线程的TEB和进程的PEB结构

来源：互联网发布：caxa编程平面铣编辑：程序博客网时间：2024/05/16 01:29

TEB：Thread Environment Block ，它记录的相关线程的信息，每一个线程都有自己的TEB，每个TEB都有自己的TIB（Thread Information Block）,即线程信息块

PEB:Process Environment Block

代码：

#include "windows.h"#include "stdio.h"int main(void){LPSTR name;LPINT pid;__asm{mov ecx,fs:[0x20]mov pid,ecxmov eax,fs:[0x18]      //TEB的地址mov eax,[eax+0x30]    //PEB结构地址mov eax,[eax+0xc]    //_PEB_LDR_DATAmov eax,[eax+0xc]    //LIST_ENTRY InLoadOrderModuleListmov eax,[eax+0x28]   //BaseDllNamemov name,eax}wprintf(L"%s:%d\n",name,pid);return 0;}

FS各偏移说明如下：

FS:[000] 指向SEH链指针
FS:[004]  线程堆栈顶部
FS:[008] 线程堆栈底部
FS:[00C]  SubSystemTib
FS:[010]  FiberData
FS:[014] ArbitraryUserPointer
FS:[018]  指向TEB自身
FS:[020] 进程PID
FS:[024] 线程ID
FS:[02C] 指向线程局部存储指针
FS:[030] PEB结构地址（进程结构）
FS:[034] 上个错误号

TEB结构：

+0x000 NtTib          : _NT_TIB
+0x01c EnvironmentPointer : Ptr32 Void
+0x020 ClientId       : _CLIENT_ID
+0x028 ActiveRpcHandle  : Ptr32 Void
+0x02c ThreadLocalStoragePointer : Ptr32 Void
+0x030 ProcessEnvironmentBlock : Ptr32 _PEB
+0x034 LastErrorValue : Uint4B
+0x038 CountOfOwnedCriticalSections : Uint4B
+0x03c CsrClientThread  : Ptr32 Void
+0x040 Win32ThreadInfo  : Ptr32 Void
+0x044 User32Reserved : [26] Uint4B
+0x0ac UserReserved    : [5] Uint4B
+0x0c0 WOW32Reserved : Ptr32 Void
+0x0c4 CurrentLocale : Uint4B
+0x0c8 FpSoftwareStatusRegister : Uint4B
+0x0cc SystemReserved1  : [54] Ptr32 Void
+0x1a4 ExceptionCode : Int4B
+0x1a8 ActivationContextStack : _ACTIVATION_CONTEXT_STACK
+0x1bc SpareBytes1    : [24] UChar
+0x1d4 GdiTebBatch    : _GDI_TEB_BATCH
+0x6b4 RealClientId    : _CLIENT_ID
+0x6bc GdiCachedProcessHandle : Ptr32 Void
+0x6c0 GdiClientPID    : Uint4B
+0x6c4 GdiClientTID    : Uint4B
+0x6c8 GdiThreadLocalInfo : Ptr32 Void
+0x6cc Win32ClientInfo  : [62] Uint4B
+0x7c4 glDispatchTable  : [233] Ptr32 Void
+0xb68 glReserved1    : [29] Uint4B
+0xbdc glReserved2    : Ptr32 Void
+0xbe0 glSectionInfo : Ptr32 Void
+0xbe4 glSection       : Ptr32 Void
+0xbe8 glTable       : Ptr32 Void
+0xbec glCurrentRC    : Ptr32 Void
+0xbf0 glContext       : Ptr32 Void
+0xbf4 LastStatusValue  : Uint4B
+0xbf8 StaticUnicodeString : _UNICODE_STRING
+0xc00 StaticUnicodeBuffer : [261] Uint2B
+0xe0c DeallocationStack : Ptr32 Void
+0xe10 TlsSlots       : [64] Ptr32 Void
+0xf10 TlsLinks       : _LIST_ENTRY
+0xf18 Vdm             : Ptr32 Void
+0xf1c ReservedForNtRpc : Ptr32 Void
+0xf20 DbgSsReserved : [2] Ptr32 Void
+0xf28 HardErrorsAreDisabled : Uint4B
+0xf2c Instrumentation  : [16] Ptr32 Void
+0xf6c WinSockData    : Ptr32 Void
+0xf70 GdiBatchCount : Uint4B
+0xf74 InDbgPrint    : UChar
+0xf75 FreeStackOnTermination : UChar
+0xf76 HasFiberData    : UChar
+0xf77 IdealProcessor : UChar
+0xf78 Spare3          : Uint4B
+0xf7c ReservedForPerf  : Ptr32 Void
+0xf80 ReservedForOle : Ptr32 Void
+0xf84 WaitingOnLoaderLock : Uint4B
+0xf88 Wx86Thread    : _Wx86ThreadState
+0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void
+0xf98 ImpersonationLocale : Uint4B
+0xf9c IsImpersonating  : Uint4B
+0xfa0 NlsCache       : Ptr32 Void
+0xfa4 pShimData       : Ptr32 Void
+0xfa8 HeapVirtualAffinity : Uint4B
+0xfac CurrentTransactionHandle : Ptr32 Void
+0xfb0 ActiveFrame    : Ptr32 _TEB_ACTIVE_FRAME
+0xfb4 SafeThunkCall : UChar
+0xfb5 BooleanSpare    : [3] UChar

PEB结构：

typedef struct _PEB {             // Size: 0x1D8
000h UCHAR          InheritedAddressSpace;
001h UCHAR          ReadImageFileExecOptions;
002h UCHAR          BeingDebugged;             //Debug运行标志
003h UCHAR          SpareBool;
004h HANDLE       Mutant;
008h HINSTANCE    ImageBaseAddress;          //程序加载的基地址
00Ch struct _PEB_LDR_DATA *Ldr             //Ptr32 _PEB_LDR_DATA
010h struct _RTL_USER_PROCESS_PARAMETERS  *ProcessParameters;
014h ULONG          SubSystemData;
018h HANDLE       DefaultHeap;
01Ch KSPIN_LOCK    FastPebLock;
020h ULONG          FastPebLockRoutine;
024h ULONG          FastPebUnlockRoutine;
028h ULONG          EnvironmentUpdateCount;
02Ch ULONG          KernelCallbackTable;
030h LARGE_INTEGER SystemReserved;
038h struct _PEB_FREE_BLOCK  *FreeList
03Ch ULONG          TlsExpansionCounter;
040h ULONG          TlsBitmap;
044h LARGE_INTEGER TlsBitmapBits;
04Ch ULONG          ReadOnlySharedMemoryBase;
050h ULONG          ReadOnlySharedMemoryHeap;
054h ULONG          ReadOnlyStaticServerData;
058h ULONG          AnsiCodePageData;
05Ch ULONG          OemCodePageData;
060h ULONG          UnicodeCaseTableData;
064h ULONG          NumberOfProcessors;
068h LARGE_INTEGER NtGlobalFlag;             // Address of a local copy
070h LARGE_INTEGER CriticalSectionTimeout;
078h ULONG          HeapSegmentReserve;
07Ch ULONG          HeapSegmentCommit;
080h ULONG          HeapDeCommitTotalFreeThreshold;
084h ULONG          HeapDeCommitFreeBlockThreshold;
088h ULONG          NumberOfHeaps;
08Ch ULONG          MaximumNumberOfHeaps;
090h ULONG          ProcessHeaps;
094h ULONG          GdiSharedHandleTable;
098h ULONG          ProcessStarterHelper;
09Ch ULONG          GdiDCAttributeList;
0A0h KSPIN_LOCK    LoaderLock;
0A4h ULONG          OSMajorVersion;
0A8h ULONG          OSMinorVersion;
0ACh USHORT       OSBuildNumber;
0AEh USHORT       OSCSDVersion;
0B0h ULONG          OSPlatformId;
0B4h ULONG          ImageSubsystem;
0B8h ULONG          ImageSubsystemMajorVersion;
0BCh ULONG          ImageSubsystemMinorVersion;
0C0h ULONG          ImageProcessAffinityMask;
0C4h ULONG          GdiHandleBuffer[0x22];
14Ch ULONG          PostProcessInitRoutine;
150h ULONG          TlsExpansionBitmap;
154h UCHAR          TlsExpansionBitmapBits[0x80];
1D4h ULONG          SessionId;
} PEB, *PPEB;

_PEB_LDR_DATA结构：

typedef struct _PEB_LDR_DATA
{
　ULONG       Length;                            // 00h
　BOOLEAN    Initialized;                      // 04h
　PVOID       SsHandle;                         // 08h
　LIST_ENTRY InLoadOrderModuleList;             // 0ch
　LIST_ENTRY InMemoryOrderModuleList;          // 14h
　LIST_ENTRY InInitializationOrderModuleList; // 1ch
}

_LDR_DATA_TABLE_ENTRY 结构：

+0x000 InLoadOrderLinks : _LIST_ENTRY
  +0x008 InMemoryOrderLinks : _LIST_ENTRY
  +0x010 InInitializationOrderLinks : _LIST_ENTRY
  +0x018 DllBase       : Ptr32 Void
  +0x01c EntryPoint    : Ptr32 Void
  +0x020 SizeOfImage    : Uint4B
  +0x024 FullDllName    : _UNICODE_STRING
  +0x02c BaseDllName    : _UNICODE_STRING
  +0x034 Flags          : Uint4B
  +0x038 LoadCount       : Uint2B
  +0x03a TlsIndex       : Uint2B
  +0x03c HashLinks       : _LIST_ENTRY
  +0x03c SectionPointer  : Ptr32 Void
  +0x040 CheckSum       : Uint4B
  +0x044 TimeDateStamp : Uint4B
  +0x044 LoadedImports : Ptr32 Void
  +0x048 EntryPointActivationContext : Ptr32 Void
  +0x04c PatchInformation : Ptr32 Void

typedef struct _UNICODE_STRING {
  USHORT  Length;    //UNICODE占用的内存字节数，个数*2；
  USHORT  MaximumLength;
  PWSTR  Buffer;
} UNICODE_STRING ,*PUNICODE_STRING;

0 0