CONTEXT Structure
The CONTEXT
structure contains processor-specific register data. It is used by GetThreadContext
and SetThreadContext
to retrieve or set a thread's execution context.
Definition
#if defined(_M_IX86) || defined(_M_X64)
typedef struct _CONTEXT {
DWORD64 P1Home;
DWORD64 P2Home;
DWORD64 P3Home;
DWORD64 P4Home;
DWORD64 P5Home;
DWORD64 P6Home;
DWORD ContextFlags;
DWORD MxCsr;
WORD SegCs;
WORD SegDs;
WORD SegEs;
WORD SegFs;
WORD SegGs;
WORD SegSs;
DWORD EFlags;
DWORD64 Dr0;
DWORD64 Dr1;
DWORD64 Dr2;
DWORD64 Dr3;
DWORD64 Dr6;
DWORD64 Dr7;
DWORD64 Rax;
DWORD64 Rcx;
DWORD64 Rdx;
DWORD64 Rbx;
DWORD64 Rsp;
DWORD64 Rbp;
DWORD64 Rsi;
DWORD64 Rdi;
DWORD64 R8;
DWORD64 R9;
DWORD64 R10;
DWORD64 R11;
DWORD64 R12;
DWORD64 R13;
DWORD64 R14;
DWORD64 R15;
DWORD64 Rip;
XMM_SAVE_AREA32 FloatSave;
DWORD64 VectorRegister[26];
DWORD64 VectorControl;
DWORD64 DebugControl;
DWORD64 LastBranchToRip;
DWORD64 LastBranchFromRip;
DWORD64 LastExceptionToRip;
DWORD64 LastExceptionFromRip;
} CONTEXT, *PCONTEXT;
#endif
Members
Member | Type | Description |
---|---|---|
P1Home | DWORD64 | Reserved for use by the system. |
ContextFlags | DWORD | Flags indicating which parts of the context are valid. |
Rax | DWORD64 | Accumulator register. |
Rcx | DWORD64 | Count register. |
Rdx | DWORD64 | Data register. |
Rbx | DWORD64 | Base register. |
Rsp | DWORD64 | Stack pointer. |
Rbp | DWORD64 | Base pointer. |
Rsi | DWORD64 | Source index. |
Rdi | DWORD64 | Destination index. |
Rip | DWORD64 | Instruction pointer. |
FloatSave | XMM_SAVE_AREA32 | Floating‑point state. |
Usage Example
// Retrieve the current thread's context
CONTEXT ctx = {0};
ctx.ContextFlags = CONTEXT_FULL;
if (GetThreadContext(GetCurrentThread(), &ctx)) {
// ctx now contains register values
}
// Modify the instruction pointer
ctx.Rip = (DWORD64)MyFunction;
SetThreadContext(GetCurrentThread(), &ctx);
Remarks
- Always initialize
ContextFlags
before callingGetThreadContext
orSetThreadContext
. - On x86, use
CONTEXT32
instead ofCONTEXT
. - The structure layout differs between 32‑bit and 64‑bit builds.
- Use
Wow64GetThreadContext
to query the context of a 32‑bit thread from a 64‑bit process.