On Oct 30, 2020, at 6:09 AM, Gabriel Ivăncescu <gabrielopcode@gmail.com> wrote:

On 30/10/2020 09:20, Brendan Shanks wrote:
Signed-off-by: Brendan Shanks <bshanks@codeweavers.com>
---
 include/winternl.h | 12 ++++++++++++
 1 file changed, 12 insertions(+)
diff --git a/include/winternl.h b/include/winternl.h
index bd6a2c35932..1b69846cc2c 100644
--- a/include/winternl.h
+++ b/include/winternl.h
@@ -379,6 +379,12 @@ typedef struct _PEB
     PVOID                        WaitOnAddressHashTable [0x80];     /* 25c/3a0 */
     PVOID                        TelemetryCoverageHeader;           /* 45c/7a0 */
     ULONG                        CloudFileFlags;                    /* 460/7a8 */
+    ULONG                        CloudFileDiagFlags;                /* 464/7ac */
+    CHAR                         PlaceholderCompatibilityMode;      /* 468/7b0 */
+    ULONG                        PlaceholderCompatibilityModeReserved[7]; /* 469/7b1 */
+    PVOID                        LeapSecondData;                    /* 470/7b8 */
+    ULONG                        LeapSecondFlags;                   /* 474/7c0 */
+    ULONG                        NtGlobalFlag2;                     /* 478/7c4 */
 } PEB, *PPEB;
   @@ -617,6 +623,12 @@ typedef struct _PEB64
     ULONG64                      WaitOnAddressHashTable [0x80];     /* 03a0 */
     ULONG64                      TelemetryCoverageHeader;           /* 07a0 */
     ULONG                        CloudFileFlags;                    /* 07a8 */
+    ULONG                        CloudFileDiagFlags;                /* 07ac */
+    CHAR                         PlaceholderCompatibilityMode;      /* 07b0 */
+    ULONG                        PlaceholderCompatibilityModeReserved[7]; /* 07b1 */
+    PVOID                        LeapSecondData;                    /* 07b8 */
+    ULONG                        LeapSecondFlags;                   /* 07c0 */
+    ULONG                        NtGlobalFlag2;                     /* 07c4 */
 } PEB64;
   typedef struct _TEB64

Isn't PlaceholderCompatibilityModeReserved[7] supposed to be CHAR or BYTE?

Yes you’re right, good catch. I’ll send another version.

Brendan