fs are special. They are called segment registers and contain not addresses but selectors.
A selector is used by the CPU as a reference to a segment - area of memory with a specific base (start address), limit (end address) and permissions.
Selectors and segments are set up by the OS and in theory there may be many different segments, however in practice all modern OSes use flat memory segments (0 to 0xFFFFFFFF for 32-bit processes) for the standard code and data segments (
ds)1. This means that in the expression
ss:[ebp+8], only the value of
EBP is used for calculating the address. In your case it is indeed correct that
EBP + 8 = 006FFB50 + 8 = 006FFB58
which matches the value shown in brackets.
However, the value after the
= sign in the debugger is not the result of the calculation but the value which is present in memory at that address. If you open a memory dump and go to address 006FFB58, you should see
The brackets in the debugger hint signify memory dereference, similarly to the assembly syntax.
fs are treated differently and are usually used for Thread Local Storage (TLS) block which is different for every thread and does not start at 0 so e.g. fs:0 does not map to the RAM address 0.