MSDN – Windows API Documentation

CONTEXT Structure

The CONTEXT structure contains processor-specific register data. It is used by GetThreadContext and SetThreadContext to retrieve or set a thread's execution context.

Definition

#if defined(_M_IX86) || defined(_M_X64)
typedef struct _CONTEXT {
    DWORD64 P1Home;
    DWORD64 P2Home;
    DWORD64 P3Home;
    DWORD64 P4Home;
    DWORD64 P5Home;
    DWORD64 P6Home;
    DWORD   ContextFlags;
    DWORD   MxCsr;
    WORD    SegCs;
    WORD    SegDs;
    WORD    SegEs;
    WORD    SegFs;
    WORD    SegGs;
    WORD    SegSs;
    DWORD   EFlags;
    DWORD64 Dr0;
    DWORD64 Dr1;
    DWORD64 Dr2;
    DWORD64 Dr3;
    DWORD64 Dr6;
    DWORD64 Dr7;
    DWORD64 Rax;
    DWORD64 Rcx;
    DWORD64 Rdx;
    DWORD64 Rbx;
    DWORD64 Rsp;
    DWORD64 Rbp;
    DWORD64 Rsi;
    DWORD64 Rdi;
    DWORD64 R8;
    DWORD64 R9;
    DWORD64 R10;
    DWORD64 R11;
    DWORD64 R12;
    DWORD64 R13;
    DWORD64 R14;
    DWORD64 R15;
    DWORD64 Rip;
    XMM_SAVE_AREA32 FloatSave;
    DWORD64 VectorRegister[26];
    DWORD64 VectorControl;
    DWORD64 DebugControl;
    DWORD64 LastBranchToRip;
    DWORD64 LastBranchFromRip;
    DWORD64 LastExceptionToRip;
    DWORD64 LastExceptionFromRip;
} CONTEXT, *PCONTEXT;
#endif

Members

MemberTypeDescription
P1HomeDWORD64Reserved for use by the system.
ContextFlagsDWORDFlags indicating which parts of the context are valid.
RaxDWORD64Accumulator register.
RcxDWORD64Count register.
RdxDWORD64Data register.
RbxDWORD64Base register.
RspDWORD64Stack pointer.
RbpDWORD64Base pointer.
RsiDWORD64Source index.
RdiDWORD64Destination index.
RipDWORD64Instruction pointer.
FloatSaveXMM_SAVE_AREA32Floating‑point state.

Usage Example

// Retrieve the current thread's context
CONTEXT ctx = {0};
ctx.ContextFlags = CONTEXT_FULL;
if (GetThreadContext(GetCurrentThread(), &ctx)) {
    // ctx now contains register values
}

// Modify the instruction pointer
ctx.Rip = (DWORD64)MyFunction;
SetThreadContext(GetCurrentThread(), &ctx);

Remarks

  • Always initialize ContextFlags before calling GetThreadContext or SetThreadContext.
  • On x86, use CONTEXT32 instead of CONTEXT.
  • The structure layout differs between 32‑bit and 64‑bit builds.
  • Use Wow64GetThreadContext to query the context of a 32‑bit thread from a 64‑bit process.