9

As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for Stack, what is happening with those leftovers from Intel conception. Registers

Those are my registers using Ollydbg, how can I predict what will be moved into EAX?

MOV EAX, DWORD PTR FS:[0]

1 Answer 1

11

On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to support OS related functionalities, services and APIs.

Examples of data TIB usage are:

  1. Thread Local Storage.
  2. the Heap.
  3. the Stack.
  4. SEH exception chain.
  5. Access to the Process Environment Block (which serves a similar, process level goal).

And many other...

To predict the actual value of a dereference into the FS register, you'll need to consult a mapping of that (only partially documented) structure for the specific OS version you're working with. For example, the TIB wikipedia page I mentioned earlier describes a 32bit windows TIB layout.

On linux the GS register is used for a similar purpose regardless of register size, and 64bit intel windows uses both the FS and GS registers.

The information stored in the TIB should not be used directly by programs, how ever specific members of the structure often are used for unintended purposes such as detecting debuggers in more prevalent ways.

As you can see, other segment registers are rarely used.

A bit of history

Although the segment registers are used for OS-related functionality, that was not the intended goal segment registers were made for. In the past, when CPU register sized varied between 8 and 16 bit, addressing was highly limited and only 64KB of address space was available. Since original CPUs were only running in Real Mode (and not Protected Mode), that address space had to be shared with all running services, processes, connected peripherals, etc...

To bypass that limitation, the Memory Segmentation was brought into use in two forms. One was Protected Mode VS Real Mode, and the other was the segment registers - which were used as an offset for the actual registers being used for addressing. This allowed a greatly increased addressing range and was considered a valid solution. In the days of 32bit protected mode processors, where 4GB of Virtual Addressable Space is available to each process, and certainly with 64 bit CPUs, the segment registers are rarely used for their original goal (except for highly low level components such as Real Mode boot loaders, which might still need the extra addressing).

P.S.

DS stands for Data Selector.

4
  • Thanks for explaining it, now the concept of segments it's much clearer to me.
    – erexo
    Commented Sep 13, 2017 at 20:29
  • 1
    There's an additional side to segment selectors, which I didn't want to dwell into because your question was essentially about the FS register. Nowadays segment registers are still used for permissions and memory management. This is pretty important to the understanding of memory managemnt on the Intel architecture family but not really related to your question, you can read about it here: en.wikipedia.org/wiki/Global_Descriptor_Table
    – NirIzr
    Commented Sep 13, 2017 at 20:39
  • 1
    typo rage -> range. I can't edit because it is less than 6 chars
    – Et7f3XIV
    Commented Feb 26, 2023 at 14:19
  • @Et7f3XIV Thanks!
    – NirIzr
    Commented Feb 27, 2023 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.