Thread Information Block
Posted 2007. 6. 19. 16:05, Filed under: Study/Computer ScienceWin32 Thread Information Block
From Wikipedia, the free encyclopedia
The TIB is officially undocumented for Windows 9x. The Windows NT series DDK includes a struct NT_TIB in winnt.h that documents the subsystem independent part. Yet so many Win32 programs use undocumented fields so it is effectively a part of the API.
The TIB can be used to get a lot of information on the process without calling win32 API. Examples include emulating GetLastError(), GetVersion(). Through the pointer to the PEB one can obtain access to the import tables (IAT), process startup arguments, image name, etc.
[edit] Accessing the TIB
The TIB can be accessed as an offset of segment register FS.
It is common to not access TIB fields by offset from FS:[0], but rather first getting a the linear self-refernecing pointer to the stored at FS:[0x18]. That pointer is used in means of pointer arithmetics or cast to a struct pointer.
Example in C inlined-assembly for 32-bit x86:
// gcc (AT&T-style inline assembly). void *getTIB() { void *pTib; __asm__("movl %%fs:0x18, %%eax\n\t" "movl %%eax, %0" : "=rm" (pTib) : : "%eax"); return pTib; }
// Microsoft C void *getTib() { void *pTib; __asm { mov EAX, FS:[18h] mov [pTib], EAX } return pTib; }
[edit] Contents of the TIB
Position | Length | Windows Versions | Description |
---|---|---|---|
FS:[0x00] | 4 | Win9x and NT | Current Structured Exception Handling (SEH) frame |
FS:[0x04] | 4 | Win9x and NT | Top of stack |
FS:[0x08] | 4 | Win9x and NT | Current bottom of stack |
FS:[0x10] | 4 | NT | Fiber data |
FS:[0x14] | 4 | Win9x and NT | Arbitrary data slot |
FS:[0x18] | 4 | Win9x and NT | Linear address of TIB |
- | - | NT | End of NT subsystem independent part |
FS:[0x20] | 4 | NT | Process ID |
FS:[0x24] | 4 | NT | Current thread ID |
FS:[0x2C] | 4 | Win9x and NT | Linear address of the thread-local storage array |
FS:[0x30] | 4 | NT | Linear address of Process Environment Block (PEB) |
FS:[0x34] | 4 | NT | Last error number |
FS:[0x38] | 4 | NT | Last status number |
FS:[0x3C] | 4 | NT | Count owned locks |
FS:[0x40] | 4 | NT | Hard errors mode |
~ | ~ | ~ | ~ |
FS:[0x60] | 4 | Win95/Win98 | Last error number |
~ | ~ | ~ | ~ |
FS:[0x74] | 4 | WinME | Last error number |