This is interesting information, but where did it come from? Is this structure described in some MS documentation? If so, does it have the full layout of the TEB as well? > Log message: > Robert Reif <reif at earthlink.net> > Document all the structure members up to SessionId in the PEB.