Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)?
To test, I assembled a program via masm64 that throws an interrupt, clears r8 then moves a pointer to the PEB to r8:
(3a4.2034): Break instruction exception - code 80000003 (!!! second chance !!!)
*** WARNING: Unable to verify checksum for C:\Users\res\Desktop\cfg\test.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Users\res\Desktop\cfg\test.exe
test+0x10c1:
00007ff6cedf10c1 4d33c0 xor r8,r8
0:000> r
rax=00007ff6cedf1000 rbx=0000000000000000 rcx=00007ff6cedf1068
rdx=00007ff6cedf1075 rsi=0000000000000000 rdi=0000000000000000
rip=00007ff6cedf10c1 rsp=0000006642d8f730 rbp=0000000000000000
r8=0000000000000000 r9=00007ff6cedf1000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000244`
Afterwards, I checked the base address for GS via selector, but it's not populated:
0:000> dg gs
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags`
---- ----------------- ----------------- ---------- - -- -- -- -- --------
002B 00000000 00000000 00000000 ffffffff Data RW Ac 3 Bg Pg P Nl 00000cf3`
Naturally its null when I try to dump GS:[0x60].
However, when I step into the instruction that moves the PEB pointer into r8, r8 has a distinct value!:
test+0x10c4:
00007ff6 cedf10c4 654c8b042560000000 mov r8,qword ptr gs:[60h] gs:00000000 00000060=????????????????
0:000> t
test+0x10cd:
00007ff6 cedf10cd 4d8b4018 mov r8,qword ptr [r8+18h] ds:00000066 42e0a018={ntdll!PebLdr (00007ff8 c642f3a0)}
0:000> r
rax=00007ff6cedf1000 rbx=0000000000000000 rcx=00007ff6cedf1068
rdx=00007ff6cedf1075 rsi=0000000000000000 rdi=0000000000000000
rip=00007ff6cedf10cd rsp=0000006642d8f730 rbp=0000000000000000
r8=0000006642e0a000 r9=00007ff6cedf1000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
test+0x10cd:
00007ff6 cedf10cd 4d8b4018 mov r8,qword ptr [r8+18h] ds:00000066 42e0a018={ntdll!PebLdr (00007ff8 c642f3a0)}`
