windbg获取结构体大小

1

0: kd> dt nt!_PEB -vstruct _PEB, 109 elements, 0x7b0 bytes   +0x000 InheritedAddressSpace : UChar   +0x001 ReadImageFileExecOptions : UChar   +0x002 BeingDebugged    : UChar   +0x003 BitField         : UChar   +0x003 ImageUsesLargePages : Bitfield Pos 0, 1 Bit   +0x003 IsProtectedProcess : Bitfield Pos 1, 1 Bit   +0x003 IsImageDynamicallyRelocated : Bitfield Pos 2, 1 Bit   +0x003 SkipPatchingUser32Forwarders : Bitfield Pos 3, 1 Bit   +0x003 IsPackagedProcess : Bitfield Pos 4, 1 Bit   +0x003 IsAppContainer   : Bitfield Pos 5, 1 Bit   +0x003 IsProtectedProcessLight : Bitfield Pos 6, 1 Bit   +0x003 IsLongPathAwareProcess : Bitfield Pos 7, 1 Bit   +0x004 Padding0         : [4] UChar   +0x008 Mutant           : Ptr64 to Void   +0x010 ImageBaseAddress : Ptr64 to Void   +0x018 Ldr              : Ptr64 to struct _PEB_LDR_DATA, 9 elements, 0x58 bytes   +0x020 ProcessParameters : Ptr64 to struct _RTL_USER_PROCESS_PARAMETERS, 33 elements, 0x410 bytes   +0x028 SubSystemData    : Ptr64 to Void   +0x030 ProcessHeap      : Ptr64 to Void   +0x038 FastPebLock      : Ptr64 to struct _RTL_CRITICAL_SECTION, 6 elements, 0x28 bytes   +0x040 AtlThunkSListPtr : Ptr64 to union _SLIST_HEADER, 3 elements, 0x10 bytes   +0x048 IFEOKey          : Ptr64 to Void   +0x050 CrossProcessFlags : Uint4B   +0x050 ProcessInJob     : Bitfield Pos 0, 1 Bit   +0x050 ProcessInitializing : Bitfield Pos 1, 1 Bit   +0x050 ProcessUsingVEH  : Bitfield Pos 2, 1 Bit   +0x050 ProcessUsingVCH  : Bitfield Pos 3, 1 Bit   +0x050 ProcessUsingFTH  : Bitfield Pos 4, 1 Bit   +0x050 ProcessPreviouslyThrottled : Bitfield Pos 5, 1 Bit   +0x050 ProcessCurrentlyThrottled : Bitfield Pos 6, 1 Bit   +0x050 ReservedBits0    : Bitfield Pos 7, 25 Bits   +0x054 Padding1         : [4] UChar   +0x058 KernelCallbackTable : Ptr64 to Void   +0x058 UserSharedInfoPtr : Ptr64 to Void   +0x060 SystemReserved   : Uint4B   +0x064 AtlThunkSListPtr32 : Uint4B   +0x068 ApiSetMap        : Ptr64 to Void   +0x070 TlsExpansionCounter : Uint4B   +0x074 Padding2         : [4] UChar   +0x078 TlsBitmap        : Ptr64 to Void   +0x080 TlsBitmapBits    : [2] Uint4B   +0x088 ReadOnlySharedMemoryBase : Ptr64 to Void   +0x090 SharedData       : Ptr64 to Void   +0x098 ReadOnlyStaticServerData : Ptr64 to Ptr64 to Void   +0x0a0 AnsiCodePageData : Ptr64 to Void   +0x0a8 OemCodePageData  : Ptr64 to Void   +0x0b0 UnicodeCaseTableData : Ptr64 to Void   +0x0b8 NumberOfProcessors : Uint4B   +0x0bc NtGlobalFlag     : Uint4B   +0x0c0 CriticalSectionTimeout : union _LARGE_INTEGER, 4 elements, 0x8 bytes   +0x0c8 HeapSegmentReserve : Uint8B   +0x0d0 HeapSegmentCommit : Uint8B   +0x0d8 HeapDeCommitTotalFreeThreshold : Uint8B   +0x0e0 HeapDeCommitFreeBlockThreshold : Uint8B   +0x0e8 NumberOfHeaps    : Uint4B   +0x0ec MaximumNumberOfHeaps : Uint4B   +0x0f0 ProcessHeaps     : Ptr64 to Ptr64 to Void   +0x0f8 GdiSharedHandleTable : Ptr64 to Void   +0x100 ProcessStarterHelper : Ptr64 to Void   +0x108 GdiDCAttributeList : Uint4B   +0x10c Padding3         : [4] UChar   +0x110 LoaderLock       : Ptr64 to struct _RTL_CRITICAL_SECTION, 6 elements, 0x28 bytes   +0x118 OSMajorVersion   : Uint4B   +0x11c OSMinorVersion   : Uint4B   +0x120 OSBuildNumber    : Uint2B   +0x122 OSCSDVersion     : Uint2B   +0x124 OSPlatformId     : Uint4B   +0x128 ImageSubsystem   : Uint4B   +0x12c ImageSubsystemMajorVersion : Uint4B   +0x130 ImageSubsystemMinorVersion : Uint4B   +0x134 Padding4         : [4] UChar   +0x138 ActiveProcessAffinityMask : Uint8B   +0x140 GdiHandleBuffer  : [60] Uint4B   +0x230 PostProcessInitRoutine : Ptr64 to     void    +0x238 TlsExpansionBitmap : Ptr64 to Void   +0x240 TlsExpansionBitmapBits : [32] Uint4B   +0x2c0 SessionId        : Uint4B   +0x2c4 Padding5         : [4] UChar   +0x2c8 AppCompatFlags   : union _ULARGE_INTEGER, 4 elements, 0x8 bytes   +0x2d0 AppCompatFlagsUser : union _ULARGE_INTEGER, 4 elements, 0x8 bytes   +0x2d8 pShimData        : Ptr64 to Void   +0x2e0 AppCompatInfo    : Ptr64 to Void   +0x2e8 CSDVersion       : struct _UNICODE_STRING, 3 elements, 0x10 bytes   +0x2f8 ActivationContextData : Ptr64 to struct _ACTIVATION_CONTEXT_DATA, 0 elements, 0x0 bytes   +0x300 ProcessAssemblyStorageMap : Ptr64 to struct _ASSEMBLY_STORAGE_MAP, 0 elements, 0x0 bytes   +0x308 SystemDefaultActivationContextData : Ptr64 to struct _ACTIVATION_CONTEXT_DATA, 0 elements, 0x0 bytes   +0x310 SystemAssemblyStorageMap : Ptr64 to struct _ASSEMBLY_STORAGE_MAP, 0 elements, 0x0 bytes   +0x318 MinimumStackCommit : Uint8B   +0x320 FlsCallback      : Ptr64 to struct _FLS_CALLBACK_INFO, 0 elements, 0x0 bytes   +0x328 FlsListHead      : struct _LIST_ENTRY, 2 elements, 0x10 bytes   +0x338 FlsBitmap        : Ptr64 to Void   +0x340 FlsBitmapBits    : [4] Uint4B   +0x350 FlsHighIndex     : Uint4B   +0x358 WerRegistrationData : Ptr64 to Void   +0x360 WerShipAssertPtr : Ptr64 to Void   +0x368 pUnused          : Ptr64 to Void   +0x370 pImageHeaderHash : Ptr64 to Void   +0x378 TracingFlags     : Uint4B   +0x378 HeapTracingEnabled : Bitfield Pos 0, 1 Bit   +0x378 CritSecTracingEnabled : Bitfield Pos 1, 1 Bit   +0x378 LibLoaderTracingEnabled : Bitfield Pos 2, 1 Bit   +0x378 SpareTracingBits : Bitfield Pos 3, 29 Bits   +0x37c Padding6         : [4] UChar   +0x380 CsrServerReadOnlySharedMemoryBase : Uint8B   +0x388 TppWorkerpListLock : Uint8B   +0x390 TppWorkerpList   : struct _LIST_ENTRY, 2 elements, 0x10 bytes   +0x3a0 WaitOnAddressHashTable : [128] Ptr64 to Void   +0x7a0 TelemetryCoverageHeader : Ptr64 to Void   +0x7a8 CloudFileFlags   : Uint4B

2 

0: kd> ?? @@c++(sizeof(_PEB))  unsigned int64 0x7b0

或者0: kd> ?? (sizeof(_PEB))  unsigned int64 0x7b0