News:

MASM32 SDK Description, downloads and other helpful links
MASM32.com New Forum Link
masmforum WebSite

FS

Started by AeroASM, May 05, 2005, 04:27:05 PM

Previous topic - Next topic

AeroASM

What segment does the FS register point to and how can it be useful to me?

Many thanks

roticv

Windows use flat memory model, where cs=ds=ss. But this is not the case for fs.

It is usually used for SEH (structured error handling) and misc data like the highly undocumentated PEB and other windows internal structures.

AeroASM

WHere is the best place to find out about this stuff?

pbrennick

Aero,
As roticv has said, it is undocumented.  Good luck finding or asking for any info from Microsoft or anyone else.  Also, this is a very dangerous (to the process) to mess around here.  fs:[4h] and fs:[8h] are easy to track so we know what they do.  Other addresses...

hth:
Paul

pbrennick

Aero:
BTW:  Since I know you are working on an OS, remember that FS is pointing to an address in the Ring3 space, the OS is in Ring0 and has a totally different value for FS.  Look at http://silverstr.ufies.org/lotr0/ for kernel development info using Ring0.

hth:
Paul

MazeGen

Check this thread out too, or search for "FS".

Petroizki


thomasantony

Hi,
   Aeor, remember that WE make the OS. Nobody else decide what is in FS. We decide. Maybe, while in console mode, we can have GS point to the Video Selector so we can write directly to video memory using GS:[0], GS:[1] etc. FS we can point to somewhere else maybe in our own PCB(Process Control Block)

Thomas :U
There are 10 types of people in the world. Those who understand binary and those who don't.


Programmer's Directory. Submit for free

chep

Hello,

First I have to thank everyone here for your great job :clap:. I've been wandering here for some time now and find this board quite instructive.

At last here is my small contribution to the board :wink.

Quote from: pbrennick on May 05, 2005, 04:39:31 PM
As roticv has said, it is undocumented.  Good luck finding or asking for any info from Microsoft or anyone else.  Also, this is a very dangerous (to the process) to mess around here.  fs:[4h] and fs:[8h] are easy to track so we know what they do.  Other addresses...

Four-F's KmdKit (http://www.freewebs.com/four-f/) contains some useful STRUCT definitions along with (sparse) comments.
This article http://www.relsoft.net/part1.html somehow explains NT's TIB/TEB/PEB structures. Not 100% accurate though, but it's worth reading as it contains sentences :green.

Hope this helps.