TIB、TEB 信息
https://en.wikipedia.org/wiki/Win32_Thread_Information_Block
这是重点
Position | Length | Windows Versions | Description |
---|---|---|---|
FS:[0x00] | 4 | Win9x and NT | Current Structured Exception Handling (SEH) frame |
FS:[0x04] | 4 | Win9x and NT | Stack Base / Bottom of stack (high address) |
FS:[0x08] | 4 | Win9x and NT | Stack Limit / Ceiling of stack (low address) |
FS:[0x0C] | 4 | NT | SubSystemTib |
FS:[0x10] | 4 | NT | Fiber data |
FS:[0x14] | 4 | Win9x and NT | Arbitrary data slot |
FS:[0x18] | 4 | Win9x and NT | Linear address of TEB |
---- End of NT subsystem independent part ---- | |||
FS:[0x1C] | 4 | NT | Environment Pointer |
FS:[0x20] | 4 | NT | Process ID (in some windows distributions this field is used as 'DebugContext') |
FS:[0x24] | 4 | NT | Current thread ID |
FS:[0x28] | 4 | NT | Active RPC Handle |
FS:[0x2C] | 4 | Win9x and NT | Linear address of the thread-local storage array |
FS:[0x30] | 4 | NT | Linear address of Process Environment Block (PEB) |
FS:[0x34] | 4 | NT | Last error number |
FS:[0x38] | 4 | NT | Count of owned critical sections |
FS:[0x3C] | 4 | NT | Address of CSR Client Thread |
FS:[0x40] | 4 | NT | Win32 Thread Information |
FS:[0x44] | 124 | NT, Wine | Win32 client information (NT), user32 private data (Wine), 0x60 = LastError (Win95), 0x74 = LastError (WinME) |
FS:[0xC0] | 4 | NT | Reserved for Wow64. Contains a pointer to FastSysCall in Wow64. |
FS:[0xC4] | 4 | NT | Current Locale |
FS:[0xC8] | 4 | NT | FP Software Status Register |
FS:[0xCC] | 216 | NT, Wine | Reserved for OS (NT), kernel32 private data (Wine)
herein: FS:[0x124] 4 NT Pointer to KTHREAD (ETHREAD) structure |
FS:[0x1A4] | 4 | NT | Exception code |
FS:[0x1A8] | 18 | NT | Activation context stack |
FS:[0x1BC] | 24 | NT, Wine | Spare bytes (NT), ntdll private data (Wine) |
FS:[0x1D4] | 40 | NT, Wine | Reserved for OS (NT), ntdll private data (Wine) |
FS:[0x1FC] | 1248 | NT, Wine | GDI TEB Batch (OS), vm86 private data (Wine) |
FS:[0x6DC] | 4 | NT | GDI Region |
FS:[0x6E0] | 4 | NT | GDI Pen |
FS:[0x6E4] | 4 | NT | GDI Brush |
FS:[0x6E8] | 4 | NT | Real Process ID |
FS:[0x6EC] | 4 | NT | Real Thread ID |
FS:[0x6F0] | 4 | NT | GDI cached process handle |
FS:[0x6F4] | 4 | NT | GDI client process ID (PID) |
FS:[0x6F8] | 4 | NT | GDI client thread ID (TID) |
FS:[0x6FC] | 4 | NT | GDI thread locale information |
FS:[0x700] | 20 | NT | Reserved for user application |
FS:[0x714] | 1248 | NT | Reserved for GL |
FS:[0xBF4] | 4 | NT | Last Status Value |
FS:[0xBF8] | 532 | NT | Static UNICODE_STRING buffer |
FS:[0xE0C] | 4 | NT | Pointer to deallocation stack |
FS:[0xE10] | 256 | NT | TLS slots, 4 byte per slot |
FS:[0xF10] | 8 | NT | TLS links (LIST_ENTRY structure) |
FS:[0xF18] | 4 | NT | VDM |
FS:[0xF1C] | 4 | NT | Reserved for RPC |
FS:[0xF28] | 4 | NT | Thread error mode (RtlSetThreadErrorMode) |
TIB、TEB 信息的更多相关文章
- java笔记整理
Java 笔记整理 包含内容 Unix Java 基础, 数据库(Oracle jdbc Hibernate pl/sql), web, JSP, Struts, Ajax Spring, E ...
- TEB 、TIB、PEB--Vista 32
TEB struct TEB typedef struct _TEB { NT_TIB NtTib; PVOID EnvironmentPointer; CLIENT_ID ClientId; PVO ...
- KTHREAD 线程调度 SDT TEB SEH shellcode中DLL模块机制动态获取 《寒江独钓》内核学习笔记(5)
目录 . 相关阅读材料 . <加密与解密3> . [经典文章翻译]A_Crash_Course_on_the_Depths_of_Win32_Structured_Exception_Ha ...
- KTHREAD 线程调度 SDT TEB SEH shellcode中DLL模块机制动态
KTHREAD 线程调度 SDT TEB SEH shellcode中DLL模块机制动态获取 <寒江独钓>内核学习笔记(5) 继续我们的线程相关的数据结构的学习.接下来我们学习 KTH ...
- 从TEB到PEB再到SEH(二)
什么是SEH? SEH( Structured Exception Handling , 结构化异常处理 ) 结构化异常处理(SEH)是Windows操作系统提供的强大异常处理功能.而Visual C ...
- 从TEB到PEB再到SEH(一)
什么是TEB? TEB(Thread Environment Block,线程环境块) 线程环境块中存放着进程中所有线程的各种信息 这里我们了解到了TEB即为线程环境块, 进程中每一条线程都对应着的自 ...
- 【逆向篇】分析一段简单的ShellCode——从TEB到函数地址获取
其实分在逆向篇不太合适,因为并没有逆向什么程序. 在http://www.exploit-db.com/exploits/28996/上看到这么一段最简单的ShellCode,其中的技术也是比较常见的 ...
- linux windows 格式化一块大于2 TiB硬盘
转自:https://help.aliyun.com/document_detail/34377.html?spm=a2c4g.11186623.2.10.17447386JrLBNR#concept ...
- fs寄存器相关,PEB,TEB
---恢复内容开始--- FS寄存器指向:偏移 说明000 指向SEH链指针004 线程堆栈顶部008 线程堆栈底部00C SubSystemTib010 FiberData014 Arbitrary ...
随机推荐
- composer(作曲家)安装php-ml
刚开始我用的是up5.6版本php命令安装composer 后来使用composer时发现命令行会提示php版本太低 于是我下载了wamp,使用7.1版本的php重新安装了composer,因为php ...
- paper 15 :整理的CV代码合集
这篇blog,原来是西弗吉利亚大学的Li xin整理的,CV代码相当的全,不知道要经过多长时间的积累才会有这么丰富的资源,在此谢谢LI Xin .我现在分享给大家,希望可以共同进步!还有,我需要说一下 ...
- sqoop简介和原理分析
Sqoop简介 Sqoop是一款开源的工具,主要用于在Hadoop(Hive)与传统的数据库(mysql.postgresql...)间进行数据的传递,可以将一个关系型数据库(例如 : MySQL , ...
- kafka拦截器原理|案例实操
拦截器原理 Producer拦截器(interceptor)是在Kafka 0.10版本被引入的,主要用于实现clients端的定制化控制逻辑. 对于producer而言,interceptor使得用 ...
- 求树的最大独立集,最小点覆盖,最小支配集 贪心and树形dp
目录 求树的最大独立集,最小点覆盖,最小支配集 三个定义 贪心解法 树形DP解法 (有任何问题欢迎留言或私聊&&欢迎交流讨论哦 求树的最大独立集,最小点覆盖,最小支配集 三个定义 最大 ...
- C4D中python初探
use_name = input('请输入账号') password = input('请输入密码') if use_name == 'alex' and password == 'alex3714' ...
- 1-电脑C盘(系统盘)清理
推荐,亲测有效! 转自: https://baijiahao.baidu.com/s?id=1612762644229315967&wfr=spider&for=pc
- Number Sequence /// oj21456
题目大意: 有一组规律数 the first 80 digits of the sequence are as follows: 1 12 123 1234 12345 123456 1234567 ...
- iphone11系统输入框的光标位置不正常
本人的系统是11.3的是正常的,却发现测试机的11.1和11.2的光标位置在输入框的下边.百度一下,很多人有同样的问题,在此记录一下 解决办法一: //弹框弹出后执行如下代码 $('body').cs ...
- Java面试(2)
包含的模块 本文分为十九个模块,分别是: Java 基础.容器.多线程.反射.对象拷贝.Java Web .异常.网络.设计模式.Spring/Spring MVC.Spring Boot/Sprin ...