 TYPEDEF: LSA_UNICODE_STRING UNICODE_STRING
 TYPEDEF: LSA_UNICODE_STRING* PUNICODE_STRING
 
+STRUCT: RTL_DRIVE_LETTER_CURDIR
+    { Flags USHORT }
+    { Length USHORT }
+    { Timestamp ULONG }
+    { DosPath UNICODE_STRING } ;
+TYPEDEF: RTL_DRIVE_LETTER_CURDIR* PRTL_DRIVE_LETTER_CURDIR
+
 STRUCT: RTL_USER_PROCESS_PARAMETERS
-    { Reserved1 BYTE[16] }
-    { Reserved2 PVOID[10] }
+    { MaximumLength ULONG }
+    { Length ULONG }
+    { Flags ULONG }
+    { DebugFlags ULONG }
+    { ConsoleHandle PVOID }
+    { ConsoleFlags ULONG }
+    { StdInputHandle HANDLE }
+    { StdOutputHandle HANDLE }
+    { StdErrorHandle HANDLE }
+    { CurrentDirectoryPath UNICODE_STRING }
+    { CurrentDirectoryHandle HANDLE }
+    { DllPath UNICODE_STRING }
     { ImagePathName UNICODE_STRING }
-    { CommandLine UNICODE_STRING } ;
+    { CommandLine UNICODE_STRING }
+    { Environment PVOID }
+    { StartingPositionLeft ULONG }
+    { StartingPositionTop ULONG }
+    { Width ULONG }
+    { Height ULONG }
+    { CharWidth ULONG }
+    { CharHeight ULONG }
+    { ConsoleTextAttributes ULONG }
+    { WindowFlags ULONG }
+    { ShowWindowFlags ULONG }
+    { WindowTitle UNICODE_STRING }
+    { DesktopName UNICODE_STRING }
+    { ShellInfo UNICODE_STRING }
+    { RuntimeData UNICODE_STRING }
+    { DLCurrentDirectory RTL_DRIVE_LETTER_CURDIR[0x20] } ;
 TYPEDEF: RTL_USER_PROCESS_PARAMETERS* PRTL_USER_PROCESS_PARAMETERS
 
 STRUCT: LIST_ENTRY

TYPEDEF: LIST_ENTRY* PLIST_ENTRY

STRUCT: PEB_LDR_DATA
    { Reserved1 BYTE[8] }
    { Reserved2 PVOID[3] }
    { InMemoryOrderModuleList LIST_ENTRY } ;
TYPEDEF: PEB_LDR_DATA* PPEB_LDR_DATA

TYPEDEF: void* PPS_POST_PROCESS_INIT_ROUTINE

STRUCT: PEB
    { Reserved1 BYTE[2] }
    { BeingDebugged BYTE }
    { Reserved2 BYTE[1] }
    { Reserved3 BYTE[2] }
    { Ldr PPEB_LDR_DATA }
    { ProcessParameters PRTL_USER_PROCESS_PARAMETERS }
    { Reserved4 BYTE[104] }
    { Reserved5 PVOID[52] }
    { PostProcessInitRoutine PPS_POST_PROCESS_INIT_ROUTINE }
    { Reserved6 BYTE[128] }
    { Reserved7 PVOID[1] }
    { SessionId ULONG } ;
TYPEDEF: PEB* PPEB

! PebBaseAddress is PPEB
STRUCT: PROCESS_BASIC_INFORMATION
    { Reserved1 PVOID }
    { PebBaseAddress void* }
    { Reserved2 PVOID[2] } 
    { UniqueProcessId ULONG_PTR }
    { Reserved3 PVOID } ;
    
ENUM: PROCESSINFOCLASS
    { ProcessBasicInformation 0 }
    { ProcessDebugPort 7 }


TYPEDEF: uint NTSTATUS

! Buffer is a PWSTR
STRUCT: LSA_UNICODE_STRING
    { Length USHORT }
    { MaximumLength USHORT }
