Monday, September 8, 2008

Win32 TIB (Thread Information Block)

Win32 TIB 

Win32 TIB (Thread Information Block) is a data struct in wins32 on x86 that stores info about the currently running thread. 

If you have a Process Explorer type application, you can use TIB instead of using APIs to get the thread and process information. 

The TIB can be used to get a lot of information on the process without calling win32 API. Examples include emulating GetLastError(), GetVersion(). Through the pointer to the PEB one can obtain access to the import tables (IAT), process startup arguments, image name, etc.

 How to Access TIB 

The TIB can be accessed as an offset of segment register FS.FS is the  data selector to TIB  for the first thread.

FS maps to a TIB which is embedded in a data block known as the TDB (thread data base). The TIB contains the thread-specific exception handling chain and pointer to the TLS (thread local storage.) The thread local storage is not the same as C local storage.

 TIB Contents: 

Position

Windows Ver.

Description

FS:[0x00]

Win9x and NT


FS:[0x04]

Win9x and NT

Top of stack

FS:[0x08]

Win9x and NT

Current bottom of stack

FS:[0x10]

NT


FS:[0x14]

Win9x and NT

Arbitrary data slot

FS:[0x18]

Win9x and NT

Linear address of TIB

FS:[0x1C]

NT

Environment Pointer

FS:[0x20]

NT

Process ID

FS:[0x24]

NT

Current thread ID

FS:[0x28]

NT

Active RPC Handle

FS:[0x2C]

Win9x and NT

Linear address of the TLS array

FS:[0x30]

NT

Linear address of (PEB)

FS:[0x34]

NT

Last error number

FS:[0x38]

NT

Count of owned critical sections

FS:[0x3C]

NT

Address of CSR Client Thread

FS:[0x40]

NT

Win32 Thread Information

FS:[0x44]

NT,Wine

Win32 client information (NT), user32 private data (Wine), 0x60 = LastError (Win95), 0x74 = LastError (WinME)

FS:[0xC0]

NT

Reserved for Wow32

FS:[0xC4]

NT

Current Locale

FS:[0xC8]

NT

FP Software Status Register

FS:[0xCC]

NT,Wine

Reserved for OS (NT), kernel32 private data (Wine)

FS:[0x124]

NT

Pointer to KTHREAD (ETHREAD) structure

FS:[0x1A4]

NT

Exception code

FS:[0x1A8]

NT

Activation context stack

FS:[0x1BC]

NT,Wine

Spare bytes (NT), ntdll private data (Wine)

FS:[0x1D4]

NT,Wine

Reserved for OS (NT), ntdll private data (Wine)

FS:[0x1FC]

NT,Wine

GDI TEB Batch (OS), vm86 private data (Wine)

FS:[0x6DC]

NT

GDI Region

FS:[0x6E0]

NT

GDI Pen

FS:[0x6E4]

NT

GDI Brush

FS:[0x6E8]

NT

Real Process ID

FS:[0x6EC]

NT

Real Thread ID

FS:[0x6F0]

NT

GDI cached process handle

FS:[0x6F4]

NT

GDI client process ID (PID)

FS:[0x6F8]

NT

GDI client thread ID (TID)

FS:[0x6FC]

NT

GDI thread locale information

FS:[0x700]

NT

Reserved for user application

FS:[0x714]

NT

Reserved for GL

FS:[0xBF4]

NT

Last Status Value

FS:[0xBF8]

NT

Reserved for advapi32

FS:[0xE0C]

NT

Pointer to deallocation stack

FS:[0xE10]

NT

TLS slots, 4 byte per slot

FS:[0xF10]

NT

TLS links (LIST_ENTRY structure)

FS:[0xF18]

NT

VDM

FS:[0xF1C]

NT

Reserved for RPC

Sample Code:

void *pTIB;

__asm

{

mov EAX,FS:[20h]
mov [pTIB],EAX

}

//Here you can see the most recent Process ID in pTIB.

EAX – is a CPU Register (Accumulator Register).

Cheers!!

Sunday, September 7, 2008

CMemoryState - Detects memory leaks in your program

Memory leak occurs when memory for an object is allocated on the heap but not deallocated when it is no longer required. Such memory leaks can lead to out-of-memory errors.CMemoryState provides an excellent way to detect memory leaks in your program.

The CMemoryState diagnostics only help to detect memory leaks caused when memory allocated using the new operator is not deallocated using delete.

CMemoryState
will not address the leaks caused by malloc , LocalAlloc & GlobalAlloc.

How to Use: 

CMemoryState oldMemState, newMemState, diffMemState;
oldMemState.Checkpoint();
/* Obtains a snapshot or "checkpoint" of the current memory state.*/

/* memory allocation activities go on here */

newMemState.Checkpoint();
if(diffMemState.Difference(oldMemState,newMemState))
{

     TRACE( "Memory leak Detected!\n" );
              diffMemState.DumpAllObjectsSince();

}
/* Difference() - Computes the difference between two objects of type CMemoryState.*/
/* DumpAllObjectsSince() - Dumps a summary of all currently allocated objects since a previous checkpoint.*/

cheers!