This article needs to beupdated. Please help update this article to reflect recent events or newly available information.(December 2013)

TheThread Information Block (TIB) orThread Environment Block (TEB) is adata structure inWin32 onx86 that stores information about the currently runningthread. It descended from, and is backward-compatible on 32-bit systems with, a similar structure inOS/2.^[1]

The TIB is officially undocumented forWindows 9x. TheWindows NT seriesDDK (as well as theMinGW/ReactOS implementation) includes a structNT_TIB inwinnt.h that documents the subsystem independent part. Even before TIB was effectively documented, many applications have already started using its fields that they are effectively a part of theAPI. The first field containing theSEH frame, in particular, is referenced by the code produced by Microsoft's own compiler.^[1] The Win32 subsystem-specific part of the TEB is undocumented, butWine includes a TEB definition inwinternl.h.^[2]

The TIB can be used to get a lot of information on the process without calling Win32 API. Examples include emulatingGetLastError(),GetVersion(). Through the pointer to thePEB one can obtain access to the import tables (IAT), process startup arguments, image name, etc. It is accessed from the FSsegment register on 32-bit Windows and GS on 64-bit Windows.

This table is based onWine's work onMicrosoft Windows internals.^[2]

FS (for 32-bit) or GS (for 64-bit) maps to a TIB which is embedded in a data block known as the TDB (thread data base). The TIB contains the thread-specific exception handling chain and pointer to the TLS (thread local storage.) The thread local storage is not the same as C local storage.

A process should be free to move thestack of its threads as long as it updates the information stored in the TIB accordingly. A few fields are key to this matter: stack base, stack limit, deallocation stack, and guaranteed stack bytes, respectively stored at offsets0x8,0x10,0x1478 and0x1748 in 64 bits. Different Windowskernel functions read and write these values, specially to distinguishstack overflows from other read/writepage faults (a read or write to a page guarded among the stack limits in guaranteed stack bytes will generate a stack-overflow exception instead of an access violation). The deallocation stack is important because Windows API allows to change the amount of guarded pages: the functionSetThreadStackGuarantee allows both read the current space and to grow it. In order to read it, it reads theGuaranteedStackBytes field, and to grow it, it uses has to uncommit stack pages. Setting stack limits without settingDeallocationStack will probably cause odd behavior inSetThreadStackGuarantee. For example, it will overwrite the stack limits to wrong values. Different libraries callSetThreadStackGuarantee, for example the.NET CLR uses it for setting up the stack of their threads.

The TIB of the current thread can be accessed as an offset of segmentregister FS (x86) or GS (x64).

It is not common to access the TIB fields by an offset fromFS:[0], but rather first getting a linear self-referencing pointer to it stored atFS:[18h]. That pointer can be used with pointer arithmetic or be cast to astructpointer.

UsingMicrosoft Windows SDK or similar, a programmer could use an inline function defined inwinnt.h namedNtCurrentTeb which returns the address of the current Thread Information Block asNT_TIB *.^[5]

Alternative methods of access forIA-32 architectures are as follows:

// gcc (AT&T-style inline assembly).void*getTIB(void){registervoid*pTIB;#if defined(__x86_64__) || defined(__amd64__)__asm__("movq %%gs:0x30, %0":"=r"(pTIB));#elif defined(__i386__)__asm__("movl %%fs:0x18, %0":"=r"(pTIB));#else#error unsupported architecture#endifreturnpTIB;}

// gcc (named address spaces, same as the inline assembly version on -O1 or -ftree-ter).void*getTIB(void){#if defined(__x86_64__) || defined(__amd64__)#ifndef __SEG_GS#error unsupported GCC version#endifreturn*(void*__seg_gs*)0x30;#elif defined(__i386__)#ifndef __SEG_FS#error unsupported GCC version#endifreturn*(void*__seg_fs*)0x18;#else#error unsupported architecture#endif}

// Microsoft C__declspec(naked)void*getTIB(){__asmmovEAX,FS:[18h]__asmret}

// Using Microsoft's intrinsics instead of inline assembly (works for both X86 and X64 architectures)void*getTIB(){#ifdef _M_IX86return(void*)__readfsdword(0x18);#elif _M_AMD64return(void*)__readgsqword(0x30);#else#error unsupported architecture#endif}

• Structured Exception Handling

• Pietrek, Matt (March 1996).Windows 95 Programming Secrets(pdf). IDG. pp. 136–138.ISBN 978-1-56884-318-6. Retrieved2010-07-17.

• TEB layout on NTinternals.net
• Structured Exception Handling and the TIB
• Description of the first slots of the TIB
• Description of TEB, field by field
• TEB definitions for various Windows versions

• Windows NT architecture
• Microsoft application programming interfaces
• Threads (computing)

• Articles with short description
• Short description is different from Wikidata
• Wikipedia articles in need of updating from December 2013
• All Wikipedia articles in need of updating