Geoff Chappell - Software Analyst
Windows 7 added a new set of bit fields to the PEB, reliably at offsets 0x0240 and 0x0378 in 32-bit and 64-bit Windows respectively. A single ULONG, named TracingFlags, overlays the bits.
| Mask | Definition | Versions |
|---|---|---|
| 0x00000001 |
ULONG HeapTracingEnabled : 1; |
6.1 and higher |
| 0x00000002 |
ULONG CritSecTracingEnabled : 1; |
6.1 and higher |
| 0x00000004 |
ULONG LibLoaderTracingEnabled : 1; |
6.2 and higher |
ULONG SpareTracingBits : 30; |
6.1 only | |
ULONG SpareTracingBits : 29; |
6.2 and higher |