首页 > 代码库 > TIB、TEB 信息

TIB、TEB 信息

2024-08-11 12:21:35   215人阅读

https://en.wikipedia.org/wiki/Win32_Thread_Information_Block

 

这是重点

 

 

PositionLengthWindows VersionsDescription
FS:[0x00]4Win9x and NTCurrent Structured Exception Handling (SEH) frame
FS:[0x04]4Win9x and NTStack Base / Bottom of stack (high address)
FS:[0x08]4Win9x and NTStack Limit / Ceiling of stack (low address)
FS:[0x0C]4NTSubSystemTib
FS:[0x10]4NTFiber data
FS:[0x14]4Win9x and NTArbitrary data slot
FS:[0x18]4Win9x and NTLinear address of TEB
---- End of NT subsystem independent part ----
FS:[0x1C]4NTEnvironment Pointer
FS:[0x20]4NTProcess ID (in some windows distributions this field is used as ‘DebugContext‘)
FS:[0x24]4NTCurrent thread ID
FS:[0x28]4NTActive RPC Handle
FS:[0x2C]4Win9x and NTLinear address of the thread-local storage array
FS:[0x30]4NTLinear address of Process Environment Block (PEB)
FS:[0x34]4NTLast error number
FS:[0x38]4NTCount of owned critical sections
FS:[0x3C]4NTAddress of CSR Client Thread
FS:[0x40]4NTWin32 Thread Information
FS:[0x44]124NT, WineWin32 client information (NT), user32 private data (Wine), 0x60 = LastError (Win95), 0x74 = LastError (WinME)
FS:[0xC0]4NTReserved for Wow64. Contains a pointer to FastSysCall in Wow64.
FS:[0xC4]4NTCurrent Locale
FS:[0xC8]4NTFP Software Status Register
FS:[0xCC]216NT, WineReserved for OS (NT), kernel32 private data (Wine)

herein: FS:[0x124] 4 NT Pointer to KTHREAD (ETHREAD) structure

FS:[0x1A4]4NTException code
FS:[0x1A8]18NTActivation context stack
FS:[0x1BC]24NT, WineSpare bytes (NT), ntdll private data (Wine)
FS:[0x1D4]40NT, WineReserved for OS (NT), ntdll private data (Wine)
FS:[0x1FC]1248NT, WineGDI TEB Batch (OS), vm86 private data (Wine)
FS:[0x6DC]4NTGDI Region
FS:[0x6E0]4NTGDI Pen
FS:[0x6E4]4NTGDI Brush
FS:[0x6E8]4NTReal Process ID
FS:[0x6EC]4NTReal Thread ID
FS:[0x6F0]4NTGDI cached process handle
FS:[0x6F4]4NTGDI client process ID (PID)
FS:[0x6F8]4NTGDI client thread ID (TID)
FS:[0x6FC]4NTGDI thread locale information
FS:[0x700]20NTReserved for user application
FS:[0x714]1248NTReserved for GL
FS:[0xBF4]4NTLast Status Value
FS:[0xBF8]532NTStatic UNICODE_STRING buffer
FS:[0xE0C]4NTPointer to deallocation stack
FS:[0xE10]256NTTLS slots, 4 byte per slot
FS:[0xF10]8NTTLS links (LIST_ENTRY structure)
FS:[0xF18]4NTVDM
FS:[0xF1C]4NTReserved for RPC
FS:[0xF28]4NTThread error mode (RtlSetThreadErrorMode)

TIB、TEB 信息


联系
我们