title: Access a spawned process's TIB through FS register?
body: <p>I'd like to access a spawned process's TIB (I created the process with CreateProcessW successfully).</p>
  
  <p>I have obtained a pointer to the spawned process's TIB through:</p>
  
  <ul>
  <li>GetThreadContext (with permissions set of course)</li>
  <li>Accessing pContext.SegFs</li>
  <li>Formatting this value like so: <code>(ldtSel.HighWord.Bits.BaseHi &lt;&lt; 24 ) | ( ldtSel.HighWord.Bits.BaseMid &lt;&lt; 16 ) | ( ldtSel.BaseLow );</code> (I don't think this is necessary).</li>
  </ul>
  
  <p>The value I am left with after the format is a 10 digit pointer.</p>
  
  <p>How am I to use this variable in place of the fs register to access the threads information block?
  The conventional way I would access it generally would be as so:</p>
  
  <pre><code> __asm 
    {
        mov eax, fs:[0x30]  // PEB
        mov dwPebBase, eax
    }
  </code></pre>
  
  <p>However, replacing the "fs" with the pointer variable of course wouldn't work, and removing the semi-colon had unexpected results.
  So how can I access the members of the TIB through this pointer value, I feel as if I am accessing memory that isn't supposed to be accessed (or attempting to anyway :P).</p>
  
  <p>Thank you for the help.</p>