Where in the API is Andrew Richards?

This blog contains random snippets/thoughts as I wonder around various SDK and WDK APIs...

Browse by Tags

Tagged Content List
  • Blog Post: StackBase and StackLimit offsets

    To save a symbol lookup in a debugger extension, here are the hardcodes to use for StackBase and StackLimit. User Mode 32bit 0:000> dt nt!_TEB.Stack* ntdll!_TEB +0x000 NtTib : +0x004 StackBase : Ptr Void +0x008 StackLimit : Ptr Void User Mode 64bit 0:000> dt nt!_TEB NtTib...
Page 1 of 1 (1 items)