TIB --- FS

转载自： http://en.wikipedia.org/wiki/Win32_Thread_Information_Block

Contents of the TIB[edit]

PositionLengthWindows VersionsDescriptionFS:[0x00]4Win9x and NTCurrent Structured Exception Handling (SEH) frameFS:[0x04]4Win9x and NTTop of stackFS:[0x08]4Win9x and NTCurrent bottom of stackFS:[0x0C]4 Unknown - TIB Subsystem?FS:[0x10]4NTFiber dataFS:[0x14]4Win9x and NTArbitrary data slotFS:[0x18]4Win9x and NTLinear address of TIB---- End of NT subsystem independent part ----FS:[0x1C]4NTEnvironment PointerFS:[0x20]4NTProcess ID (in some windows distributions this field is used as 'DebugContext')FS:[0x24]4NTCurrent thread IDFS:[0x28]4NTActive RPC HandleFS:[0x2C]4Win9x and NTLinear address of the thread-local storage arrayFS:[0x30]4NTLinear address of Process Environment Block (PEB)FS:[0x34]4NTLast error numberFS:[0x38]4NTCount of owned critical sectionsFS:[0x3C]4NTAddress of CSR Client ThreadFS:[0x40]4NTWin32 Thread InformationFS:[0x44]124NT, WineWin32 client information (NT), user32 private data (Wine), 0x60 = LastError (Win95), 0x74 = LastError (WinME)FS:[0xC0]4NTReserved for Wow64. Contains a pointer to FastSysCall in Wow64.FS:[0xC4]4NTCurrent LocaleFS:[0xC8]4NTFP Software Status RegisterFS:[0xCC]216NT, WineReserved for OS (NT), kernel32 private data (Wine)

herein: FS:[0x124] 4 NT Pointer to KTHREAD (ETHREAD) structure

FS:[0x1A4]4NTException codeFS:[0x1A8]18NTActivation context stackFS:[0x1BC]24NT, WineSpare bytes (NT), ntdll private data (Wine)FS:[0x1D4]40NT, WineReserved for OS (NT), ntdll private data (Wine)FS:[0x1FC]1248NT, WineGDI TEB Batch (OS), vm86 private data (Wine)FS:[0x6DC]4NTGDI RegionFS:[0x6E0]4NTGDI PenFS:[0x6E4]4NTGDI BrushFS:[0x6E8]4NTReal Process IDFS:[0x6EC]4NTReal Thread IDFS:[0x6F0]4NTGDI cached process handleFS:[0x6F4]4NTGDI client process ID (PID)FS:[0x6F8]4NTGDI client thread ID (TID)FS:[0x6FC]4NTGDI thread locale informationFS:[0x700]20NTReserved for user applicationFS:[0x714]1248NTReserved for GLFS:[0xBF4]4NTLast Status ValueFS:[0xBF8]532NTStatic UNICODE_STRING bufferFS:[0xE0C]4NTPointer to deallocation stackFS:[0xE10]256NTTLS slots, 4 byte per slotFS:[0xF10]8NTTLS links (LIST_ENTRY structure)FS:[0xF18]4NTVDMFS:[0xF1C]4NTReserved for RPCFS:[0xF28]4NTThread error mode (RtlSetThreadErrorMode)