What is the meaning of kernel32.BaseThreadInitThunk?

Question

i try to analyze a program in assembly using ollydbg. In the first line i have the following:

MOV EAX, DWORD PTR FS:[0]

In the register window, i ve got the information:

EAX 7570EE0A kernel32.BaseThreadInitThunk

and in another window about FS the following:

FS:[00000000]=[7FFDF000]=0012FFC4

So, my questions would be:

1. What is the difference between DWORD PTR FS and DWORD PTR DS ? Normally, I always see DWORD PTR DS and not DWORD PTR FS.

2. What is kernel32.BaseThreadInitThunk ? It is a function?

I hope that someone can help me.

Answer 1

What is the difference between DWORD PTR FS and DWORD PTR DS ?

Check this - Segment_Registers

On Windows fs[0] points TEB

What is kernel32.BaseThreadInitThunk ? It is a function?

Yes it is. It's quite simple and is used only to execute your thread's function.

Answer 2

Segment registers were historically used to allow 16-bit code to address more than 16 bits (64KB) of address space. Code could be pointed to with the CS segment, data with DS, etc. FS was an "extra" segment that could be used however necessary. You can read more about segmentation on wikipedia. Modern architectures don't use segment registers, with the exception of FS and GS.