Application Compatibility Flags in the PEB

The PEB got two sets of flags for Application Compatibility in Windows XP, one each apparently for kernel and user issues. The kernel set is named AppCompatFlags and is reliably at offsets 0x01D8 and 0x02C8 in 32-bit and 64-bit Windows, respectively. As a set, these flags are a ULARGE_INTEGER. Individual flags are defined by macros. Microsoft’s names for them therefore do not show in public symbol files and might have been unknown forever except that Microsoft published some in a header named APCOMPAT.H in the Enterprise edition of the Windows Driver Kit (WDK) for the original and 1511 releases of Windows 10.

That the AppCompatFlags represent kernel compatibility issues, as distinct from the issues that have the separate AppCompatFlagsUser member, looks to be entirely a user-mode distinction, as originally modelled by the separation of KERNEL32 and USER32. APPHELP loads them from the MASK attribute of a <FLAG> tag whose TYPE is KERNEL.