XNTSV: Windows System Structures Viewer
XNTSV is a free Windows utility for viewing system structures such as PEB, TEB, PEB_LDR_DATA, and EPROCESS in full field-level detail. Reach for it if you reverse engineer Windows processes or build software protection and need exact structure layouts for Windows 7 through Windows 11. Skip it if you're targeting Windows XP or 2000 — support for those was dropped — or if you want scriptable output instead of a GUI.
What is XNTSV?
XNTSV is a Windows desktop program from horsicq that displays the internal system structures Windows creates during process creation, such as PEB, TEB, PEB_LDR_DATA, and EPROCESS. Microsoft doesn't fully document these structures and their layout shifts between Windows versions, so XNTSV reads the live values instead of relying on a static reference. It's aimed at people who study Windows internals or work on copy-protection and anti-tamper tooling, according to the project.
Key Capabilities
- ✓Shows complete field-level detail for PEB, TEB, PEB_LDR_DATA, LDR_DATA_TABLE_ENTRY, RTL_USER_PROCESS_PARAMETERS, EPROCESS, and the other structures Windows creates when it starts a process.
- ✓Lets you add or edit structure definitions yourself in structs/ARCH/custom.json instead of waiting on an official update.
- ✓Reads kernel-mode structures too, provided you sign the driver with a valid certificate or Windows' test-signing mode.
- ✓Tracks structure differences across specific Windows releases rather than assuming one fixed layout for all of them.
- ✓Ships as open source under the MIT license, with build instructions in docs/BUILD.md for compiling from source.
- ✓Includes a changelog.txt in the repo so you can check what changed between releases before upgrading.
Who Benefits from XNTSV?
- •People pulling apart Windows binaries who need the exact byte layout of PEB, TEB, or EPROCESS on the specific build they're targeting, instead of guessing from old documentation.
- •Developers of software protection or anti-tamper code who read undocumented process structures directly, per the README's own framing.
- •Kernel-mode driver developers who want to inspect EPROCESS and related structures with a signed test driver.
- •Anyone maintaining internal tooling for a Windows version XNTSV doesn't ship structs for yet, who can define the missing fields in custom.json.
Getting Started with XNTSV
Grab a release from the project's GitHub Releases page — that's where the compiled Windows binary lives. The README points to a separate docs/RUN.md file for run instructions and docs/BUILD.md if you'd rather compile it yourself from the QMake project, but the contents of those files aren't included in the README itself, so the exact step-by-step commands aren't clearly documented here — open those docs on GitHub before you run it.
Strengths
- ✓Covers the specific structures (PEB, TEB, PEB_LDR_DATA, LDR_DATA_TABLE_ENTRY, RTL_USER_PROCESS_PARAMETERS, EPROCESS) that come up constantly in Windows reverse engineering, in one place instead of scattered forum posts.
- ✓The custom.json editing means you're not locked into whatever structures the maintainer already shipped — you can patch in a field yourself.
- ✓MIT license, so you can fold it into a commercial reverse-engineering or protection workflow without licensing friction.
- ✓Kernel-mode support extends it past user-mode structures like PEB/TEB into EPROCESS territory, which most lightweight GUI tools skip.
Current OS Support
- △The current build skips Windows 2000, XP, and Vista entirely — the README points people to an older XNTSV release for those, so if you maintain legacy XP-era tooling this version won't help.
- △Kernel-mode structure viewing needs a signed driver — either a valid driver certificate or Windows test-signing mode — which is extra setup most people skip on a clean machine.
- △The README itself calls Windows' documentation for these structures unofficial and says the layout shifts between versions, so XNTSV's own structure definitions can lag behind a brand-new Windows build until someone updates them.
- △It's a Windows-only desktop app built with QMake, with no mention in the README of Linux, macOS, or a scriptable/CLI mode, so it doesn't slot into an automated pipeline.
Similar Tools for Windows Internals
Frequently Asked Questions
XNTSV currently supports Windows 7, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2016, 2019, and 2022, plus all builds of Windows 10 and Windows 11 build 22000, according to the README.
XNTSV supports kernel-mode structure viewing, but the README says you need to sign the driver with a valid driver certificate or use a test-signing certificate before it will load.
XNTSV lets you define your own structures by editing the custom.json file inside the structs/ARCH folder in the project, rather than waiting for an official update to add them.
XNTSV is released under the MIT license, according to its GitHub repository.
XNTSV does not support Windows 2000, XP, or Vista in its current version — the README recommends using an older release of XNTSV if you need structures for those systems.
XNTSV binaries are published on the project's GitHub Releases page at github.com/horsicq/xntsv/releases, with separate docs for running and building it from source.
The problem it solves
Windows doesn't publish official documentation for structures like PEB, TEB, or EPROCESS, and their field layout changes across every OS version and build — so a researcher poking at process internals either has to reverse the struct offsets by hand for each Windows version or trust a third-party reference that's already stale by the time a new build ships. XNTSV solves this by reading the structures directly off a running system and letting you edit the structure definitions yourself in structs/ARCH/custom.json when a new field or version shows up before anyone documents it.
Who should try it — and who should skip
Try XNTSV if you're reverse engineering Windows processes, hardening an app against tampering, or building a driver, and you need PEB/TEB/EPROCESS fields laid out exactly as Windows does it on your target build — and you don't mind a Windows-only GUI tool. Skip it if you're stuck on Windows XP or older, need a scriptable structure dump for a CI pipeline, or only need the couple of fields WinDbg already shows with `!peb` — in that case, installing a separate tool isn't worth it.