ntenvblock

C header-only library to read selected fields from Windows NT process structures.

---

Overview

ntenvblock provides read-only access to selected fields of the Windows NT Thread Environment Block (TEB), Process Environment Block (PEB), and RTL_USER_PROCESS_PARAMETERS.

Intended use case

This library is intended for low-level diagnostics, profilers, debuggers, and runtime infrastructure that need direct access to NT process metadata without linking against ntdll or relying on Win32 wrappers.

Requirements

• Windows 7 or later
• C11 compiler
• <windows.h>
• <winternl.h>

Compatibility Notes

This library relies on undocumented Windows internal structure layouts.
The offsets included in the current release have been verified against supported NT-family systems at the time of publication.

Future Windows releases may change these layouts and require updated offset definitions. If Microsoft changes internal layouts, accessors may return incorrect data; they will not crash unless the structure contracts.

API Reference

Accessors

For each supported field, the library provides a generated accessor.

Note

All generated accessors return values by copy. No writable access to NT internal structures is provided, apart from subsequently referenced data via handles or through pointers to synchronization objects.

Pattern:

  <type> get_<field>(const <domain> *ptr)

Example:

  DWORD get_last_error(const TEB *ptr)

Preconditions:

• ptr must reference a valid <domain> object. It does not need to be aligned to the natural alignment of the underlying NT structure.

Available accessors

Domain TEB

Accessor	Return Type	Description
get_last_error	DWORD	source of GetLastError() (TEB::LastErrorValue)
get_process_id	DWORD	Process ID (narrowed CLIENT_ID::UniqueProcess); used by GetCurrentProcessId()
get_thread_id	DWORD	Thread ID (narrowed CLIENT_ID::UniqueThread); used by GetCurrentThreadId()

Domain PEB

Accessor	Return Type	Description
get_peb_lock	LPCRITICAL_SECTION	pointer to the PEB's internal synchronization object, historically used by NTDLL to protect portions of mutable PEB and process-parameter data; the existence and synchronization semantics of this lock are undocumented and may vary across Windows versions
get_process_heap	HANDLE	HANDLE to the default heap of the calling process; source of GetProcessHeap()

Domain RTL_USER_PROCESS_PARAMETERS

Accessor	Return Type	Description
get_cmd_ln_buf	const WCHAR *	command line (UNICODE_STRING::Buffer); null terminated because this is the same pointer that GetCommandLineW() returns
get_cmd_ln_size	USHORT	command line length in bytes, excluding terminator (UNICODE_STRING::Length)
get_cur_dir_buf	const WCHAR *	current directory (UNICODE_STRING::Buffer)
get_cur_dir_size	USHORT	current directory length in bytes, excluding terminator (UNICODE_STRING::Length)
get_env_buf	const WCHAR *	environment block: flat sequence of null-terminated environment strings, terminated by an extra null character
get_env_size	SIZE_T	environment block size in bytes, including the final terminator; (requires NT 6.1 or later)
get_img_path_buf	const WCHAR *	full path of the executable (UNICODE_STRING::Buffer); like GetModuleFileNameW() with hModule set to NULL
get_img_path_size	USHORT	executable path length in bytes, excluding terminator (UNICODE_STRING::Length)
get_std_err	HANDLE	HANDLE to the standard error device; same as GetStdHandle(STD_ERROR_HANDLE)
get_std_in	HANDLE	HANDLE to the standard input device; same as GetStdHandle(STD_INPUT_HANDLE)
get_std_out	HANDLE	HANDLE to the standard output device; same as GetStdHandle(STD_OUTPUT_HANDLE)

Functions

In addition, three functions are provided to get the domain pointers:

Function	Description
NTENVBLOCK_API const TEB *get_current_teb(void)	Get the current Thread Environment Block.
NTENVBLOCK_API const PEB *get_current_peb(const TEB *pTeb)	Get the current Process Environment Block.
NTENVBLOCK_API const RTL_USER_PROCESS_PARAMETERS *get_current_process_parameters(const PEB *pPeb)	Get the current Process Parameters.

Installation

Copy ntenvblock.h into your project and include it where needed:

#include "ntenvblock.h"

Example

#include <stdio.h>
#include "ntenvblock.h"

int main(void)
{
  const TEB *const pTeb = get_current_teb();
  const PEB *const pPeb = get_current_peb(pTeb);
  const RTL_USER_PROCESS_PARAMETERS *const pUpp = get_current_process_parameters(pPeb);

  wprintf_s(L"* Command Line *\n%s\n", get_cmd_ln_buf(pUpp));

  return 0;
}

---