Talk:Win32 Thread Information Block

This article is based on false understanding of internal win structs, the _NT_TIB struct is the first part of the _TEB struct (thread environment block). From fs:[1ch] on the displayed members are part of _TEB. --78.53.9.66 (talk) 21:44, 13 June 2008 (UTC)

I concur. For instance, I believe that the thread-local storage array linear address is in fact a pointer to an array of link loader module TLS tables (i.e. those declared with __declspec(thread) or similar). There is a lot of misinformation out on the web. But, I'm not comfortable documenting these fields one way or another. Probably the table should be removed, and the entry should merely discuss uses and provide more external references. --68.49.218.100 (talk) 20:05, 21 June 2008 (UTC)

The block at FS:[0xBF8] is marked with length 214 bytes; however, 0xE0C - 0xBF8 = 0x214 = 532 != 214. Not sure if that's a mistake or not. Can someone confirm this and correct? Rjball (talk) 22:50, 9 June 2009 (UTC)

I second that concur. The TIB is a child struct contained within the first 0x1c bytes of the TEB.

To try and answer your question about TEB:0xbf8, it appears to be a unicode string structure there, defined as

typedef struct _UNICODE_STRING {

    WORD Length;
    WORD MaximumLength;
    WORD * Buffer;

} UNICODE_STRING, *PUNICODE_STRING;

The examples Im finding have a Buffer len of wchar[261]

Just to verify that the NT_TIB is only the first 0x1c bytes, here is the TIB as defined in MS WinNT.h:

typedef struct _NT_TIB {

   struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
   PVOID StackBase;
   PVOID StackLimit;
   PVOID SubSystemTib;
   union {
       PVOID FiberData;
       DWORD Version;
   };
   PVOID ArbitraryUserPointer;
   struct _NT_TIB *Self;

} NT_TIB; typedef NT_TIB *PNT_TIB;

Drak-x86 (talk) 12:37, 13 November 2009 (UTC)

External links modified

Hello fellow Wikipedians,

I have just modified one external link on Win32 Thread Information Block. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:

• Added archive https://web.archive.org/web/20110514140137/http://cs.mipt.ru/docs/comp/eng/os/win32/win95_sys_progr_secr/main.pdf to http://cs.mipt.ru/docs/comp/eng/os/win32/win95_sys_progr_secr/main.pdf

When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.

This message was posted before February 2018. After February 2018, "External links modified" talk page sections are no longer generated or monitored by InternetArchiveBot. No special action is required regarding these talk page notices, other than regular verification using the archive tool instructions below. Editors have permission to delete these "External links modified" talk page sections if they want to de-clutter talk pages, but see the RfC before doing mass systematic removals. This message is updated dynamically through the template {{source check}} (last update: 18 January 2022).

• If you have discovered URLs which were erroneously considered dead by the bot, you can report them with this tool.
• If you found an error with any archives or the URLs themselves, you can fix them with this tool.

Cheers.—InternetArchiveBot (Report bug) 04:17, 30 December 2017 (UTC)