编辑

通过

ThreadCreateEvent.ThreadEnviromentBlockAddress Property

  • Reference

Definition

Namespace:
Microsoft.Windows.EventTracing.Processes
Assembly:
Microsoft.Windows.EventTracing.Processes.dll

Gets the address of the Thread Environment Block (TEB).

public Nullable<Microsoft.Windows.EventTracing.Address> ThreadEnviromentBlockAddress { get; }
member this.ThreadEnviromentBlockAddress : Nullable<Microsoft.Windows.EventTracing.Address>
Public ReadOnly Property ThreadEnviromentBlockAddress As Nullable(Of Address)

Property Value

Nullable<Address>

Remarks

This value is not present in some older versions of the event.

Applies to