The last thing that you need to understand related to processes and threads are these data structures (TIB, TEB, and PEB). These structures are stored inside the process memory and accessible through its code. Their main function is to include all the information about the process and each thread and make them accessible to the code so that it can easily know the process filename, the loaded DLLs, and other related information.
They are all accessible through a special segment register FS, like this:
mov eax, DWORD PTR FS:[XX]
And these data structures have the following functions:
- Thread Information Block (TIB): Contains some information about the thread, including the list of functions that are used for error handling and much more
- Thread Environment Block (TEB): Has more information about the thread, including the thread ID
- Process Environment Block (PEB): Includes information about the process, such as the process name, process ID (PID...
