How are addresses calculated from the values in x86 segment registers?

Question

How are the 16-bit values in segment registers used to represent large memory addresses?

ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS 003B 32bit 7FFDF000 (FFF)
GS 0000 NULL

For instance, how does the 003B in FS translate to 7FFDF000? Why are the 0023 in ES and the 001B in CS both apparently translating to 0?

I'm digging through the Intel manuals, but hoping someone here can help me out a tiny bit quicker than I can read those...

Answer 1

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (size) and some other attributes of the segment (data or code, 16- or 32-bit). For more info see the following links:

• Global Descriptor Table;
• Memory Translation and Segmentation.

Windows usually sets up the selectors so that they map 1:1 directly to virtual addresses, that's why they all have base of 0. fs is the exception because it's used for quick addressing of the Thread Information Block (TIB) which is separate for each thread of each process.

However, on 32-bit kernels you can in fact set up a custom selector mapping using the undocumented function NtSetLdtEntries. See here for more info:

• Protected Mode Segmentation as a powerful anti-debugging measure, by j00ru.

Answer 2

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a pretty big address range.

Instead, some segment registers (CS, SS, DS) are now used for permissions, memory protection and paging, while others are used as general purpose registers, or OS specific structures (such as FS in 32bit windows and GS in linux and 64bit windows).

To find out more, I suggest you read about memory protection, protected mode, and modern OS memory management and paging.