Terminus Project launch.


I would like to announce launch of my new web-based tool: Terminus Project. It’s automatically generated diff of Windows structures with nice (I hope!) presentation layer. Currently it contains only data gathered from NTDLL PDBs (281 dlls at the moment of writing this post), but it can be easily extended with other libraries. Idea behind this project was derived from my old research on PEB structure (link), which is still quite popular (comparing to the other posts on this blog). There are a few things that should be improved (for example, better support for structures with unions), but I decided to publish it now, so it won’t stay on my HDD for the next few months.

Navigation throughout the Terminus is very simple, on the main page, there is a list of all structures and the search input field:


There are three possible Views: x86, x64 and combined. Sometimes not all of them are available, but it is very easy to check it without navigating to the structure. When the link to the specific View is hovered, Terminus shows the preview of the structure:


Structure view is very simple. Except the table with structure definition, it contains navigation bar in the bottom left corner (so user can easily switch between x86/x64/combined view) and ZOOM slider in the bottom right corner (helpful for big structures).


Each field in the structure table has tooltip with size of the field and if the type of the field is a structure itself, it has preview similar to the one shown on the index page:


Table header contains Min version and Max version rows (combined view has also Architecture row), those are of course minimal and maximal supported Windows versions (Pre RTM denotes any version that was published before RTM). There is a tooltip for these rows as well, it shows the exact version number of minimal and maximal supported Windows (sometimes I don’t have all matching x86/x64 DLLs, in such cases it can show different version for x86 and different for x64 like on the picture below):


I think that’s all for now, no technical details this time :) I can recommend you looking at PEB and TEB:

Last, but not least, to show that not everything is as nice as it could(should?) be:

In case of EPROCESS/ETHREAD combined view seems like a total failure, but x86/x64 views are quite usable.


Comments (11)

  1. 20:28, November 29, 2015Malcom  / Reply

    Really love this idea! Very helpful…

    • 20:43, November 29, 2015ReWolf  / Reply

      Thanks :)

  2. 13:52, December 8, 2015ZigD  / Reply

    Excellent ReWolf! impressive and useful

  3. 12:35, December 20, 2015Ali Rizvi-Santiago  / Reply

    This is one of the most fucking awesome and useful things on the internet right now. ;-)


    • 13:50, December 20, 2015ReWolf  / Reply


  4. 00:05, December 24, 2015i604  / Reply

    Hi ReWolf: ” It’s automatically generated diff of Windows structures with nice (I hope!) presentation layer. ”
    You said, but I can’t understand :( Diff of what? System calls before and after I run something?

    • 21:46, December 27, 2015ReWolf  / Reply

      diff of internal structures changes among windows versions.

  5. 12:59, June 22, 2016Alois Kraus  / Reply

    This is a great tool. I am still trying to get my hands on the GDI handles table which seem to have changed quite a lot. So far no tool seem to work reliably anymore. Are you aware of an up to date description of the GDICELL64 to which the GdiSharedHandleTable of the PEB points to? When I iterate over it and count all fields with the current pid it reports ca. 20% less handles than the performance counter tells me. It would be great if GDICELL/64 would also make it into your tool if you have access to the pdbs containing its definition.

    • 17:29, June 22, 2016ReWolf  / Reply

      If the structure is in public PDB of one of the system libraries then I can help you.

  6. 05:25, February 23, 2017sailing  / Reply

    Hi ReWolf:
    When I lookup _KTHREAD_X64 structure,there are two “7 sp1” ,and their min and max versions are overlapped,the first one is “min:6.1.7601.17514,max:6.1.7601.21772”;the second is “min:6.1.7601.18205,max:6.1.7601.22436”.so,I want to know if my build num is “6.1.7601.18409”,which one “7 sp1” structure should I chose.Thanks!

    • 17:28, February 23, 2017ReWolf  / Reply

      Looks like some bug in the generator code, I’ll take look at it later. To verify which structure is used on your system, just check it in the PDB file for the ntoskrnl.

Leave a Reply

Allowed Tags - You may use these HTML tags and attributes in your comment.

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Pingbacks (0)

› No pingbacks yet.