I've found MSDN documentation on the purpose of the FS register:
https://msdn.microsoft.com/en-us/library/ms253960(v=vs.90).aspx
which states that:
"In an x86 environment, the FS register points to the current value of the Thread Information Block (TIB) structure."
But I cannot seem to find any rigorous documentation of the purpose of the GS register in a Windows based environment.
Can someone tell me where to look, or give an explanation?
On 32 bit Windows GS
is reserved for future use.
The FS
segment points to the Thread information block.
In x64 mode the FS
and GS
segment registers have been swapped around.
In x86 mode FS:[0]
points to the start of the TIB, in X64 it's GS:[0]
.
The reason Win64 uses GS
is that there the FS
register is used in the 32 bit compatibility layer (confusingly called Wow64).
Because 32-bit apps use FS
the bookkeeping for Win64 is simplified.
32 bit applications never cause GS
to be altered and 64 bit applications never cause FS
to be altered.
Note that the fact that GS
is non-zero in Win64 and Wow64 can be used to detect if a 32-bit application is running in 64-bit Windows.
In a 'true' 32 bit Windows GS
is always zero.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With