https://en.wikipedia.org/wiki/Win32_Thread_Information_Block

这是重点

Position Length Windows Versions Description
FS:[0x00] 4 Win9x and NT Current Structured Exception Handling (SEH) frame
FS:[0x04] 4 Win9x and NT Stack Base / Bottom of stack (high address)
FS:[0x08] 4 Win9x and NT Stack Limit / Ceiling of stack (low address)
FS:[0x0C] 4 NT SubSystemTib
FS:[0x10] 4 NT Fiber data
FS:[0x14] 4 Win9x and NT Arbitrary data slot
FS:[0x18] 4 Win9x and NT Linear address of TEB
---- End of NT subsystem independent part ----
FS:[0x1C] 4 NT Environment Pointer
FS:[0x20] 4 NT Process ID (in some windows distributions this field is used as 'DebugContext')
FS:[0x24] 4 NT Current thread ID
FS:[0x28] 4 NT Active RPC Handle
FS:[0x2C] 4 Win9x and NT Linear address of the thread-local storage array
FS:[0x30] 4 NT Linear address of Process Environment Block (PEB)
FS:[0x34] 4 NT Last error number
FS:[0x38] 4 NT Count of owned critical sections
FS:[0x3C] 4 NT Address of CSR Client Thread
FS:[0x40] 4 NT Win32 Thread Information
FS:[0x44] 124 NT, Wine Win32 client information (NT), user32 private data (Wine), 0x60 = LastError (Win95), 0x74 = LastError (WinME)
FS:[0xC0] 4 NT Reserved for Wow64. Contains a pointer to FastSysCall in Wow64.
FS:[0xC4] 4 NT Current Locale
FS:[0xC8] 4 NT FP Software Status Register
FS:[0xCC] 216 NT, Wine Reserved for OS (NT), kernel32 private data (Wine)

herein: FS:[0x124] 4 NT Pointer to KTHREAD (ETHREAD) structure
FS:[0x1A4] 4 NT Exception code
FS:[0x1A8] 18 NT Activation context stack
FS:[0x1BC] 24 NT, Wine Spare bytes (NT), ntdll private data (Wine)
FS:[0x1D4] 40 NT, Wine Reserved for OS (NT), ntdll private data (Wine)
FS:[0x1FC] 1248 NT, Wine GDI TEB Batch (OS), vm86 private data (Wine)
FS:[0x6DC] 4 NT GDI Region
FS:[0x6E0] 4 NT GDI Pen
FS:[0x6E4] 4 NT GDI Brush
FS:[0x6E8] 4 NT Real Process ID
FS:[0x6EC] 4 NT Real Thread ID
FS:[0x6F0] 4 NT GDI cached process handle
FS:[0x6F4] 4 NT GDI client process ID (PID)
FS:[0x6F8] 4 NT GDI client thread ID (TID)
FS:[0x6FC] 4 NT GDI thread locale information
FS:[0x700] 20 NT Reserved for user application
FS:[0x714] 1248 NT Reserved for GL
FS:[0xBF4] 4 NT Last Status Value
FS:[0xBF8] 532 NT Static UNICODE_STRING buffer
FS:[0xE0C] 4 NT Pointer to deallocation stack
FS:[0xE10] 256 NT TLS slots, 4 byte per slot
FS:[0xF10] 8 NT TLS links (LIST_ENTRY structure)
FS:[0xF18] 4 NT VDM
FS:[0xF1C] 4 NT Reserved for RPC
FS:[0xF28] 4 NT Thread error mode (RtlSetThreadErrorMode)

TIB、TEB 信息的更多相关文章

  1. java笔记整理

    Java 笔记整理 包含内容     Unix Java 基础, 数据库(Oracle jdbc Hibernate pl/sql), web, JSP, Struts, Ajax Spring, E ...

  2. TEB 、TIB、PEB--Vista 32

    TEB struct TEB typedef struct _TEB { NT_TIB NtTib; PVOID EnvironmentPointer; CLIENT_ID ClientId; PVO ...

  3. KTHREAD 线程调度 SDT TEB SEH shellcode中DLL模块机制动态获取 《寒江独钓》内核学习笔记（5）

    目录 . 相关阅读材料 . <加密与解密3> . [经典文章翻译]A_Crash_Course_on_the_Depths_of_Win32_Structured_Exception_Ha ...

  4. KTHREAD 线程调度 SDT TEB SEH shellcode中DLL模块机制动态

    KTHREAD 线程调度 SDT TEB SEH shellcode中DLL模块机制动态获取 <寒江独钓>内核学习笔记(5)   继续我们的线程相关的数据结构的学习.接下来我们学习 KTH ...

  5. 从TEB到PEB再到SEH（二）

    什么是SEH? SEH( Structured Exception Handling , 结构化异常处理 ) 结构化异常处理(SEH)是Windows操作系统提供的强大异常处理功能.而Visual C ...

  6. 从TEB到PEB再到SEH（一）

    什么是TEB? TEB(Thread Environment Block,线程环境块) 线程环境块中存放着进程中所有线程的各种信息 这里我们了解到了TEB即为线程环境块, 进程中每一条线程都对应着的自 ...

  7. 【逆向篇】分析一段简单的ShellCode——从TEB到函数地址获取

    其实分在逆向篇不太合适,因为并没有逆向什么程序. 在http://www.exploit-db.com/exploits/28996/上看到这么一段最简单的ShellCode,其中的技术也是比较常见的 ...

  8. linux windows 格式化一块大于2 TiB硬盘

    转自:https://help.aliyun.com/document_detail/34377.html?spm=a2c4g.11186623.2.10.17447386JrLBNR#concept ...

  9. fs寄存器相关，PEB，TEB

    ---恢复内容开始--- FS寄存器指向:偏移 说明000 指向SEH链指针004 线程堆栈顶部008 线程堆栈底部00C SubSystemTib010 FiberData014 Arbitrary ...

随机推荐

  1. [JZOJ 5817] 抄代码

    题意: 给定2T个串,带修的判断两个串是否按规则一样?? 思路: 两个串是"抄袭的"肯定就是: 1.长度一样. 2.特殊字符位置一样 3.对于每个\(x\)在两个串中出现位置一样, ...

  2. 最常见VC++编译错误信息集合

    1.fatal error C1010: unexpected end of file while looking for precompiled header directive. 寻找预编译头文件 ...

  3. c# 将byte数组保存成图片

    将byte数组保存成图片: 方式一:System.IO.File.WriteAllBytes(@"c:\test.jpg", bytes); 方式二:MemoryStream ms ...

  4. 2、http请求与http响应

    我们在接口测试过程中,可能会用http协议,webservice协议,当然用的较多的还是http协议,webservice协议在此不做过多介绍,我们先了解一下http协议,然后重点介绍http请求与响 ...

  5. RHEL7更换yum源

    1,删除注册和订阅提示 查找subscription-manager相关组件: rpm -qa | grep subscription-manager 删除subscription-maanager相 ...

  6. 【HDUOJ】1213 How many tables

    题目链接:http://acm.hdu.edu.cn/showproblem.php?pid=1213 题意:Ignatius邀请了n个朋友来家里,朋友之间如果互相不认识的不想坐一起,所以至少要准备几 ...

  7. 【POJ】2236 Wireless Network

    题目链接:http://poj.org/problem?id=2236 题意:给你n台计算机的坐标.d是可通信的最大距离.有两个操作. 1.O p 表示修复计算机p. 2.S p q表示询问pq是否能 ...

  8. SpringMVC向前台传输 JSON数据

    所需Jar包jackson-core.jackson-annotations和jackson-databind 在MVC的配置文件中加入<mvc:annotation-driven>< ...

  9. opencv remap 函数

    remap 查看:https://blog.csdn.net/yangfengman/article/details/52769716 remap 其实就是一个坐标到另一个坐标的映射,比如经常用在鱼眼 ...

  10. Hive中SQL查询转换成MapReduce作业的过程