I've found MSDN documentation on the purpose of the FS register:
https://msdn.microsoft.com/en-us/library/ms253960(v=vs.90).aspx
which states that:
"In an x86 environment, the FS register points to the current value of the Thread Information Block (TIB) structure."
But I cannot seem to find any rigorous documentation of the purpose of the GS register in a Windows based environment.
Can someone tell me where to look, or give an explanation?
On 32 bit Windows GS is reserved for future use.
The FS segment points to the Thread information block.
In x64 mode the FS and GS segment registers have been swapped around.
In x86 mode FS:[0] points to the start of the TIB, in X64 it's GS:[0].
The reason Win64 uses GS is that there the FS register is used in the 32 bit compatibility layer (confusingly called Wow64).
Because 32-bit apps use FS the bookkeeping for Win64 is simplified.
32 bit applications never cause GS to be altered and 64 bit applications never cause FS to be altered.
Note that the fact that GS is non-zero in Win64 and Wow64 can be used to detect if a 32-bit application is running in 64-bit Windows.
In a 'true' 32 bit Windows GS is always zero.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With