#ifndef _NTPSAPI_H
//
// User processes and threads
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// begin_rev
#define PS_ATTRIBUTE_TEB_ADDRESS \
PsAttributeValue(PsAttributeTebAddress, TRUE, FALSE, FALSE)
View code on GitHub
This attribute allows the caller to request the TEB
address of the new thread to be returned upon its creation.
Attribute
- PS_ATTRIBUTE_TEB_ADDRESS
(numeric value 0x10004
).Size
- sizeof(PVOID)
.ValuePtr
- a pointer to a PTEB
variable that receives the TEB
address of the new thread.TEB
PS_ATTRIBUTE_NUM
NtCurrentTeb