Package ghidra.app.util.datatype.microsoft

Class ThreadEnvironmentBlock

java.lang.Object

ghidra.app.util.datatype.microsoft.ThreadEnvironmentBlock

public class ThreadEnvironmentBlock
extends Object

Class for creating a Ghidra memory block representing the TEB: Thread Environment Block. The class must be instantiated with the Program and the Windows OS version to control details of the TEB layout. The user must call setAddress to provide the starting address of the block to create. Then they must call one of - createBlockAndStructure or - createBlocksAndSymbols The TEB can be represented either by a single structure overlaying the block (createBlockAndStructure), or as a series of symbols and primitive data-types (createBlocksAndSymbols). Finally the user should call setRegisterValue. The TEB is accessed either through the FS segment (32-bit) or GS segment (64-bit), so this method sets a Register value for one these over the program.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	ThreadEnvironmentBlock.WinVersion	An enumeration describing a Windows OS version by String and by ordinal.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	BLOCK_NAME

Constructor Summary

Constructors

Constructor	Description
ThreadEnvironmentBlock(Program prog, ThreadEnvironmentBlock.WinVersion version)

Method Summary

Modifier and Type	Method	Description
void	createBlockAndStructure()	Create TEB as a single uninitialized block.
void	createBlocksAndSymbols()	Create 2 blocks, one that is initialized to hold a proper value for the TEB Self reference field and another to hold the remainder of the TEB.
int	getBlockSize()
boolean	is64()
void	setAddress(Address addr)	Set the starting address of the TEB
void	setRegisterValue()	Set FS_OFFSET for 32-bit or GS_OFFSET for 64-bit to the address of the TEB across the program.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

BLOCK_NAME

public static final String BLOCK_NAME

See Also:

• Constant Field Values

Constructor Details

ThreadEnvironmentBlock

public ThreadEnvironmentBlock(Program prog,
 ThreadEnvironmentBlock.WinVersion version)

Method Details

createBlockAndStructure

public void createBlockAndStructure()
                             throws MemoryConflictException,
LockException,
IllegalArgumentException,
AddressOverflowException,
CodeUnitInsertionException,
InvalidInputException

Create TEB as a single uninitialized block. A TEB structure is created and is placed on the block.

Throws:

MemoryConflictException - if there are overlap problems with other blocks

AddressOverflowException - for problems with block's start Address

IllegalArgumentException - for problems with the block name or the TEB data-type

LockException - if it cannot get an exclusive lock on the program

CodeUnitInsertionException - for problems laying down the structure on the block

InvalidInputException - for problems with the symbol name attached to the TEB

createBlocksAndSymbols

public void createBlocksAndSymbols()
                            throws MemoryConflictException,
LockException,
IllegalArgumentException,
AddressOverflowException,
CancelledException

Create 2 blocks, one that is initialized to hold a proper value for the TEB Self reference field and another to hold the remainder of the TEB. The data structure is layed down as a series of symbols on these blocks.

Throws:

MemoryConflictException - if there are overlap problems with other blocks

CancelledException - if block creation is cancelled

AddressOverflowException - for problems with block's start Address

IllegalArgumentException - for problems with the block name or the TEB data-type

LockException - if it cannot get an exclusive lock on the program

setRegisterValue

public void setRegisterValue()

Set FS_OFFSET for 32-bit or GS_OFFSET for 64-bit to the address of the TEB across the program.

is64

public boolean is64()

Returns:

true if a 64-bit TEB is being layed down.

getBlockSize

public int getBlockSize()

Returns:

the number of bytes needed in the full TEB block being constructed

setAddress

public void setAddress(Address addr)

Set the starting address of the TEB

Parameters:

addr - is the Address to set