#ifndef _NTPEBTEB_H
/**
* Thread Environment Block (TEB) structure.
*
* \remarks https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
*/
typedef struct _TEB
{
//
// Thread Information Block (TIB) contains the thread's stack, base and limit addresses, the current stack pointer, and the exception list.
//
NT_TIB NtTib;
//
// Reserved.
//
PVOID EnvironmentPointer;
//
// Client ID for this thread.
//
CLIENT_ID ClientId;
//
// A handle to an active Remote Procedure Call (RPC) if the thread is currently involved in an RPC operation.
//
PVOID ActiveRpcHandle;
//
// A pointer to the __declspec(thread) local storage array.
//
PVOID ThreadLocalStoragePointer;
//
// A pointer to the Process Environment Block (PEB), which contains information about the process.
//
PPEB ProcessEnvironmentBlock;
//
// The previous Win32 error value for this thread.
//
ULONG LastErrorValue;
//
// The number of critical sections currently owned by this thread.
//
ULONG CountOfOwnedCriticalSections;
//
// Reserved.
//
PVOID CsrClientThread;
//
// Reserved.
//
PVOID Win32ThreadInfo;
//
// Reserved.
//
ULONG User32Reserved[26];
//
// Reserved.
//
ULONG UserReserved[5];
//
// Reserved.
//
PVOID WOW32Reserved;
//
// The LCID of the current thread. (Kernel32!GetThreadLocale)
//
LCID CurrentLocale;
//
// Reserved.
//
ULONG FpSoftwareStatusRegister;
//
// Reserved.
//
PVOID ReservedForDebuggerInstrumentation[16];
#ifdef _WIN64
//
// Reserved.
//
PVOID SystemReserved1[25];
//
// Per-thread fiber local storage. (Teb->HasFiberData)
//
PVOID HeapFlsData;
//
// Reserved.
//
ULONG_PTR RngState[4];
#else
//
// Reserved.
//
PVOID SystemReserved1[26];
#endif
//
// Placeholder compatibility mode. (ProjFs and Cloud Files)
//
CHAR PlaceholderCompatibilityMode;
//
// Indicates whether placeholder hydration is always explicit.
//
BOOLEAN PlaceholderHydrationAlwaysExplicit;
//
// Reserved.
//
CHAR PlaceholderReserved[10];
//
// The process ID (PID) that the current COM server thread is acting on behalf of.
//
ULONG ProxiedProcessId;
//
// Pointer to the activation context stack for the current thread.
//
ACTIVATION_CONTEXT_STACK ActivationStack;
//
// Opaque operation on behalf of another user or process.
//
UCHAR WorkingOnBehalfTicket[8];
//
// The last exception status for the current thread.
//
NTSTATUS ExceptionCode;
//
// Pointer to the activation context stack for the current thread.
//
PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
//
// The stack pointer (SP) of the current system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackSp;
//
// The program counter (PC) of the previous system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackPreviousPc;
//
// The stack pointer (SP) of the previous system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackPreviousSp;
#ifdef _WIN64
//
// The miniversion ID of the current transacted file operation.
//
ULONG TxFsContext;
#endif
//
// Indicates the state of the system call or exception instrumentation callback.
//
BOOLEAN InstrumentationCallbackDisabled;
#ifdef _WIN64
//
// Indicates the state of alignment exceptions for unaligned load/store operations.
//
BOOLEAN UnalignedLoadStoreExceptions;
#endif
#ifndef _WIN64
//
// SpareBytes.
//
UCHAR SpareBytes[23];
//
// The miniversion ID of the current transacted file operation.
//
ULONG TxFsContext;
#endif
//
// Reserved for GDI.
//
GDI_TEB_BATCH GdiTebBatch;
CLIENT_ID RealClientId;
HANDLE GdiCachedProcessHandle;
ULONG GdiClientPID;
ULONG GdiClientTID;
PVOID GdiThreadLocalInfo;
//
// Reserved for User32.
//
ULONG_PTR Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH];
//
// Reserved for opengl32.dll
//
PVOID glDispatchTable[233];
ULONG_PTR glReserved1[29];
PVOID glReserved2;
PVOID glSectionInfo;
PVOID glSection;
PVOID glTable;
PVOID glCurrentRC;
PVOID glContext;
//
// The previous status value for this thread.
//
NTSTATUS LastStatusValue;
//
// A static string for use by the application.
//
UNICODE_STRING StaticUnicodeString;
//
// A static buffer for use by the application.
//
WCHAR StaticUnicodeBuffer[STATIC_UNICODE_BUFFER_LENGTH];
//
// The maximum stack size and indicates the base of the stack.
//
PVOID DeallocationStack;
//
// Data for Thread Local Storage. (TlsGetValue)
//
PVOID TlsSlots[TLS_MINIMUM_AVAILABLE];
//
// Reserved.
//
LIST_ENTRY TlsLinks;
//
// Reserved for NTVDM.
//
PVOID Vdm;
//
// Reserved.
//
PVOID ReservedForNtRpc;
//
// Reserved.
//
PVOID DbgSsReserved[2];
//
// The error mode for the current thread. (GetThreadErrorMode)
//
ULONG HardErrorMode;
//
// Reserved.
//
#ifdef _WIN64
PVOID Instrumentation[11];
#else
PVOID Instrumentation[9];
#endif
//
// Reserved.
//
GUID ActivityId;
//
// The service creating the thread (svchost).
//
PVOID SubProcessTag;
//
// Reserved.
//
PVOID PerflibData;
//
// Reserved.
//
PVOID EtwTraceData;
//
// The address of a socket handle during a blocking socket operation. (WSAStartup)
//
HANDLE WinSockData;
//
// The number of function calls accumulated in the current GDI batch. (GdiSetBatchLimit)
//
ULONG GdiBatchCount;
//
// The preferred processor for the curremt thread. (SetThreadIdealProcessor/SetThreadIdealProcessorEx)
//
union
{
PROCESSOR_NUMBER CurrentIdealProcessor;
ULONG IdealProcessorValue;
struct
{
UCHAR ReservedPad0;
UCHAR ReservedPad1;
UCHAR ReservedPad2;
UCHAR IdealProcessor;
};
};
//
// The minimum size of the stack available during any stack overflow exceptions. (SetThreadStackGuarantee)
//
ULONG GuaranteedStackBytes;
//
// Reserved.
//
PVOID ReservedForPerf;
//
// tagSOleTlsData.
//
PVOID ReservedForOle;
ULONG WaitingOnLoaderLock;
PVOID SavedPriorityState;
ULONG_PTR ReservedForCodeCoverage;
PVOID ThreadPoolData;
PVOID *TlsExpansionSlots;
#ifdef _WIN64
PVOID ChpeV2CpuAreaInfo; // CHPEV2_CPUAREA_INFO // previously DeallocationBStore
PVOID Unused; // previously BStoreLimit
#endif
ULONG MuiGeneration;
ULONG IsImpersonating;
PVOID NlsCache;
PVOID pShimData;
ULONG HeapData;
HANDLE CurrentTransactionHandle;
PTEB_ACTIVE_FRAME ActiveFrame;
//
// Reserved for FLS (RtlProcessFlsData).
//
PVOID FlsData;
PVOID PreferredLanguages;
PVOID UserPrefLanguages;
PVOID MergedPrefLanguages;
ULONG MuiImpersonation;
union
{
USHORT CrossTebFlags;
USHORT SpareCrossTebBits : 16;
};
union
{
USHORT SameTebFlags;
struct
{
USHORT SafeThunkCall : 1;
USHORT InDebugPrint : 1;
USHORT HasFiberData : 1;
USHORT SkipThreadAttach : 1;
USHORT WerInShipAssertCode : 1;
USHORT RanProcessInit : 1;
USHORT ClonedThread : 1;
USHORT SuppressDebugMsg : 1;
USHORT DisableUserStackWalk : 1;
USHORT RtlExceptionAttached : 1;
USHORT InitialThread : 1;
USHORT SessionAware : 1;
USHORT LoadOwner : 1;
USHORT LoaderWorker : 1;
USHORT SkipLoaderInit : 1;
USHORT SkipFileAPIBrokering : 1;
};
};
PVOID TxnScopeEnterCallback;
PVOID TxnScopeExitCallback;
PVOID TxnScopeContext;
ULONG LockCount;
LONG WowTebOffset;
PVOID ResourceRetValue;
PVOID ReservedForWdf;
ULONGLONG ReservedForCrt;
GUID EffectiveContainerId;
ULONGLONG LastSleepCounter; // Win11
ULONG SpinCallCount;
ULONGLONG ExtendedFeatureDisableMask;
PVOID SchedulerSharedDataSlot; // 24H2
PVOID HeapWalkContext;
GROUP_AFFINITY PrimaryGroupAffinity;
ULONG Rcu[2];
} TEB, *PTEB;
View code on GitHub
This structure is documented in Windows SDK.
Structure TEB
(Thread Environment Block) is memory block containing system variables placed in User-Mode memory. Every created thread have own TEB
block. User can get address of TEB
by call NtCurrentTeb
function.
Structure NT_TIB
is available in <WinNT.h> header file.
Pointer to PEB
structure contains Process Environment Block.
NtCurrentTeb
PEB
THREAD_BASIC_INFORMATION