1

I'm disassembled my program and I'm trying to understand what is it:

MOV DWORD PTR FS:[0],ESP

What is FS? I searched in google, and I found that is use as extra register. But when is it use? Why?

Drew McGowen
  • 11,471
  • 1
  • 31
  • 57
dsaads
  • 23
  • 3

1 Answers1

2

The FS register is aligned with the thread information block, which contains various thread-specific information.

Of particular interest when disassembling is the head of the exception handler chain at offset zero.

  • is it handler for FIRST EXCEPTION will occur? – dsaads Sep 26 '14 at 11:51
  • In a sense, yes. FS:[0] points to the inner-most exception handler structure on stack. It in turn has a pointer to the next one, and so on. Any function that has an exception frame inserts that frame in this chain on entry and removes it again on exit. – 500 - Internal Server Error Sep 26 '14 at 11:55