How can I get the 32 bit stack limits / the 32 bit TEB/TIB from an existing 32 bit process under windows in x64 mode?

StackOverflow https://stackoverflow.com/questions/8212495

  •  05-03-2021
  •  | 
  •  

Domanda

Normally I would just cheat and use NtQueryInformationThread for ThreadBasicInformation to get the TebBaseAddress

but wow64 threads have two stacks, this will only get the 64 bit Teb.

È stato utile?

Soluzione

the best way I've found is to get the 32 bit context ( not via GetThreadContext, but Wow64GetThreadContext) and use Wow64GetThreadSelectorEntry to get the address of FS[0] and then use ReadProcessMemory. But the biggest problem is that this requires Win7/Windows2008 Server R2 )

Altri suggerimenti

Are you using the Windows debugging interface to attach to the process? If so, you should be able to use the lpThreadLocalBase field of the events CREATE_THREAD_DEBUG_INFO and CREATE_PROCESS_DEBUG_INFO to get the TEB base address when a new thread is created.

But I think this only works if your debugger has controlled the process from its creation. This wouldn't help for attaching to an existing process.

This is an easier, albeit undocumented, method: http://redplait.blogspot.ru/2012/12/teb32-of-wow64-process.html

Autorizzato sotto: CC-BY-SA insieme a attribuzione
Non affiliato a StackOverflow
scroll top