Timeline for windbg - Why does the GS register resolve to offset 0x0?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 4, 2019 at 18:00 | comment | added | blabb | @igorsk !teb is rdmsr 0xc000_0102 gs;[0] in kmode is rdmsr 0xc000_0101 | |
| Apr 4, 2019 at 17:55 | comment | added | blabb | @Biswapriyo nothing they are read using rdmsr in ring 0 msr for GS_BASE and kernel_gs_base are respectively c000_0101 / c000_0102 see the edit | |
| Apr 4, 2019 at 17:53 | history | edited | blabb | CC BY-SA 4.0 |
added 320 characters in body
|
| Apr 4, 2019 at 13:15 | comment | added | Igor Skochinsky♦ |
gs is used in user mode too for thread-local data (similar to fs in x86).
|
|
| Apr 4, 2019 at 12:45 | comment | added | Biswapriyo |
What magic do you know about it? I just see only mov rax, gs:[offset].
|
|
| Apr 4, 2019 at 6:35 | history | answered | blabb | CC BY-SA 4.0 |