ebab7d0da53c51438720d60c6e2e467c - /page/wikibook/entry.mu

Micron Document

Livres et Wikis | Archives | Info

🔍Search

Win32 Thread Information Block

14.8 KB · ⇊ 5 parts · ⤓ Micron 14.8 KB · ⤓ HTML 33.2 KB

layout: Wide · Narrow · Centered

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

top

The Thread Information Block (TIB) or Thread Environment Block (TEB) is a data structure in Win32 on x86 that stores information about the currently running thread. It descended from, and is backward-compatible on 32-bit systems with, a similar structure in OS/2.cite-ref-pietrek-may96-1-0[1]

The TIB is officially undocumented for Windows 9x. The Windows NT series DDK (as well as the MinGW/ReactOS implementation) includes a struct NT_TIB in winnt.h that documents the subsystem independent part. Even before TIB was effectively documented, many applications have already started using its fields that they are effectively a part of the API. The first field containing the SEH frame, in particular, is directly referenced by the code produced by Microsoft's own compiler.cite-ref-pietrek-may96-1-1[1] The Win32 subsystem-specific part of the TEB is undocumented, but Wine includes a TEB definition in winternl.h.cite-ref-wine-winternl-2-0[2]

The TIB can be used to get a lot of information on the process without calling Win32 API. Examples include emulating GetLastError(), GetVersion(). Through the pointer to the PEB one can obtain access to the import tables (IAT), process startup arguments, image name, etc. It is accessed from the FS segment register on 32-bit Windows and GS on 64-bit Windows.

Contents

• Contents of the TIB on Windows

• Stack information stored in the TIB

• Accessing the TIB

• See also

• References

• Further reading

• External links

Contents of the TIB on Windows

This table is based on Wine's work on Microsoft Windows internals.cite-ref-wine-winternl-2-1[2]

| Bytes/ Type | offset (32-bit, FS) | offset (64-bit, GS) |

|---|---|---|

| pointer | FS:[0x00] | GS:[0x00] |

| pointer | FS:[0x04] | GS:[0x08] |

| pointer | FS:[0x08] | GS:[0x10] |

| pointer | FS:[0x0C] | GS:[0x18] |

| pointer | FS:[0x10] | GS:[0x20] |

| pointer | FS:[0x14] | GS:[0x28] |

| pointer | FS:[0x18] | GS:[0x30] |

| End of NT subsystem independent part; b… | | |

| pointer | FS:[0x1C] | GS:[0x38] |

| pointer | FS:[0x20] | GS:[0x40] |

| pointer | FS:[0x24] | GS:[0x48] |

| pointer | FS:[0x28] | GS:[0x50] |

| pointer | FS:[0x2C] | GS:[0x58] |

| pointer | FS:[0x30] | GS:[0x60] |

| 4 | FS:[0x34] | GS:[0x68] |

| 4 | FS:[0x38] | GS:[0x6C] |

| pointer | FS:[0x3C] | GS:[0x70] |

| pointer | FS:[0x40] | GS:[0x78] |

| 124 | FS:[0x44] | GS:[0x80] |

| pointer | FS:[0xC0] | GS:[0x100] |

| 4 | FS:[0xC4] | GS:[0x108] |

| 4 | FS:[0xC8] | GS:[0x10C] |

| 216 | FS:[0xCC] | GS:[0x110] |

| 4 | FS:[0x1A4] | GS:[0x2C0] |

| 18 | FS:[0x1A8] | GS:[0x2C8] |

| 24 | FS:[0x1BC] | GS:[0x2E8] |

| 40 | FS:[0x1D4] | GS:[0x300] |

| 1248 | FS:[0x1FC] | GS:[0x350] |

| 4 | FS:[0x6DC] | GS:[0x838] |

| 4 | FS:[0x6E0] | GS:[0x840] |

| 4 | FS:[0x6E4] | GS:[0x848] |

| 4 | FS:[0x6E8] | GS:[0x850] |

| 4 | FS:[0x6EC] | GS:[0x858] |

| 4 | FS:[0x6F0] | GS:[0x860] |

| 4 | FS:[0x6F4] | GS:[0x868] |

| 4 | FS:[0x6F8] | GS:[0x86C] |

| 4 | FS:[0x6FC] | GS:[0x870] |

| 20 | FS:[0x700] | GS:[0x878] |

| 1248 | FS:[0x714] | GS:[0x890] |

| 4 | FS:[0xBF4] | GS:[0x1250] |

| 532 | FS:[0xBF8] | GS:[0x1258] |

| pointer | FS:[0xE0C] | GS:[0x1478] |

| pointer[] | FS:[0xE10] | GS:[0x1480] |

| 8 | FS:[0xF10] | GS:[0x1680] |

| 4 | FS:[0xF18] | GS:[0x1690] |

| 4 | FS:[0xF1C] | GS:[0x1698] |

| 4 | FS:[0xF28] | GS:[0x16B0] |

| 4 | FS:[0xF78] | GS:[0x1748] |

| This is not the full table; see wine re… | | |

| Bytes/ Type | Windows Versions |

|---|---|

| pointer | Win9x and NT |

| pointer | NT |

| pointer | Win9x and NT |

| pointer | NT |

| pointer | Win9x and NT |

| pointer | NT |

| 4 | NT |

| pointer | NT |

| 124 | NT, Wine |

| pointer | NT |

| 4 | NT |

| 216 | NT, Wine |

| 4 | NT |

| 18 | NT |

| 24 | NT, Wine |

| 40 | NT, Wine |

| 1248 | NT, Wine |

| 4 | NT |

| 20 | NT |

| 1248 | NT |

| 4 | NT |

| 532 | NT |

| pointer | NT |

| pointer[] | NT |

| 8 | NT |

| 4 | NT |

| Bytes/ Type | Description |

|---|---|

| pointer | Current Structured Exception Handling (… |

| pointer | Stack Base / Bottom of stack (high addr… |

| pointer | Stack Limit / Ceiling of stack (low add… |

| pointer | SubSystemTib |

| pointer | Fiber data |

| pointer | Arbitrary data slot |

| pointer | Linear address of TEB |

| pointer | Environment Pointer |

| pointer | Process ID (in some Windows distributio… |

| pointer | Current thread ID |

| pointer | Active RPC Handle |

| pointer | Linear address of the thread-local stor… |

| pointer | Linear address of Process Environment B… |

| 4 | Last error number |

| 4 | Count of owned critical sections |

| pointer | Address of CSR Client Thread |

| pointer | Win32 Thread Information |

| 124 | Win32 client information (NT), user32 p… |

| pointer | Reserved for Wow64. Contains a pointer… |

| 4 | Current Locale |

| 4 | FP Software Status Register |

| 216 | Reserved for OS (NT), kernel32 private… |

| 4 | Exception code |

| 18 | Activation context stack |

| 24 | Spare bytes (NT), ntdll private data (W… |

| 40 | Reserved for OS (NT), ntdll private dat… |

| 1248 | GDI TEB Batch (OS), vm86 private data (… |

| 4 | GDI Region |

| 4 | GDI Pen |

| 4 | GDI Brush |

| 4 | Real Process ID |

| 4 | Real Thread ID |

| 4 | GDI cached process handle |

| 4 | GDI client process ID (PID) |

| 4 | GDI client thread ID (TID) |

| 4 | GDI thread locale information |

| 20 | Reserved for user application |

| 1248 | Reserved for GL (See wine ref for inter… |

| 4 | Last Status Value |

| 532 | Static UNICODE_STRING buffer |

| pointer | Also known as DeallocationStack , it es… |

| pointer[] | TLS slots, 4/8 bytes per slot, 64 slots |

| 8 | TLS links ( LIST_ENTRY structure) |

| 4 | VDM |

| 4 | Reserved for RPC |

| 4 | Thread error mode ( RtlSetThreadErrorMo… |

| 4 | Guaranteed stack bytes |

FS (for 32-bit) or GS (for 64-bit) maps to a TIB which is embedded in a data block known as the TDB (thread data base). The TIB contains the thread-specific exception handling chain and pointer to the TLS (thread local storage.) The thread local storage is not the same as C local storage.

Stack information stored in the TIB

A process should be free to move the stack of its threads as long as it updates the information stored in the TIB accordingly. A few fields are key to this matter: stack base, stack limit, deallocation stack, and guaranteed stack bytes, respectively stored at offsets 0x8, 0x10, 0x1478 and 0x1748 in 64 bits. Different Windows kernel functions read and write these values, specially to distinguish stack overflows from other read/write page faults (a read or write to a page guarded among the stack limits in guaranteed stack bytes will generate a stack-overflow exception instead of an access violation). The deallocation stack is important because Windows API allows to change the amount of guarded pages: the function SetThreadStackGuarantee allows both read the current space and to grow it. In order to read it, it reads the GuaranteedStackBytes field, and to grow it, it uses has to uncommit stack pages. Setting stack limits without setting DeallocationStack will probably cause odd behavior in SetThreadStackGuarantee. For example, it will overwrite the stack limits to wrong values. Different libraries call SetThreadStackGuarantee, for example the .NET CLR uses it for setting up the stack of their threads.

Accessing the TIB

The TIB of the current thread can be accessed as an offset of segment register FS (x86) or GS (x64).

It is not common to access the TIB fields by an offset from FS:[0], but rather first getting a linear self-referencing pointer to it stored at FS:[18h]. That pointer can be used with pointer arithmetic or be cast to a struct pointer.

Using Microsoft Windows SDK or similar, a programmer could use an inline function defined in winnt.h named NtCurrentTeb which returns the address of the current Thread Information Block as NT_TIB *.cite-ref-5[5]

Alternative methods of access for IA-32 architectures are as follows:

// gcc (AT&T-style inline assembly).

void *getTIB(void) {

#if defined(__x86_64__) || defined(__amd64__)

__asm__("movq %%gs:0x30, %0" : "=r" (pTIB));

#elif defined(__i386__)

__asm__("movl %%fs:0x18, %0" : "=r" (pTIB));

#else

#error unsupported architecture

#endif

return pTIB;

}

// gcc (named address spaces, same as the inline assembly version on -O1 or -ftree-ter).

void *getTIB(void) {

#if defined(__x86_64__) || defined(__amd64__)

#ifndef __SEG_GS

#error unsupported GCC version

#endif

return *(void *__seg_gs *) 0x30;

#elif defined(__i386__)

#ifndef __SEG_FS

#error unsupported GCC version

#endif

return *(void *__seg_fs *) 0x18;

#else

#error unsupported architecture

#endif

}

// Microsoft C

__declspec(naked)

void *getTIB() {

__asm mov EAX, FS:[18h]

__asm ret

}

// Using Microsoft's intrinsics instead of inline assembly (works for both X86 and X64 architectures)

void *getTIB() {

#ifdef _M_IX86

return (void *)__readfsdword(0x18);

#elif _M_AMD64

return (void *)__readgsqword(0x30);

#else

#error unsupported architecture

#endif

}