1

I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which separates the first operand MOV RAX from the second one qword ptr FS:[0x28]. What exactly does does qword ptr FS:[0x28] do?

3
  • This question is already answered here. stackoverflow.com/questions/10325713/…
    – Viktor
    Jul 20 at 0:46
  • Yeah, I already looked at that post, but it wasn't very clear to me.
    – greg5678
    Jul 20 at 0:52
  • 2
    This is intel syntax, so the value gets copied to RAX, not from. qword ptr FS:[0x28] just means it references a quadword at memory location 0x28 in the FS segment.
    – tkausl
    Jul 20 at 5:43

2 Answers 2

3

It is not clear from the context of the question but it depends on the platform, if you are on Windows then fs:[0x28] is the field ArbitraryUserPointer according to the following data structure.

ntdll!_NT_TIB
   +0x000 ExceptionList    : Ptr64 _EXCEPTION_REGISTRATION_RECORD
   +0x008 StackBase        : Ptr64 Void
   +0x010 StackLimit       : Ptr64 Void
   +0x018 SubSystemTib     : Ptr64 Void
   +0x020 FiberData        : Ptr64 Void
   +0x020 Version          : Uint4B
   +0x028 ArbitraryUserPointer : Ptr64 Void
   +0x030 Self             : Ptr64 _NT_TIB

You can find some information about this field in the TEB here:

0

The assembly you posted is in Intel syntax.

MOV RAX, qword ptr FS:[0x28]

The sentinel value stored is being copied into RAX, not from it. This code is part of a setup for copying the value into a stack canary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.