I'm reading how SEH is implemented in Win32 and I came across this thing called the FS register. I couldn't find anything good on Google (most probably I may be searching for the wrong thing). So can anyone explain what it is?
1 Answer
It's a segment register. The x86 has six of them: CS, DS, ES, SS, FS and GS (FS and GS were new in 80386). The mnemonics come from their roles: code segment, data segment, extended segment (in fact, an auxiliary register), stack segment. These roles are hard-coded in the semantics of x86 assembly instructions. FS and GS are auxiliary like ES so they just bear the next letters after E.
In 32-bit protected mode as it's typically used (e.g., in Windows, Linux, *BSD), CS, DS, ES and SS are all set with a base of 0 and a limit of 4Gig, and memory protection is done only with page permissions. FS points to a Thread Information Block (TIB) in user mode and to Processor Control Region (KPCR) in kernel mode. Matt Pietrek wrote a pretty good article about it years ago that's still available on MSDN.
-
-
-
2@hab: AFAIK, they don't really mean anything -- they already had C, D and E, so when they added more, they used F and G, but don't seem to have had anything specific in mind for them to stand for. Feb 1, 2011 at 9:03
-
1@hab: yes, at least normally. Anything that indexes off of ESP (or EBP) uses SS by default. Feb 1, 2011 at 9:05
-
1Thanks for the answer. Just TIB should be short for [Thread Information Block].– user1583636Aug 8, 2012 at 5:14