If I want to find all references to fs:[0x28] how would I go about doing it with radare2? For example,

0x000006b5      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x1978 ; '(' ; "x\x19"

I want to find all lines that reference fs:[0x28], like the one above. This address is used as a stack canary, and I'm especially interested to see what is reading from it.

2 Answers 2


Seems you can find the things writing to it with axt (find data/code references to this address) using just the address 0x28. I'm still unsure how to qualify the memory segment,

[0x000006aa]> axt 0x28
sym.foo 0x6b5 [DATA] mov rax, qword fs:[0x28]

But this doesn't work,

[0x000006aa]> axt fs:[0x28]
entry0; [14] -r-x section size 514 named .text 0x5a0 [CODE] xor ebp, ebp
sym.__libc_csu_init 0x779 [CALL] call qword [r12 + rbx*8]

By looking how this function is implemented, it looks like there's no option for this (but go ask on r2's on Telegram). It just takes a string that's being converted to a number and that's all. If you want to see all the places where fs:[0x28] being used why not search for this part of the opcode?

[0x004049a0]> /c fs:[0x28]
0x00402a19   # 9: mov rax, qword fs:[0x28]
0x00403f81   # 9: xor rcx, qword fs:[0x28]
0x00404dc1   # 9: mov rax, qword fs:[0x28]
0x00404de6   # 9: xor rdx, qword fs:[0x28]
0x00405431   # 9: mov rax, qword fs:[0x28]
0x004054ea   # 9: xor rbx, qword fs:[0x28]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.