Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is the GS register used for on Windows? [duplicate]

I've found MSDN documentation on the purpose of the FS register:

https://msdn.microsoft.com/en-us/library/ms253960(v=vs.90).aspx

which states that:

"In an x86 environment, the FS register points to the current value of the Thread Information Block (TIB) structure."

But I cannot seem to find any rigorous documentation of the purpose of the GS register in a Windows based environment.

Can someone tell me where to look, or give an explanation?

like image 680
Shuzheng Avatar asked Dec 07 '22 21:12

Shuzheng


1 Answers

On 32 bit Windows GS is reserved for future use.
The FS segment points to the Thread information block.

In x64 mode the FS and GS segment registers have been swapped around.

In x86 mode FS:[0] points to the start of the TIB, in X64 it's GS:[0].
The reason Win64 uses GS is that there the FS register is used in the 32 bit compatibility layer (confusingly called Wow64).
Because 32-bit apps use FS the bookkeeping for Win64 is simplified.
32 bit applications never cause GS to be altered and 64 bit applications never cause FS to be altered.

Note that the fact that GS is non-zero in Win64 and Wow64 can be used to detect if a 32-bit application is running in 64-bit Windows.
In a 'true' 32 bit Windows GS is always zero.

like image 146
Johan Avatar answered Jan 05 '23 21:01

Johan