6

I'm reading how SEH is implemented in Win32 and I came across this thing called the FS register. I couldn't find anything good on Google (most probably I may be searching for the wrong thing). So can anyone explain what it is?

1 Answer 1

12

It's a segment register. The x86 has six of them: CS, DS, ES, SS, FS and GS (FS and GS were new in 80386). The mnemonics come from their roles: code segment, data segment, extended segment (in fact, an auxiliary register), stack segment. These roles are hard-coded in the semantics of x86 assembly instructions. FS and GS are auxiliary like ES so they just bear the next letters after E.

In 32-bit protected mode as it's typically used (e.g., in Windows, Linux, *BSD), CS, DS, ES and SS are all set with a base of 0 and a limit of 4Gig, and memory protection is done only with page permissions. FS points to a Thread Information Block (TIB) in user mode and to Processor Control Region (KPCR) in kernel mode. Matt Pietrek wrote a pretty good article about it years ago that's still available on MSDN.

5
  • What do they mean? like CS is Code Segment. What's FS and GS?
    – akif
    Feb 1, 2011 at 8:56
  • and if SS is stack segment then ESP points to a region in SS?
    – akif
    Feb 1, 2011 at 9:02
  • 2
    @hab: AFAIK, they don't really mean anything -- they already had C, D and E, so when they added more, they used F and G, but don't seem to have had anything specific in mind for them to stand for. Feb 1, 2011 at 9:03
  • 1
    @hab: yes, at least normally. Anything that indexes off of ESP (or EBP) uses SS by default. Feb 1, 2011 at 9:05
  • 1
    Thanks for the answer. Just TIB should be short for [Thread Information Block].
    – user1583636
    Aug 8, 2012 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.