE_BUFFER32,
    PostProcessInitRoutine: ULONG, // WOW64_POINTER
    TlsExpansionBitmap: ULONG, // WOW64_POINTER
    TlsExpansionBitmapBits: [ULONG; 32],
    SessionId: ULONG,
    AppCompatFlags: ULARGE_INTEGER,
    AppCompatFlagsUser: ULARGE_INTEGER,
    pShimData: ULONG, // WOW64_POINTER
    AppCompatInfo: ULONG, // WOW64_POINTER
    CSDVersion: UNICODE_STRING32,
    ActivationContextData: ULONG, // WOW64_POINTER
    ProcessAssemblyStorageMap: ULONG, // WOW64_POINTER
    SystemDefaultActivationContextData: ULONG, // WOW64_POINTER
    SystemAssemblyStorageMap: ULONG, // WOW64_POINTER
    MinimumStackCommit: ULONG,
    FlsCallback: ULONG, // WOW64_POINTER
    FlsListHead: LIST_ENTRY32,
    FlsBitmap: ULONG, // WOW64_POINTER
    FlsBitmapBits: [ULONG; FLS_MAXIMUM_AVAILABLE as usize / (size_of::<ULONG>() * 8)],
    FlsHighIndex: ULONG,
    WerRegistrationData: ULONG, // WOW64_POINTER
    WerShipAssertPtr: ULONG, // WOW64_POINTER
    pContextData: ULONG, // WOW64_POINTER
    pImageHeaderHash: ULONG, // WOW64_POINTER
    TracingFlags: ULONG,
    CsrServerReadOnlySharedMemoryBase: ULONGLONG,
    TppWorkerpListLock: ULONG, // WOW64_POINTER
    TppWorkerpList: LIST_ENTRY32,
    WaitOnAddressHashTable: [ULONG; 128], // WOW64_POINTER
    TelemetryCoverageHeader: ULONG, // WOW64_POINTER
    CloudFileFlags: ULONG,
    CloudFileDiagFlags: ULONG,
    PlaceholderCompatibilityMode: CHAR,
    PlaceholderCompatibilityModeReserved: [CHAR; 7],
}}
BITFIELD!{PEB32 BitField: BOOLEAN [
    ImageUsesLargePages set_ImageUsesLargePages[0..1],
    IsProtectedProcess set_IsProtectedProcess[1..2],
    IsImageDynamicallyRelocated set_IsImageDynamicallyRelocated[2..3],
    SkipPatchingUser32Forwarders set_SkipPatchingUser32Forwarders[3..4],
    IsPackagedProcess set_IsPackagedProcess[4..5],
    IsAppContainer set_IsAppContainer[5..6],
    IsProtectedProcessLight set_IsProtectedProcessLight[6..7],
    IsLongPathAwareProcess set_IsLongPathAwareProcess[7..8],
]}
BITFIELD!{PEB32 CrossProcessFlags: ULONG [
    ProcessInJob set_ProcessInJob[0..1],
    ProcessInitializing set_ProcessInitializing[1..2],
    ProcessUsingVEH set_ProcessUsingVEH[2..3],
    ProcessUsingVCH set_ProcessUsingVCH[3..4],
    ProcessUsingFTH set_ProcessUsingFTH[4..5],
    ReservedBits0 set_ReservedBits0[5..32],
]}
BITFIELD!{PEB32 TracingFlags: ULONG [
    HeapTracingEnabled set_HeapTracingEnabled[0..1],
    CritSecTracingEnabled set_CritSecTracingEnabled[1..2],
    LibLoaderTracingEnabled set_LibLoaderTracingEnabled[2..3],
    SpareTracingBits set_SpareTracingBits[3..32],
]}
pub type PPEB32 = *mut PEB32;
pub const GDI_BATCH_BUFFER_SIZE: usize = 310;
STRUCT!{struct GDI_TEB_BATCH32 {
    Offset: ULONG,
    HDC: ULONG,
    Buffer: [ULONG; GDI_BATCH_BUFFER_SIZE],
}}
pub type PGDI_TEB_BATCH32 = *mut GDI_TEB_BATCH32;
STRUCT!{struct TEB32_u_s {
    ReservedPad0: UCHAR,
    ReservedPad1: UCHAR,
    ReservedPad2: UCHAR,
    IdealProcessor: UCHAR,
}}
UNION!{union TEB32_u {
    CurrentIdealProcessor: PROCESSOR_NUMBER,
    IdealProcessorValue: ULONG,
    s: TEB32_u_s,
}}
STRUCT!{struct TEB32 {
    NtTib: NT_TIB32,
    EnvironmentPointer: ULONG, // WOW64_POINTER
    ClientId: CLIENT_ID32,
    ActiveRpcHandle: ULONG, // WOW64_POINTER
    ThreadLocalStoragePointer: ULONG, // WOW64_POINTER
    ProcessEnvironmentBlock: ULONG, // WOW64_POINTER
    LastErrorValue: ULONG,
    CountOfOwnedCriticalSections: ULONG,
    CsrClientThread: ULONG, // WOW64_POINTER
    Win32ThreadInfo: ULONG, // WOW64_POINTER
    User32Reserved: [ULONG; 26],
    UserReserved: [ULONG; 5],
    WOW32Reserved: ULONG, // WOW64_POINTER
    CurrentLocale: LCID,
    FpSoftwareStatusRegister: ULONG,
    ReservedForDebuggerInstrumentation: [ULONG; 16], // WOW64_POINTER
    SystemReserved1: [ULONG; 36], // WOW64_POINTER
    WorkingOnBehalfTicket: [UCHAR; 8],
    ExceptionCode: NTSTATUS,
    ActivationContextStackPointer: ULONG, // WOW64_POINTER
    InstrumentationCallbackSp: ULONG,
    InstrumentationCallbackPreviousPc: ULONG,
    InstrumentationCallbackPreviousSp: ULONG,
    InstrumentationCallbackDisabled: BOOLEAN,
    SpareBytes: [UCHAR; 23],
    TxFsContext: ULONG,
    GdiTebBatch: GDI_TEB_BATCH32,
    RealClientId: CLIENT_ID32,
    GdiCachedProcessHandle: ULONG, // WOW64_POINTER
    GdiClientPID: ULONG,
    GdiClientTID: ULONG,
    GdiThreadLocalInfo: ULONG, // WOW64_POINTER
    Win32ClientInfo: [ULONG; 62],
    glDispatchTable: [ULONG; 233], // WOW64_POINTER
    glReserved1: [ULONG; 29], // WOW64_POINTER
    glReserved2: ULONG, // WOW64_POINTER
    glSectionInfo: ULONG, // WOW64_POINTER
    glSection: ULONG, // WOW64_POINTER
    glTable: ULONG, // WOW64_POINTER
    glCurrentRC: ULONG, // WOW64_POINTER
    glContext: ULONG, // WOW64_POINTER
    LastStatusValue: NTSTATUS,
    StaticUnicodeString: UNICODE_STRING32,
    StaticUnicodeBuffer: [WCHAR; 261],
    DeallocationStack: ULONG, // WOW64_POINTER
    TlsSlots: [ULONG; 64], // WOW64_POINTER
    TlsLinks: LIST_ENTRY32,
    Vdm: ULONG, // WOW64_POINTER
    ReservedForNtRpc: ULONG, // WOW64_POINTER
    DbgSsReserved: [ULONG; 2], // WOW64_POINTER
    HardErrorMode: ULONG,
    Instrumentation: [ULONG; 9], // WOW64_POINTER
    ActivityId: GUID,
    SubProcessTag: ULONG, // WOW64_POINTER
    PerflibData: ULONG, // WOW64_POINTER
    EtwTraceData: ULONG, // WOW64_POINTER
    WinSockData: ULONG, // WOW64_POINTER
    GdiBatchCount: ULONG,
    u: TEB32_u,
    GuaranteedStackBytes: ULONG,
    ReservedForPerf: ULONG, // WOW64_POINTER
    ReservedForOle: ULONG, // WOW64_POINTER
    WaitingOnLoaderLock: ULONG,
    SavedPriorityState: ULONG, // WOW64_POINTER
    ReservedForCodeCoverage: ULONG,
    ThreadPoolData: ULONG, // WOW64_POINTER
    TlsExpansionSlots: ULONG, // WOW64_POINTER
    MuiGeneration: ULONG,
    IsImpersonating: ULONG,
    NlsCache: ULONG, // WOW64_POINTER
    pShimData: ULONG, // WOW64_POINTER
    HeapVirtualAffinity: USHORT,
    LowFragHeapDataSlot: USHORT,
    CurrentTransactionHandle: ULONG, // WOW64_POINTER
    ActiveFrame: ULONG, // WOW64_POINTER
    FlsData: ULONG, // WOW64_POINTER
    PreferredLanguages: ULONG, // WOW64_POINTER
    UserPrefLanguages: ULONG, // WOW64_POINTER
    MergedPrefLanguages: ULONG, // WOW64_POINTER
    MuiImpersonation: ULONG,
    CrossTebFlags: USHORT,
    SameTebFlags: USHORT,
    TxnScopeEnterCallback: ULONG, // WOW64_POINTER
    TxnScopeExitCallback: ULONG, // WOW64_POINTER
    TxnScopeContext: ULONG, // WOW64_POINTER
    LockCount: ULONG,
    WowTebOffset: LONG,
    ResourceRetValue: ULONG, // WOW64_POINTER
    ReservedForWdf: ULONG, // WOW64_POINTER
    ReservedForCrt: ULONGLONG,
    EffectiveContainerId: GUID,
}}
BITFIELD!{TEB32 SameTebFlags: USHORT [
    SafeThunkCall set_SafeThunkCall[0..1],
    InDebugPrint set_InDebugPrint[1..2],
    HasFiberData set_HasFiberData[2..3],
    SkipThreadAttach set_SkipThreadAttach[3..4],
    WerInShipAssertCode set_WerInShipAssertCode[4..5],
    RanProcessInit set_RanProcessInit[5..6],
    ClonedThread set_ClonedThread[6..7],
    SuppressDebugMsg set_SuppressDebugMsg[7..8],
    DisableUserStackWalk set_DisableUserStackWalk[8..9],
    RtlExceptionAttached set_RtlExceptionAttached[9..10],
    InitialThread set_InitialThread[10..11],
    SessionAware set_SessionAware[11..12],
    LoadOwner set_LoadOwner[12..13],
    LoaderWorker set_LoaderWorker[13..14],
    SpareSameTebBits set_SpareSameTebBits[14..16],
]}
pub type PTEB32 = *mut TEB32;
#[inline]
pub fn UStr32ToUStr(
    Destination: &mut UNICODE_STRING,
    Source: &UNICODE_STRING32,
) {
    Destination.Length = Source.Length;
    Destination.MaximumLength = Source.MaximumLength;
    Destination.Buffer = Source.Buffer as *mut u16;
}
#[inline]
pub fn UStrToUStr32(
    Destination: &mut UNICODE_STRING32,
    Source: &UNICODE_STRING,
) {
    Destination.Length = Source.Length;
    Destination.MaximumLength = Source.MaximumLength;
    Destination.Buffer = Source.Buffer as u32;
}