I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows:


What does this value 0x53 mean? Does it have some connection with the address 0x7EFDD000? If to change FS value to 0x63 (for example), the address to the right becomes 0:

FS mod

Likewise, if to change another segment register to 0x53, it will be also pointing to TEB:

CS mod

How should we interpret all the things?

  • 1
    well i wrote an answer and before i could post this thread was locked so i posted it in the referred thread you may have a look
    – blabb
    Jun 13 '17 at 19:15
  • @blabb Thank you! Your answer clarifies a lot of things. The answer is here.
    – greenpiece
    Jun 14 '17 at 7:23

Browse other questions tagged or ask your own question.