I'm having a real issue with Windows Debug Event Generation.
When Windows creates a DEBUG_EVENT structure to notify of a new process or new thread (CREATE_PROCESS_DEBUG_EVENT or CREATE_THREAD_DEBUG_EVENT), all the data seems normal and correct with one exception:
DEBUG_EVENT contains a ThreadLocalBase structure which contains a ThreadLocalStorage pointer, and it is always NULL (0), even when TLS indexes have been created in the target program being debugged. This makes it absolutely impossible to read TLS data for the user in my debugger.
Who knows how or why this pointer could ever be NULL? How can I get the real pointer?