6

When I disassemble a function, I encounter from time to time an expression of the form %reg:value. Typically, I encounter this syntax when I activate the canaries in GCC (-fstack-protector), as in the following example:

(gdb) disas
Dump of assembler code for function foo:
   0x000000000040057c <+0>: push   %rbp
   0x000000000040057d <+1>: mov    %rsp,%rbp
   0x0000000000400580 <+4>: sub    $0x20,%rsp
   0x0000000000400584 <+8>: mov    %edi,-0x14(%rbp)
=> 0x0000000000400587 <+11>:    mov    %fs:0x28,%rax
   0x0000000000400590 <+20>:    mov    %rax,-0x8(%rbp)
   0x0000000000400594 <+24>:    xor    %eax,%eax
   0x0000000000400596 <+26>:    mov    $0x4006ac,%edi
   0x000000000040059b <+31>:    callq  0x400440 <puts@plt>
   0x00000000004005a0 <+36>:    mov    -0x8(%rbp),%rax
   0x00000000004005a4 <+40>:    xor    %fs:0x28,%rax
   0x00000000004005ad <+49>:    je     0x4005b4 <foo+56>
   0x00000000004005af <+51>:    callq  0x400450 <__stack_chk_fail@plt>
   0x00000000004005b4 <+56>:    leaveq 
   0x00000000004005b5 <+57>:    retq

What is the meaning of this kind of syntax?

Improve this question

1 Answer 1

Reset to default
6

%fs:028h is actually using the form segment:offset, which means it is reaching the memory address at offset 28h in the segment selected by the Far Segment FS.

Any memory reference has an implicit segment (most of the time, CS for execution, DS for data read/write), which can be overriden by a segment prefix.

Improve this answer
7
  • This is Linux, not Windows.
    – Igor Skochinsky ♦
    May 3, 2013 at 8:10
  • So, we could have write it: 0x28(%fs), why another syntax for the same thing ?
    – perror
    May 3, 2013 at 8:48
  • @perror: please reread Ange's answer. FS is a segment register, so this syntax means an offset inside the segment pointed to by FS. There's no syntax for extracting bits from a register (x86 ISA does not support operands like that). 0x28(%fs) would mean value of FS plus 0x28 which is a different thing.
    – Igor Skochinsky ♦
    May 3, 2013 at 8:49
  • Okay, it means that the memory space addressed here is on the physical memory space and not the virtual one. Is it correct ?
    – perror
    May 3, 2013 at 8:53
  • @perror: nope. The values may differ between KM and UM. In UM you never get to see physical memory directly, unless it's a gaping security hole. fs and friends are usually referred to as selectors in flat address mode, since they don't quite have the same meaning as they used to in real mode.
    – 0xC0000022L ♦
    May 3, 2013 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.