win: Retrieve thread context for x64

util/win/process_structs.h

Index: util/win/process_structs.h
diff --git a/util/win/process_structs.h b/util/win/process_structs.h
index d88b33d135ca60886ec7de454484ef91f64a30a7..6cd06b0f08cefc89cce0ac145e88f42e2330cdf3 100644
--- a/util/win/process_structs.h
+++ b/util/win/process_structs.h
@@ -302,6 +302,15 @@ struct CLIENT_ID {
   typename Traits::Pointer UniqueThread;
 };
 
+// This is a partial definition of the TEB, as we do not currently use many
+// fields of it. See http://www.nirsoft.net/kernel_struct/vista/TEB.html.

[cpu_(ooo_6.6-7.5), 2015/05/12 21:31:21]

do we want to make sure the packing or the alignment are explicit? here and
above, other defs.

If so maybe in a different CL. Since it is templatized I don't know how it will
look.

[scottmg, 2015/05/12 22:06:36]

Yes, it's not obvious per struct unfortunately, but this whole file is pragma
pack 1.

In general, the Traits template parameter is intended to handle padding, see
e.g. SYSTEM_EXTENDED_THREAD_INFORMATION at line 324, where WaitTime is a ULONG
on both x86 and x64, so it's put in a union with a Traits::Pad, which is a 64bit
sized field intended to make alignment correct when the template is used for
reading from an x64 process.

In this particular case for the head of the TEB, I *think* the padding is
correct -- all the TIB fields are pointers, followed by a pointer for
EnvironmentPointer, followed by two pointers in ClientId, all of which should be
naturally aligned. (Having said that, I've only tried it on x64 so far, not x86
because of a few other places that don't handle x86 yet.)

+template <class Traits>
+struct TEB {
+  NT_TIB<Traits> NtTib;
+  typename Traits::Pointer EnvironmentPointer;
+  CLIENT_ID<Traits> ClientId;
+};
+
 // See https://msdn.microsoft.com/en-us/library/gg750724.aspx for the base
 // structure, and 
 // http://processhacker.sourceforge.net/doc/struct___s_y_s_t_e_m___e_x_t_e_n_d_e_d___t_h_r_e_a_d___i_n_f_o_r_m_a_t_i_o_n.html