Geoff Chappell - Software Analyst
Windows Vista introduced two sets of bit fields to the TEB. Each is overlaid by a USHORT for simultaneous access to the bits. The set that is named CrossTebFlags has been provided for but no bits are yet defined: all are spare. The original bits in the SameTebFlags had names whose Dbg and Rtl prefixes were removed in Windows 7. Since then, the SameTebFlags have changed only by addition:
| Mask | Definition | Versions | Remarks |
|---|---|---|---|
| 0x0001 |
USHORT DbgSafeThunkCall : 1; |
6.0 only | |
USHORT SafeThunkCall : 1; |
6.1 and higher | ||
| 0x0002 |
USHORT DbgInDebugPrint : 1; |
6.0 only | previously BOOLEAN as InDbgPrint at 0x0F74 and 0x1744 |
USHORT InDebugPrint : 1; |
6.1 and higher | ||
| 0x0004 |
USHORT DbgHasFiberData : 1; |
6.0 only | previously BOOLEAN as HasFiberData at 0x0F76 and 0x1746 |
USHORT HasFiberData : 1; |
6.1 and higher | ||
| 0x0008 |
USHORT DbgSkipThreadAttach : 1; |
6.0 only | |
USHORT SkipThreadAttach : 1; |
6.1 and higher | ||
| 0x0010 |
USHORT DbgWerInShipAssertCode : 1; |
6.0 only | |
USHORT WerInShipAssertCode : 1; |
6.1 and higher | ||
| 0x0020 |
USHORT DbgRanProcessInit : 1; |
6.0 only | |
USHORT RanProcessInit : 1; |
6.1 and higher | ||
| 0x0040 |
USHORT DbgClonedThread : 1; |
6.0 only | |
USHORT ClonedThread : 1; |
6.1 and higher | ||
| 0x0080 |
USHORT DbgSuppressDebugMsg : 1; |
6.0 only | |
USHORT SuppressDebugMsg : 1; |
6.1 and higher | ||
| 0x0100 |
USHORT RtlDisableUserStackWalk : 1; |
late 6.0 only | |
USHORT DisableUserStackWalk : 1; |
6.1 and higher | ||
| 0x0200 |
USHORT RtlExceptionAttached : 1; |
late 6.0 and higher | |
| 0x0400 |
USHORT InitialThread : 1; |
6.1 and higher | |
| 0x0800 |
USHORT SessionAware : 1; |
6.2 and higher | |
| 0x1000 |
USHORT LoadOwner : 1; |
10.0 and higher | |
| 0x2000 |
USHORT LoaderWorker : 1; |
10.0 and higher | |
| 0x0400 |
USHORT SkipLoaderInit : 1; |
1703 and higher | |
USHORT SpareSameTebBits : 8; |
early 6.0 only | ||
USHORT SpareSameTebBits : 6; |
late 6.0 and higher | ||
USHORT SpareSameTebBits : 5; |
6.1 only | ||
USHORT SpareSameTebBits : 4; |
6.2 to 6.3 | ||
USHORT SpareSameTebBits : 2; |
10.0 to 1607 | ||
USHORT SpareSameTebBits : 1; |
1703 and higher |