mov eax, large fs:30h

debugging assembly x86 ida mov
daehee picture daehee · Jan 24, 2013 · Viewed 10.4k times · Source

I was analyzing some x86 binary and found the following instruction which I can not understand. Can someone please explain me following instruction?

mov     eax, large fs:30h

I googled this, and it turns out it is some anti-debugging stuff... but that's all I know.

what does large means?? And what does fs:30 means??

I know about segmentation but I don't know when the fs register is used. For say cs:, ds: are implicitly skipped when instruction is referencing code or data. But what is fs, and what is gs?

Answer

JasonD picture JasonD · Jan 24, 2013

Looks like it's Windows code, loading the address of the Process Environment Block (PEB), via the Thread Information Block, which can be accessed via the FS segment.

The PEB contains, amongest other things, a flag indicating if the process is being debugged.

MSDN has a page about it here

Related questions

What is your favourite anti-debugging trick?

At my previous employer we used a third party component which basically was just a DLL and a header file. That particular module handled printing in Win32. However, the company that made the component went bankcrupt so I couldn't report …

Read More
Is it possible to "decompile" a Windows .exe? Or at least view the Assembly?

A friend of mine downloaded some malware from Facebook, and I'm curious to see what it does without infecting myself. I know that you can't really decompile an .exe, but can I at least view it in Assembly or attach …

Read More
How do you get assembler output from C/C++ source in gcc?

How does one do this? If I want to analyze how something is getting compiled, how would I get the emitted assembly code?

Read More