i have started out reverse engineering with IDA Pro a few weeks ago. Currently i am reversing a heavily obfuscated file which uses many anti-reversing techniques and in particular relys heavily on exceptionhandling.

Therefore it would be really useful to get the address in fs:0 to easily set a breakpoint in the exceptionhandler(s) and analyze whats happening. Unfortunately i have not found a way in ida to grab that content. In x96dbg i would have this nice tab which gives me the whole TEB. Not so in IDA. I found this link which describes something similar to what i want but it seems to be absolutely outdated in IDA PRO 7.5.

Thus is there any way to get the address of fs:0? Or the content of it in IDA?

Thanks for helping :)

  • Okay i have found a way to get the excpetionhandlers through windbg with !exchain. Still it would be usefull to examine the TEB here and then. – crush3dice Mar 21 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.