78 struct ThreadBasicInformation {
85 ULONG_PTR AffinityMask;
89 using NtQueryInformationThreadFn =
90 LONG(WINAPI *)(
HANDLE ThreadHandle, ULONG ThreadInformationClass,
91 PVOID ThreadInformation, ULONG ThreadInformationLength,
95 L
"ntdll.dll",
"NtQueryInformationThread"};
96 if (!s_query_information_thread)
98 auto NtQueryInformationThread = *s_query_information_thread;
101 if (!handle || handle == INVALID_HANDLE_VALUE)
104 ThreadBasicInformation info = {};
106 if (NtQueryInformationThread(handle, 0, &info,
sizeof(info),
nullptr) < 0)
108 if (!info.TebBaseAddress)
111 auto dict = std::make_shared<StructuredData::Dictionary>();
112 dict->AddIntegerItem(
"teb_address",
113 reinterpret_cast<uint64_t
>(info.TebBaseAddress));