On x86 32bit windows the
FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to support OS related functionalities, services and APIs.
Examples of data TIB usage are:
- Thread Local Storage.
- the Heap.
- the Stack.
- SEH exception chain.
- Access to the Process Environment Block (which serves a similar, process level goal).
And many other...
To predict the actual value of a dereference into the
FS register, you'll need to consult a mapping of that (only partially documented) structure for the specific OS version you're working with. For example, the TIB wikipedia page I mentioned earlier describes a 32bit windows TIB layout.
On linux the
GS register is used for a similar purpose regardless of register size, and 64bit intel windows uses both the
The information stored in the TIB should not be used directly by programs, how ever specific members of the structure often are used for unintended purposes such as detecting debuggers in more prevalent ways.
As you can see, other segment registers are rarely used.
A bit of history
Although the segment registers are used for OS-related functionality, that was not the intended goal segment registers were made for. In the past, when CPU register sized varied between 8 and 16 bit, addressing was highly limited and only 64KB of address space was available. Since original CPUs were only running in Real Mode (and not Protected Mode), that address space had to be shared with all running services, processes, connected peripherals, etc...
To bypass that limitation, the Memory Segmentation was brought into use in two forms. One was Protected Mode VS Real Mode, and the other was the segment registers - which were used as an offset for the actual registers being used for addressing. This allowed a greatly increased addressing rage and was considered a valid solution. In the days of 32bit protected mode processors, where 4GB of Virtual Addressable Space is available to each process, and certainly with 64 bit CPUs, the segment registers are rarely used for their original goal (except for highly low level components such as Real Mode boot loaders, which might still need the extra addressing).
DS stands for Data Selector.