4

i try to analyze a program in assembly using ollydbg. In the first line i have the following:

MOV EAX, DWORD PTR FS:[0]

In the register window, i ve got the information:

EAX 7570EE0A kernel32.BaseThreadInitThunk

and in another window about FS the following:

FS:[00000000]=[7FFDF000]=0012FFC4

So, my questions would be:

  1. What is the difference between DWORD PTR FS and DWORD PTR DS ? Normally, I always see DWORD PTR DS and not DWORD PTR FS.

  2. What is kernel32.BaseThreadInitThunk ? It is a function?

I hope that someone can help me.

3

What is the difference between DWORD PTR FS and DWORD PTR DS ?

Check this - Segment_Registers

On Windows fs[0] points TEB

What is kernel32.BaseThreadInitThunk ? It is a function?

Yes it is. It's quite simple and is used only to execute your thread's function.

1

Segment registers were historically used to allow 16-bit code to address more than 16 bits (64KB) of address space. Code could be pointed to with the CS segment, data with DS, etc. FS was an "extra" segment that could be used however necessary. You can read more about segmentation on wikipedia. Modern architectures don't use segment registers, with the exception of FS and GS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.