Bring me the head of Bill Gates!

Bring me the head of Bill Gates!

[Dave Korn]

  AAAARRRGGH!

http://msdn.microsoft.com/en-us/library/ms686708(VS.85).aspx

[This structure may be altered in future versions of Windows. Applications
should use the alternate functions listed in this topic.]

typedef struct _TEB {
  BYTE Reserved1[1952];
  PVOID Reserved2[412];
  PVOID TlsSlots[64];
  BYTE Reserved3[8];
  PVOID Reserved4[26];
  PVOID ReservedForOle;
  PVOID Reserved5[4];
  PVOID TlsExpansionSlots;
} TEB, 
 *PTEB;


  Ok then, let's see what "alternate functions" they're talking about....

http://msdn.microsoft.com/en-us/library/ms684847(VS.85).aspx
Process and Thread Functions

 [ ... ]

Obsolete Functions

    * NtGetCurrentProcessorNumber
    * NtQueryInformationProcess
    * NtQueryInformationThread
    * WinExec
    * ZwQueryInformationProcess


  GNRREAAAARGH!  <gnashing of teeth>

*head*bonk*desk*bonk*head*bonk*desk*bonk*head*bonk*desk*bonk*

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....

Re: Bring me the head of Bill Gates!

[Gareth Pearce]

Umm, the alternate functions are listed in the topic ... as TlsGetValue 
and CoGetContextToken ...

price of bread?

Dave Korn wrote:
>   AAAARRRGGH!
>
> http://msdn.microsoft.com/en-us/library/ms686708(VS.85).aspx
>
> [This structure may be altered in future versions of Windows. Applications
> should use the alternate functions listed in this topic.]
>
> typedef struct _TEB {
>   BYTE Reserved1[1952];
>   PVOID Reserved2[412];
>   PVOID TlsSlots[64];
>   BYTE Reserved3[8];
>   PVOID Reserved4[26];
>   PVOID ReservedForOle;
>   PVOID Reserved5[4];
>   PVOID TlsExpansionSlots;
> } TEB, 
>  *PTEB;
>
>
>   Ok then, let's see what "alternate functions" they're talking about....
>
> http://msdn.microsoft.com/en-us/library/ms684847(VS.85).aspx
> Process and Thread Functions
>
>  [ ... ]
>
> Obsolete Functions
>
>     * NtGetCurrentProcessorNumber
>     * NtQueryInformationProcess
>     * NtQueryInformationThread
>     * WinExec
>     * ZwQueryInformationProcess
>
>
>   GNRREAAAARGH!  <gnashing of teeth>
>
> *head*bonk*desk*bonk*head*bonk*desk*bonk*head*bonk*desk*bonk*
>
>     cheers,
>       DaveK
>   

Re: Bring me the head of Bill Gates!

[Christopher Faylor]

On Tue, Sep 23, 2008 at 04:57:57PM +1000, Gareth Pearce wrote:
> price of bread?

Yeah, I'm missing the context here as well.

cgf

RE: Bring me the head of Bill Gates!

[Dave Korn]

Christopher Faylor wrote on 23 September 2008 15:38:

> On Tue, Sep 23, 2008 at 04:57:57PM +1000, Gareth Pearce wrote:
>> price of bread?
> 
> Yeah, I'm missing the context here as well.
> 
> cgf

 <koff> been away with lurgy.

  Anyway.  The point was..

> Gareth Pearce wrote on 23 September 2008 07:58:
> 
>> Umm, the alternate functions are listed in the topic ... as TlsGetValue
>> and CoGetContextToken ...

  Those two functions only give you access to the tiniest fraction of the
stuff that is now hidden behind the nondescript

>>>   BYTE Reserved1[1952];

  Remember [fs:4] = stack bottom = tls area?  That's gone now.  Can't access
the exception registration chain at [fs:0] either.  All that useful stuff -
last error value, peb pointer, environment - it's all out of bounds now.
Can't look at it in the TEB.  Can't get it via the NT api info funcs that
might otherwise have provided another route to the data, because they've been
retired too.  And there's no equivalent win32 func for most of it either -
none of the GetThreadXxxxx functions are any help there.

  So.  How's anyone except MS supposed to write C runtimes, compilers and
support libraries, or posix emulation layers now?

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....