ZwQueryInformationThread(ThreadTebInformation)

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
//A new method introduced in recent versions of Windows to Copy certain fields of TEB's of remote threads.
#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

#define ThreadTebInformation            0x1A

extern "C"
{
int __stdcall ZwSetInformationThread(HANDLE,unsigned long,unsigned long*,unsigned long);
int __stdcall ZwQueryInformationThread(HANDLE,unsigned long,unsigned long*,unsigned long,unsigned long*);
}

struct TEB_INFO
{
    void* pDest; //Receives read TEB info.
    unsigned long Offset; //Offset at which TEB fields are read.
    unsigned long NumOfBytes; //Number of Bytes to read (0xFE4 as Max).
};

int main(int argc, char* argv[])
{
    //-----------
    char* ShadowTEB=(char*)LocalAlloc(LMEM_ZEROINIT,0x1000);

    TEB_INFO TB={ShadowTEB,0x0,0xFE4};
    int ret=ZwQueryInformationThread(GetCurrentThread(),
                                        ThreadTebInformation,
                                        (unsigned long*)(&TB),sizeof(TB),0);
    if(ret>=0)  printf("Okay\r\n");
    else        printf("Error: %x\r\n",ret);

    LocalFree(ShadowTEB);
    return 0;
}