MyFunction:
    <set ES so that ES:0000000 points to SS:ESP>
    mov eax , [ES:00000004]
    

struc TIB
{
.m_pexrExceptionList            dd ?
.m_pvStackBase                          dd ?
.m_pvStackLimit                         dd ?
        .m_pvSubSystemTib:                              ;WINNT
        .m_pvTDB:                               dw ?    ;WIN95
        .m_pvThunkSS:                   dw ?    ;WIN95

        .m_pvFiberDataOrVersion:                ;WINNT
        .m_dwUnknown                    dd ?    ;WIN95

.m_pvArbitraryUserPointer       dd ?
.m_pntbSelf                                     dd ?

        .m_dwUnknown1:                                  ;WINNT
        .m_wTIBFlags                    dw ?    ;WIN95
        .m_wWin16MutexCount             dw ?    ;WIN95

        .m_dwProcessID:                                 ;WINNT
        .m_dwDebugContext               dd ?    ;WIN95

        .m_dwThreadID:                                  ;WINNT
        .m_pCurrentPriority             dd ?    ;WIN95
        
        .m_dwUnknown2                   dd ?    ;WINNT
        .m_pvQueue                              dd ?    ;WIN95

.m_pvTLSArray                           dd ?
        
        .m_pProcess                             dd ?    ;WIN95
}

virtual at 0
TIB TIB
end virtual


MyProc:
    mov lea eax , [esp - 12]
    mov edx , [fs: TIB.m_pexrExceptionList]
    mov [esp - 8] , .ErrorHandler
    mov [esp - 12], edx
    mov [fs:TIB.m_pexrExceptionList] , eax

.... (using ESP and EBP at will)

    mov edx , [fs:TIB.m_pexrExceptionList]
    mov ecx , [edx+16]  ;<== GETTING FIRST PARAMETER

....

.ret
        ret
.ErrorHandler:
.... (Err treatment for this procedure)...
    

Messing with TIB is a necessary thing to do, if you want to generate exception handling or per-thread global memory. Those two can only be done through TIB.

(Yes, I might store it inside the TIB that is at FS:0

Btw, "freeing the EBP register"? You're already free to use that. You problably meant freeing ESP?

He can't free ESP, because Windows has been written (badly) and will use ESP and store stuff below it in case of an USER exception (I mean a process exception handled by user code).

and I recall I could at least do MOV ES,blabla without 0.. getting an exception..

Maverick wrote:

He can't free ESP, because Windows has been written (badly) and will use ESP and store stuff below it in case of an USER exception (I mean a process exception handled by user code).

He can use it temporarily if he doesn't generate exceptions and remember to set min/max-esp in the TIB... or are there other situations where Windows uses the stack?

IMHO it's not such a bad requirement having a valid stack in order to handle user exceptions - if you don't, your handler code most likely wouldn't be able to do anything useful.

I do think it's a bit unfortunate that exception frames have to be located on the stack, but again this is probably a sanity check - it's the de facto location, so if a exception frame pointer points outside the stack location, the rationale says that we have a corrupted stack, and need to abort.

I think this all is pretty okay for usermode exception handling... it's not perfect, but in practice it works well enough for normal stuff. And if you need to write tracing code or the like, there's always Vectored Exception Handling to (ab)use

Maverick wrote:

and I recall I could at least do MOV ES,blabla without 0.. getting an exception..

Darn, it's been too long since I read the intel manuals... so I can't remember if you get an exception just by loading a selector with nonsense

or if it's only when using it to access anything. I do remember that you can load with zero without problems as long as you don't access, though.