16

I was analyzing some x86 binary and found the following instruction which I can not understand. Can someone please explain me following instruction?

mov     eax, large fs:30h

I googled this, and it turns out it is some anti-debugging stuff... but that's all I know.

what does large means?? And what does fs:30 means??

I know about segmentation but I don't know when the fs register is used. For say cs:, ds: are implicitly skipped when instruction is referencing code or data. But what is fs, and what is gs?

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
daehee
  • 5,047
  • 7
  • 44
  • 70

1 Answers1

15

Looks like it's Windows code, loading the address of the Process Environment Block (PEB), via the Thread Information Block, which can be accessed via the FS segment.

The PEB contains, amongest other things, a flag indicating if the process is being debugged.

MSDN has a page about it here

JasonD
  • 16,464
  • 2
  • 29
  • 44
  • Via Thread Environment Block (TEB) _TEB `+0x030 ProcessEnvironmentBlock : Ptr32 _PEB` Thread Information Block (TIB) _NT_TIB - first member of TEB `+0x000 NtTib : _NT_TIB` – Serg Jan 24 '13 at 13:36
  • Yes, exactly. fs:[30] + 0xC = PEB_LDR_Data, + 0x0C = InMemoryOrderModuleList of loaded modules. Then you can explore their exports. – GalacticJello May 04 '13 at 05:58