1

I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which separates the first operand MOV RAX from the second one qword ptr FS:[0x28]. What exactly does does qword ptr FS:[0x28] do?

Improve this question
3
  • This question is already answered here. stackoverflow.com/questions/10325713/…
    – Viktor
    Commented Jul 20, 2022 at 0:46
  • Yeah, I already looked at that post, but it wasn't very clear to me.
    – greg5678
    Commented Jul 20, 2022 at 0:52
  • 2
    This is intel syntax, so the value gets copied to RAX, not from. qword ptr FS:[0x28] just means it references a quadword at memory location 0x28 in the FS segment.
    – tkausl
    Commented Jul 20, 2022 at 5:43

2 Answers 2

Reset to default
3

It is not clear from the context of the question but it depends on the platform, if you are on Windows then fs:[0x28] is the field ArbitraryUserPointer according to the following data structure.

ntdll!_NT_TIB
   +0x000 ExceptionList    : Ptr64 _EXCEPTION_REGISTRATION_RECORD
   +0x008 StackBase        : Ptr64 Void
   +0x010 StackLimit       : Ptr64 Void
   +0x018 SubSystemTib     : Ptr64 Void
   +0x020 FiberData        : Ptr64 Void
   +0x020 Version          : Uint4B
   +0x028 ArbitraryUserPointer : Ptr64 Void
   +0x030 Self             : Ptr64 _NT_TIB

You can find some information about this field in the TEB here:

Improve this answer
0

The assembly you posted is in Intel syntax.

MOV RAX, qword ptr FS:[0x28]

The sentinel value stored is being copied into RAX, not from it. This code is part of a setup for copying the value into a stack canary.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.