zoukankan      html  css  js  c++  java
  • TEB 、TIB、PEB--Vista 32

    TEB

    struct TEB
    typedef struct _TEB
    {
         NT_TIB NtTib;
         PVOID EnvironmentPointer;
         CLIENT_ID ClientId;
         PVOID ActiveRpcHandle;
         PVOID ThreadLocalStoragePointer;
         PPEB ProcessEnvironmentBlock;
         ULONG LastErrorValue;
         ULONG CountOfOwnedCriticalSections;
         PVOID CsrClientThread;
         PVOID Win32ThreadInfo;
         ULONG User32Reserved[26];
         ULONG UserReserved[5];
         PVOID WOW32Reserved;
         ULONG CurrentLocale;
         ULONG FpSoftwareStatusRegister;
         VOID * SystemReserved1[54];
         LONG ExceptionCode;
         PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
         UCHAR SpareBytes1[36];
         ULONG TxFsContext;
         GDI_TEB_BATCH GdiTebBatch;
         CLIENT_ID RealClientId;
         PVOID GdiCachedProcessHandle;
         ULONG GdiClientPID;
         ULONG GdiClientTID;
         PVOID GdiThreadLocalInfo;
         ULONG Win32ClientInfo[62];
         VOID * glDispatchTable[233];
         ULONG glReserved1[29];
         PVOID glReserved2;
         PVOID glSectionInfo;
         PVOID glSection;
         PVOID glTable;
         PVOID glCurrentRC;
         PVOID glContext;
         ULONG LastStatusValue;
         UNICODE_STRING StaticUnicodeString;
         WCHAR StaticUnicodeBuffer[261];
         PVOID DeallocationStack;
         VOID * TlsSlots[64];
         LIST_ENTRY TlsLinks;
         PVOID Vdm;
         PVOID ReservedForNtRpc;
         VOID * DbgSsReserved[2];
         ULONG HardErrorMode;
         VOID * Instrumentation[9];
         GUID ActivityId;
         PVOID SubProcessTag;
         PVOID EtwLocalData;
         PVOID EtwTraceData;
         PVOID WinSockData;
         ULONG GdiBatchCount;
         UCHAR SpareBool0;
         UCHAR SpareBool1;
         UCHAR SpareBool2;
         UCHAR IdealProcessor;
         ULONG GuaranteedStackBytes;
         PVOID ReservedForPerf;
         PVOID ReservedForOle;
         ULONG WaitingOnLoaderLock;
         PVOID SavedPriorityState;
         ULONG SoftPatchPtr1;
         PVOID ThreadPoolData;
         VOID * * TlsExpansionSlots;
         ULONG ImpersonationLocale;
         ULONG IsImpersonating;
         PVOID NlsCache;
         PVOID pShimData;
         ULONG HeapVirtualAffinity;
         PVOID CurrentTransactionHandle;
         PTEB_ACTIVE_FRAME ActiveFrame;
         PVOID FlsData;
         PVOID PreferredLanguages;
         PVOID UserPrefLanguages;
         PVOID MergedPrefLanguages;
         ULONG MuiImpersonation;
         WORD CrossTebFlags;
         ULONG SpareCrossTebBits: 16;
         WORD SameTebFlags;
         ULONG DbgSafeThunkCall: 1;
         ULONG DbgInDebugPrint: 1;
         ULONG DbgHasFiberData: 1;
         ULONG DbgSkipThreadAttach: 1;
         ULONG DbgWerInShipAssertCode: 1;
         ULONG DbgRanProcessInit: 1;
         ULONG DbgClonedThread: 1;
         ULONG DbgSuppressDebugMsg: 1;
         ULONG SpareSameTebBits: 8;
         PVOID TxnScopeEnterCallback;
         PVOID TxnScopeExitCallback;
         PVOID TxnScopeContext;
         ULONG LockCount;
         ULONG ProcessRundown;
         UINT64 LastSwitchTime;
         UINT64 TotalSwitchOutTime;
         LARGE_INTEGER WaitReasonBitMap;
    } TEB, *PTEB;

     TIB

    typedef struct _NT_TIB
    {
         PEXCEPTION_REGISTRATION_RECORD ExceptionList;
         PVOID StackBase;
         PVOID StackLimit;
         PVOID SubSystemTib;
         union
         {
              PVOID FiberData;
              ULONG Version;
         };
         PVOID ArbitraryUserPointer;
         PNT_TIB Self;
    } NT_TIB, *PNT_TIB;

    PEB

    typedef struct _PEB
    {
         UCHAR InheritedAddressSpace;
         UCHAR ReadImageFileExecOptions;
         UCHAR BeingDebugged;
         UCHAR BitField;
         ULONG ImageUsesLargePages: 1;
         ULONG IsProtectedProcess: 1;
         ULONG IsLegacyProcess: 1;
         ULONG IsImageDynamicallyRelocated: 1;
         ULONG SpareBits: 4;
         PVOID Mutant;
         PVOID ImageBaseAddress;
         PPEB_LDR_DATA Ldr;
         PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
         PVOID SubSystemData;
         PVOID ProcessHeap;
         PRTL_CRITICAL_SECTION FastPebLock;
         PVOID AtlThunkSListPtr;
         PVOID IFEOKey;
         ULONG CrossProcessFlags;
         ULONG ProcessInJob: 1;
         ULONG ProcessInitializing: 1;
         ULONG ReservedBits0: 30;
         union
         {
              PVOID KernelCallbackTable;
              PVOID UserSharedInfoPtr;
         };
         ULONG SystemReserved[1];
         ULONG SpareUlong;
         PPEB_FREE_BLOCK FreeList;
         ULONG TlsExpansionCounter;
         PVOID TlsBitmap;
         ULONG TlsBitmapBits[2];
         PVOID ReadOnlySharedMemoryBase;
         PVOID HotpatchInformation;
         VOID * * ReadOnlyStaticServerData;
         PVOID AnsiCodePageData;
         PVOID OemCodePageData;
         PVOID UnicodeCaseTableData;
         ULONG NumberOfProcessors;
         ULONG NtGlobalFlag;
         LARGE_INTEGER CriticalSectionTimeout;
         ULONG HeapSegmentReserve;
         ULONG HeapSegmentCommit;
         ULONG HeapDeCommitTotalFreeThreshold;
         ULONG HeapDeCommitFreeBlockThreshold;
         ULONG NumberOfHeaps;
         ULONG MaximumNumberOfHeaps;
         VOID * * ProcessHeaps;
         PVOID GdiSharedHandleTable;
         PVOID ProcessStarterHelper;
         ULONG GdiDCAttributeList;
         PRTL_CRITICAL_SECTION LoaderLock;
         ULONG OSMajorVersion;
         ULONG OSMinorVersion;
         WORD OSBuildNumber;
         WORD OSCSDVersion;
         ULONG OSPlatformId;
         ULONG ImageSubsystem;
         ULONG ImageSubsystemMajorVersion;
         ULONG ImageSubsystemMinorVersion;
         ULONG ImageProcessAffinityMask;
         ULONG GdiHandleBuffer[34];
         PVOID PostProcessInitRoutine;
         PVOID TlsExpansionBitmap;
         ULONG TlsExpansionBitmapBits[32];
         ULONG SessionId;
         ULARGE_INTEGER AppCompatFlags;
         ULARGE_INTEGER AppCompatFlagsUser;
         PVOID pShimData;
         PVOID AppCompatInfo;
         UNICODE_STRING CSDVersion;
         _ACTIVATION_CONTEXT_DATA * ActivationContextData;
         _ASSEMBLY_STORAGE_MAP * ProcessAssemblyStorageMap;
         _ACTIVATION_CONTEXT_DATA * SystemDefaultActivationContextData;
         _ASSEMBLY_STORAGE_MAP * SystemAssemblyStorageMap;
         ULONG MinimumStackCommit;
         _FLS_CALLBACK_INFO * FlsCallback;
         LIST_ENTRY FlsListHead;
         PVOID FlsBitmap;
         ULONG FlsBitmapBits[4];
         ULONG FlsHighIndex;
         PVOID WerRegistrationData;
         PVOID WerShipAssertPtr;
    } PEB, *PPEB;

    http://www.nirsoft.net/kernel_struct/vista/TEB.html

    Windows Vista Kernel Structures

  • 相关阅读:
    微服务架构技术栈选型手册(万字长文)
    Visual Studio 2013 always switches source control plugin to Git and disconnect TFS
    Visual Studio 2013 always switches source control plugin to Git and disconnect TFS
    MFC对话框中使用CHtmlEditCtrl
    ATL开发 ActiveX控件的 inf文件模板
    ActiveX: 如何用.inf和.ocx文件生成cab文件
    Xslt 1.0中使用Array
    如何分隔两个base64字符串?
    An attempt was made to load a program with an incorrect format
    JQuery 公网 CDN
  • 原文地址:https://www.cnblogs.com/DirWang/p/12167559.html
Copyright © 2011-2022 走看看