PsGetCurrentThreadTeb function (ntddk.h)

The PsGetCurrentThreadTeb routine returns the Thread Environment Block (TEB) of the current thread, or NULL. The call must be made in kernel-mode.

Syntax

PVOID PsGetCurrentThreadTeb();

Return value

A pointer to the thread environment block of the current thread. The TEB should be accessed within a try/catch exception block.

PsGetCurrentThreadTeb returns NULL in the following cases:

  • The current thread does not have a TEB (for example a system thread).
  • The current thread cannot safely access its own TEB. This might happen if the driver attached the thread to the address space of another process, for example by calling KeStackAttachProcess.

Remarks

While PsGetCurrentThreadTeb can be called at any IRQL without causing a bugcheck, the TEB is not safe to access at DISPATCH_LEVEL or above (it could be paged out). Also, if you're calling at elevated IRQL from the context of an interrupt or DPC, the current thread is whatever happened to be running on the current processor when your interrupt was delivered there. As a result, it is recommended that you call PsGetCurrentThreadTeb from thread context below DISPATCH_LEVEL.

Requirements

Requirement Value
Minimum supported client Available in Windows 7 and later versions of Windows.
Target Platform Universal
Header ntddk.h
Library NtosKrnl.lib
DLL NtosKrnl.exe
IRQL Any level (see Remarks)

See also

Process and Thread Manager Routines