Terminus Project launch.


I would like to announce launch of my new web-based tool: Terminus Project. It’s automatically generated diff of Windows structures with nice (I hope!) presentation layer. Currently it contains only data gathered from NTDLL PDBs (281 dlls at the moment of writing this post), but it can be easily extended with other libraries. Idea behind this project was derived from my old research on PEB structure (link), which is still quite popular (comparing to the other posts on this blog). There are a few things that should be improved (for example, better support for structures with unions), but I decided to publish it now, so it won’t stay on my HDD for the next few months.

Navigation throughout the Terminus is very simple, on the main page, there is a list of all structures and the search input field:


There are three possible Views: x86, x64 and combined. Sometimes not all of them are available, but it is very easy to check it without navigating to the structure. When the link to the specific View is hovered, Terminus shows the preview of the structure:


Structure view is very simple. Except the table with structure definition, it contains navigation bar in the bottom left corner (so user can easily switch between x86/x64/combined view) and ZOOM slider in the bottom right corner (helpful for big structures).


Each field in the structure table has tooltip with size of the field and if the type of the field is a structure itself, it has preview similar to the one shown on the index page:


Table header contains Min version and Max version rows (combined view has also Architecture row), those are of course minimal and maximal supported Windows versions (Pre RTM denotes any version that was published before RTM). There is a tooltip for these rows as well, it shows the exact version number of minimal and maximal supported Windows (sometimes I don’t have all matching x86/x64 DLLs, in such cases it can show different version for x86 and different for x64 like on the picture below):


I think that’s all for now, no technical details this time :) I can recommend you looking at PEB and TEB:

Last, but not least, to show that not everything is as nice as it could(should?) be:

In case of EPROCESS/ETHREAD combined view seems like a total failure, but x86/x64 views are quite usable.


Comments (19)

  1. 20:28, November 29, 2015Malcom  / Reply

    Really love this idea! Very helpful…

    • 20:43, November 29, 2015ReWolf  / Reply

      Thanks :)

  2. 13:52, December 8, 2015ZigD  / Reply

    Excellent ReWolf! impressive and useful

  3. 12:35, December 20, 2015Ali Rizvi-Santiago  / Reply

    This is one of the most fucking awesome and useful things on the internet right now. ;-)


    • 13:50, December 20, 2015ReWolf  / Reply


  4. 00:05, December 24, 2015i604  / Reply

    Hi ReWolf: ” It’s automatically generated diff of Windows structures with nice (I hope!) presentation layer. ”
    You said, but I can’t understand :( Diff of what? System calls before and after I run something?

    • 21:46, December 27, 2015ReWolf  / Reply

      diff of internal structures changes among windows versions.

  5. 12:59, June 22, 2016Alois Kraus  / Reply

    This is a great tool. I am still trying to get my hands on the GDI handles table which seem to have changed quite a lot. So far no tool seem to work reliably anymore. Are you aware of an up to date description of the GDICELL64 to which the GdiSharedHandleTable of the PEB points to? When I iterate over it and count all fields with the current pid it reports ca. 20% less handles than the performance counter tells me. It would be great if GDICELL/64 would also make it into your tool if you have access to the pdbs containing its definition.

    • 17:29, June 22, 2016ReWolf  / Reply

      If the structure is in public PDB of one of the system libraries then I can help you.

  6. 05:25, February 23, 2017sailing  / Reply

    Hi ReWolf:
    When I lookup _KTHREAD_X64 structure,there are two “7 sp1” ,and their min and max versions are overlapped,the first one is “min:6.1.7601.17514,max:6.1.7601.21772”;the second is “min:6.1.7601.18205,max:6.1.7601.22436”.so,I want to know if my build num is “6.1.7601.18409”,which one “7 sp1” structure should I chose.Thanks!

    • 17:28, February 23, 2017ReWolf  / Reply

      Looks like some bug in the generator code, I’ll take look at it later. To verify which structure is used on your system, just check it in the PDB file for the ntoskrnl.

  7. 08:47, April 27, 2017Steve  / Reply

    Hi ReWolf – terminus is excellent! Thank you for making it available for such convenient reference..I’ve returned to it many times over the last two years.

    I’m currently building a corpus of corpus of PDB and DWARF files to do large-scale analysis of structure change over time. Will terminus (or parts of it) make it to your github eventually? I’m very interested in the code.


    • 19:52, April 27, 2017ReWolf  / Reply

      At this point I don’t plan to publish the code. It is a complete mess written in python with 0 documentation :D

      • 04:09, May 1, 2017Steve  / Reply

        If you ever do let it out (even if only upon request), keep me in mind? I think my email was added part of the comment.

        After all, messy undocumented python is always better than no code :)
        Just smack a “don’t blame me, and I probably don’t remember” note on there


        • 11:55, May 6, 2017ReWolf  / Reply

          Sure, I’ll keep you in mind ;)

  8. 20:11, December 30, 2017mappa  / Reply

    Great project, I keep coming back to this from time to time. It’s a really handy reference. Can you tell me how did you manage to collect all of those pdb files for different versions? As far as I know you need to have some metadata (PDB signature, age, etc.) to query symbols server as there is no way to enumerate symbols by dll name. Am I unaware of something here or you have some other method to build your database?

    • 00:02, January 6, 2018ReWolf  / Reply

      You just need PE timestamp and PE image size.

      • 03:04, January 6, 2018mappa  / Reply

        Indeed, but that’s still an information you need to obtain somehow. For so many different OS versions, updates, service packs that seems to be quite a burden especially if one wants to rely on installing systems or downloading whole symbol packages. So are you doing just that or figured out something smarter to obtain symbols?

        • 21:23, February 6, 2018ReWolf  / Reply

          You can scrap timestamps from the web, this is all I can say :)

Leave a Reply

Allowed Tags - You may use these HTML tags and attributes in your comment.

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Pingbacks (0)

› No pingbacks yet.