win: Retrieve thread context for x64

util/win/process_structs.h

 // Copyright 2015 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 284 matching lines @@
   typename Traits::Pointer Self;
 };
 
 // See https://msdn.microsoft.com/en-us/library/gg750647.aspx.
 template <class Traits>
 struct CLIENT_ID {
   typename Traits::Pointer UniqueProcess;
   typename Traits::Pointer UniqueThread;
 };
 
+// This is a partial definition of the TEB, as we do not currently use many
+// fields of it. See http://www.nirsoft.net/kernel_struct/vista/TEB.html.

[cpu_(ooo_6.6-7.5), 2015/05/12 21:31:21]

do we want to make sure the packing or the alignment are explicit? here and
above, other defs.

If so maybe in a different CL. Since it is templatized I don't know how it will
look.

[scottmg, 2015/05/12 22:06:36]

Yes, it's not obvious per struct unfortunately, but this whole file is pragma
pack 1.

In general, the Traits template parameter is intended to handle padding, see
e.g. SYSTEM_EXTENDED_THREAD_INFORMATION at line 324, where WaitTime is a ULONG
on both x86 and x64, so it's put in a union with a Traits::Pad, which is a 64bit
sized field intended to make alignment correct when the template is used for
reading from an x64 process.

In this particular case for the head of the TEB, I *think* the padding is
correct -- all the TIB fields are pointers, followed by a pointer for
EnvironmentPointer, followed by two pointers in ClientId, all of which should be
naturally aligned. (Having said that, I've only tried it on x64 so far, not x86
because of a few other places that don't handle x86 yet.)

+template <class Traits>
+struct TEB {
+  NT_TIB<Traits> NtTib;
+  typename Traits::Pointer EnvironmentPointer;
+  CLIENT_ID<Traits> ClientId;
+};
+
 // See https://msdn.microsoft.com/en-us/library/gg750724.aspx for the base
 // structure, and 
 // http://processhacker.sourceforge.net/doc/struct___s_y_s_t_e_m___e_x_t_e_n_d_e_d___t_h_r_e_a_d___i_n_f_o_r_m_a_t_i_o_n.html
 // for the extension part.
 template <class Traits>
 struct SYSTEM_EXTENDED_THREAD_INFORMATION {
   LARGE_INTEGER KernelTime;
   LARGE_INTEGER UserTime;
   LARGE_INTEGER CreateTime;
   union {
@@ skipping 68 matching lines @@
 };
 
 #pragma pack(pop)
 
 //! \}
 
 }  // namespace process_types
 }  // namespace crashpad
 
 #endif  // CRASHPAD_UTIL_WIN_PROCESS_STRUCTS_H_