PEBTEB.H

The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the PEBTEB.H header at

d:\th.public.fre\internal\sdk\inc

and draws from it the following type definitions:

Line Number Type
105 struct _PEB
359 struct _ACTIVATION_CONTEXT_STACK
371 struct _TEB_ACTIVE_FRAME_CONTEXT
387 struct _TEB_ACTIVE_FRAME
407 struct _TEB
struct _TEB32
struct _TEB64
658 struct _CURDIR
698 struct _RTL_DRIVE_LETTER_CURDIR
763 struct _RTL_USER_PROCESS_PARAMETERS

The header PEBTEB.H is not known in any Device Driver Kit (DDK) or Windows Driver Kit (WDK).

The unusual definition of multiple structures at the same line can be explained, at least partially, by multiple inclusion designed to produce slightly different definitions depending on prior definition of macros that govern conditional compilation. This is confirmed by the disclosure of WOW64T.H in the “minwin” directory of the Windows Driver Kit (WDK) for Windows 10 in the original and Version 1511 editions. Among the reasons for suspecting that this disclosure of this directory’s disclosure was an oversight is that more than a few of its headers would include headers that are not supplied. WOW64T.H is one example in that it would include PEBTEB.H, but specially notable is that WOW64T.H would include PEBTEB.H twice: once with a macro PEBTEB_BITS defined as 32; next with it redefined as 64.