Wow64CurrentGuestTeb - NtDoc

#ifndef _NTWOW64_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#ifdef _M_X64

FORCEINLINE
TEB32*
POINTER_UNSIGNED
Wow64CurrentGuestTeb(
    VOID
    )
{
    TEB* POINTER_UNSIGNED Teb;
    TEB32* POINTER_UNSIGNED Teb32;

    Teb = NtCurrentTeb();

    if (Teb->WowTebOffset == 0)
    {
        //
        // Not running under or over WoW, so there is no "guest teb"
        //

        return NULL;
    }

    if (Teb->WowTebOffset < 0)
    {
        //
        // Was called while running under WoW. The current teb is the guest
        // teb.
        //

        Teb32 = (PTEB32)Teb;

        RTL_ASSERT(&Teb32->WowTebOffset == &Teb->WowTebOffset);
    }
    else
    {
        //
        // Called by the WoW Host, so calculate the position of the guest teb
        // relative to the current (host) teb.
        //

        Teb32 = (PTEB32)RtlOffsetToPointer(Teb, Teb->WowTebOffset);
    }

    RTL_ASSERT(Teb32->NtTib.Self == PtrToUlong(Teb32));

    return Teb32;
}

#endif
#endif
#endif
View code on GitHub