1. Contents of the TIB on Windows

2. Accessing the TIB

3. See also

4. References

5. Further reading

6. External links

In computing, the Win32 Thread Information Block (TIB) is a data structure in Win32 on x86 that stores information about the currently running thread. This structure is also known as the Thread Environment Block (TEB).

The TIB is officially undocumented for Windows 9x. The Windows NT series DDK includes a struct NT_TIB in winnt.h that documents the subsystem independent part. Wine includes [https://github.com/wine-mirror/wine/blob/d744f367d263a131feee96e103fb8220e8400b53/include/winternl.h#L347 header declarations] for the extended (subsystem-specific part of) TIB. Yet so many Win32 programs use these undocumented fields that they are effectively a part of the API. The first field, in particular, is directly referenced by the code produced by Microsoft's own compiler.

The TIB can be used to get a lot of information on the process without calling Win32 API. Examples include emulating GetLastError(), GetVersion(). Through the pointer to the PEB one can obtain access to the import tables (IAT), process startup arguments, image name, etc. It is accessed from the FS segment register when operating on 32 bits, and from GS in 64 bits.

Contents of the TIB on Windows

FS maps to a TIB which is embedded in a data block known as the TDB (thread data base). The TIB contains the thread-specific exception handling chain and pointer to the TLS (thread local storage.) The thread local storage is not the same as C local storage.

Note: The above description ONLY refers to 32-bit Windows on x86. On x86-64 (64-bit) Windows, GS (and not FS) is used as the segment register that points to the TIB. Additionally some of the variable slots in the structure above have a different size (typically 8 instead of 4 bytes for pointer-sized data slots).

Accessing the TIB

The TIB of the current thread can be accessed as an offset of segment register FS (x86) or GS (x64).

It is not common to access the TIB fields by an offset from FS:[0], but rather first getting a linear self-referencing pointer to it stored at FS:[0x18]. That pointer can be used with pointer arithmetics or be cast to a struct pointer.

Example in C inlined-assembly for 32-bit x86:

// gcc (AT&T-style inline assembly).

void *getTIB() {

    void *pTIB;    __asm__("movl %%fs:0x18, %0" : "=r" (pTIB) : : );    return pTIB;

}

// Microsoft C

__declspec(naked)

void *getTIB() {

}

// Using Microsoft's intrinsics instead of inline assembly (works for both X86 and X64 architectures)

void *getTIB() {

1. ifdef _M_IX86
2. elif _M_AMD64
3. endif

}

See also

• Structured Exception Handling

References

Further reading

• {{cite book|url=http://cs.mipt.ru/docs/comp/eng/os/win32/win95_sys_progr_secr/main.pdf|title=Windows 95 Programming Secrets |author-last=Pietrek |author-first=Matt |author-link=Matt Pietrek |date=March 1996|publisher=IDG|isbn=978-1-56884-318-6|pages=136–138|format=pdf|accessdate=2010-07-17|deadurl=yes|archiveurl=https://web.archive.org/web/20110514140137/http://cs.mipt.ru/docs/comp/eng/os/win32/win95_sys_progr_secr/main.pdf|archivedate=2011-05-14|df=}}

External links

• TEB layout on NTinternals.net
• Structured Exception Handling and the TIB
• [https://www.nirsoft.net/kernel_struct/vista/NT_TIB.html Description of the first slots of the TIB]
• [https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/teb/index.htm Description of TEB, field by field]
• [https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1809%20Redstone%205%20(October%20Update)/_TEB TEB definitions for various Windows versions]

• Banshee’s Last Cry
• Bansheleh
• Ban Sheytan
• Banshi College of Management Studies
• Ban Shigeru
• Banshilal Mahto
• Banshipur, Arrah
• Banshi River
• Ban Shirvan
• Ban Shirvan-e Tofangchi
• Banshlai Bridge railway station
• Banshlai Bridge Station
• Bansho-ji
• Banshovan
• Ban Shovar
• Banshtali Govt. Primary School
• Banshō-ji
• Banshū
• Banshū (disambiguation)
• Ban Siao
• Ban Sigeru
• Bansihari
• Bansihari (Community development block)
• Bansi Ponnappa
• Bansiya