Official way to get the Thread Information/Environment Block (TIB/TEB) Official way to get the Thread Information/Environment Block (TIB/TEB) windows windows

Official way to get the Thread Information/Environment Block (TIB/TEB)


The macro NtCurrentTeb() is available in winnt.h for all supported architectures, including ARM (Windows RT):

#if defined(_M_ARM) && !defined(__midl) && !defined(_M_CEE_PURE)__forceinlinestruct _TEB *NtCurrentTeb (    VOID    ){    return (struct _TEB *)(ULONG_PTR)_MoveFromCoprocessor(CP15_TPIDRURW);}


To answer your posted question, you can use NtQueryInformationThread() to retrieve a THREAD_BASIC_INFORMATION structure, which contains a pointer to the thread's TIB in its TebBaseAddress member.


Igor nailed it. But FYI, in ARM assembly it goes like this:

mrc p15, 0, r12, c13, c0, 2 ; r12 now points at TEB/TIBldr r12, [r12, #4] ; r12 now holds stack base