Win32 Thread Information Block


In computing, the Win32 Thread Information Block is a data structure in Win32 on x86 that stores information about the currently running thread. It is also known as the Thread Environment Block for Win32. It descended from, and is backward-compatible on 32-bit systems with, a similar structure in OS/2.
The TIB is officially undocumented for Windows 9x. The Windows NT series DDK includes a struct NT_TIB in winnt.h that documents the subsystem independent part. Even before TIB was effectively documented, many applications have already started using its fields that they are effectively a part of the API. The first field containing the SEH frame, in particular, is directly referenced by the code produced by Microsoft's own compiler. The Win32 subsystem-specific part of the TEB is undocumented, but Wine includes a TEB definition in winternl.h.
The TIB can be used to get a lot of information on the process without calling Win32 API. Examples include emulating GetLastError, GetVersion. Through the pointer to the PEB one can obtain access to the import tables, process startup arguments, image name, etc. It is accessed from the FS segment register on 32-bit Windows and GS on 64-bit Windows.

Contents of the TIB on Windows

This table is based on Wine's work on Microsoft Windows internals.
FS or GS maps to a TIB which is embedded in a data block known as the TDB. The TIB contains the thread-specific exception handling chain and pointer to the TLS The thread local storage is not the same as C local storage.

Accessing the TIB

The TIB of the current thread can be accessed as an offset of segment register FS or GS.
It is not common to access the TIB fields by an offset from FS:, but rather first getting a linear self-referencing pointer to it stored at FS:. That pointer can be used with pointer arithmetic or be cast to a struct pointer.
Using Microsoft Windows SDK or similar, a programmer could use an inline function defined in winnt.h named NtCurrentTeb which returns the address of the current Thread Information Block as NT_TIB *.
Alternative methods of access for IA-32 architectures are as follows:

// gcc.
void *getTIB


// gcc.
void *getTIB


// Microsoft C
__declspec
void *getTIB


// Using Microsoft's intrinsics instead of inline assembly
void *getTIB