Introduction
Win32 TIB (Thread Information Block) is a data struct in wins32 on x86 that stores info about the currently running thread.
If you have a Process Explorer type application, you can use TIB instead of using APIs to get the thread and process information.
The TIB can be used to get a lot of information on the process without calling win32 API. Examples include emulating GetLastError(), GetVersion(). Through the pointer to the PEB one can obtain access to the import tables (IAT), process startup arguments, image name, etc.
How to access TIB
The TIB can be accessed as an offset of segment register FS.FS is the data selector to TIB for the first thread.
FS maps to a TIB which is embedded in a data block known as the TDB (thread data base). The TIB contains the thread-specific exception handling chain and pointer to the TLS (thread local storage.) The thread local storage is not the same as C local storage.
Contents of TIB :
| Position<o:p>
| Windows
Ver.<o:p>
| Description<o:p>
|
| FS:[0x00]<o:p>
| Win9x and NT<o:p>
| Current Structured Exception
Handling (SEH) frame<o:p>
|
| FS:[0x04]<o:p>
| Win9x and NT<o:p>
| <o:p>
|
| FS:[0x08]<o:p>
| Win9x and NT<o:p>
| Current bottom of stack<o:p>
|
| FS:[0x10]<o:p>
| NT<o:p>
| Fiber data<o:p>
|
| FS:[0x14]<o:p>
| Win9x and NT<o:p>
| Arbitrary data slot<o:p>
|
| FS:[0x18]<o:p>
| Win9x and NT<o:p>
| Linear address of TIB<o:p>
|
| FS:[0x1C]<o:p>
| NT<o:p>
| Environment Pointer<o:p>
|
| FS:[0x20]<o:p>
| NT<o:p>
| Process ID<o:p>
|
| FS:[0x24]<o:p>
| NT<o:p>
| Current thread ID<o:p>
|
| FS:[0x28]<o:p>
| NT<o:p>
| Active RPC Handle<o:p>
|
| FS:[0x2C]<o:p>
| Win9x and NT<o:p>
| Linear address of the thread-local storage array<o:p>
|
| FS:[0x30]<o:p>
| NT<o:p>
| Linear address of Process
Environment Block (PEB)<o:p>
|
| FS:[0x34]<o:p>
| NT<o:p>
| Last error number<o:p>
|
| FS:[0x38]<o:p>
| NT<o:p>
| Count of owned critical sections<o:p>
|
| FS:[0x3C]<o:p>
| NT<o:p>
| Address of CSR Client Thread<o:p>
|
| FS:[0x40]<o:p>
| NT<o:p>
| Win32 Thread Information<o:p>
|
| FS:[0x44]<o:p>
| NT<o:p>
| Win32 client information (NT), user32
private data , 0x60 = LastError (Win95), 0x74 = LastError (WinME)<o:p>
|
| FS:[0xC0]<o:p>
| NT<o:p>
| Reserved for Wow32<o:p>
|
| FS:[0xC4]<o:p>
| NT<o:p>
| Current Locale<o:p>
|
| FS:[0xC8]<o:p>
| NT<o:p>
| FP Software Status Register<o:p>
|
| FS:[0xCC]<o:p>
| NT<o:p>
| Reserved for OS (NT), kernel32 private
data <o:p>
|
| FS:[0x124]<o:p>
| NT<o:p>
| Pointer to KTHREAD (ETHREAD) structure<o:p>
|
| FS:[0x1A4]<o:p>
| NT<o:p>
| Exception code<o:p>
|
| FS:[0x1A8]<o:p>
| NT<o:p>
| Activation context stack<o:p>
|
| FS:[0x1BC]<o:p>
| NT<o:p>
| Spare bytes (NT), ntdll private data<o:p>
|
| FS:[0x1D4]<o:p>
| NT<o:p>
| Reserved for OS (NT), ntdll private data<o:p>
|
| FS:[0x1FC]<o:p>
| NT<o:p>
| GDI TEB Batch (OS), vm86 private data<o:p>
|
| FS:[0x6DC]<o:p>
| NT<o:p>
| GDI Region<o:p>
|
| FS:[0x6E0]<o:p>
| NT<o:p>
| GDI Pen<o:p>
|
| FS:[0x6E4]<o:p>
| NT<o:p>
| GDI Brush<o:p>
|
| FS:[0x6E8]<o:p>
| NT<o:p>
| Real Process ID<o:p>
|
| FS:[0x6EC]<o:p>
| NT<o:p>
| Real Thread ID<o:p>
|
| FS:[0x6F0]<o:p>
| NT<o:p>
| GDI cached process handle<o:p>
|
| FS:[0x6F4]<o:p>
| NT<o:p>
| GDI client process ID (PID)<o:p>
|
| FS:[0x6F8]<o:p>
| NT<o:p>
| GDI client thread ID (TID)<o:p>
|
| FS:[0x6FC]<o:p>
| NT<o:p>
| GDI thread locale information<o:p>
|
| FS:[0x700]<o:p>
| NT<o:p>
| Reserved for user application<o:p>
|
| FS:[0x714]<o:p>
| NT<o:p>
| Reserved for GL<o:p>
|
| FS:[0xBF4]<o:p>
| NT<o:p>
| Last Status Value<o:p>
|
| FS:[0xBF8]<o:p>
| NT<o:p>
| Reserved for advapi32<o:p>
|
| FS:[0xE0C]<o:p>
| NT<o:p>
| Pointer to deallocation stack<o:p>
|
| FS:[0xE10]<o:p>
| NT<o:p>
| TLS slots, 4 byte per slot<o:p>
|
| FS:[0xF10]<o:p>
| NT<o:p>
| TLS links (LIST_ENTRY structure)<o:p>
|
| FS:[0xF18]<o:p>
| NT<o:p>
| VDM<o:p>
|
| FS:[0xF1C]<o:p>
| NT<o:p>
| Reserved for RPC<o:p>
|
Sample Code
void *pTIB;
__asm
{
mov EAX,FS:[20h]
mov [pTIB],EAX
}
EAX – is a CPU Register (Accumulator
Register).<o:p>
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
