Search notes:

TIB - Windows Thread Information Block

The TIB is also referred to as TEB (Thread Environment Block)?
The TIB is also known as Thread Environment Block.
In a Win32 environment, the FS register always points at the TEB, in a Win64 environment, it's the GS register.
Programattically, the TEB can be found with NtCurrentTeb().

Struct members

The TIB apparently corresponds to the NT_TIB struct (winnt.h)
The first element is a pointer to (the thread's) EXCEPTION_REGISTRATION struct.
The second and third elements contain the high and low addresses of the stack.
etc.
Offset 0x18 (Win32) of the TIB points to the linear address of itself:
mov eax, fs:[0x18]
In Win64, this is gs:[0x30].
NtosKrnl.exe (ntddk.h, NtosKrnl.lib) provides the function PsGetCurrentThreadTeb() that returns a pointer to the TIB.
Offset 0x30 (Win32) points to the linear address of the PEB. In Win64, this is gs:[0x60].

EXCEPTION_REGISTRATION

The EXCEPTION_REGISTRATION struct contains a pointer to a call back function to be called in case of an exception (aka the _except_handler callback function).
Thus, it points at the current structured exception handling (SEH) frame.

Index