Could someone explain about large fs:0?

exception assembly x86 guard disassembly
bTagTiger picture bTagTiger · Mar 28, 2013 · Viewed 8.6k times · Source 
:0378CED0                 push    ebp    
:0378CED1                 mov     ebp, esp     
:0378CED3                 push    0FFFFFFFFh    
:0378CED5                 push    3927B50h    
:0378CEDA                 push    38DB344h   
:0378CEDF                 mov     eax, large fs:0    
:0378CEE5                 push    eax   
:0378CEE6                 mov     large fs:0, esp   
:0378CEED                 add     esp, 0FFFFF928h   
:0378CEF3                 push    ebx   
:0378CEF4                 push    esi   
:0378CEF5                 push    edi   
:0378CEF6                 mov     [ebp+var_18], esp   
:0378CEF9                 mov     [ebp+var_20], 1   
:0378CF00                 mov     [ebp+var_1C], 0   
:0378CF07                 mov     eax, [ebp+arg_8]    
:0378CF0A                 mov     [ebp+var_230], eax   
:0378CF10                 mov     [ebp+var_22C], 0   
:0378CF1A                 mov     [ebp+var_4], 0   
:0378CF21                 jmp     loc_3B62B79

I can't understand what it means from 0378CEDF to 0378CEE6. Please someone explain this... Thanks.

Answer

douglasquaid84 picture douglasquaid84 · Sep 21, 2013

On windows the segment register FS points to the Win32 Thread Information Block. http://en.wikipedia.org/wiki/Win32_Thread_Information_Block

so if this is code is from a win32 app then 0378CEDF to 0378CEE6 is saving FS:0 (SEH frame) and then overwriting it with whatever's in esp.

Related questions

How can I safely create a nested directory?

What is the most elegant way to check if the directory a file is going to be written to exists, and if not, create the directory using Python? Here is what I tried: import os file_path = "/my/directory/filename.…

Read More
Manually raising (throwing) an exception in Python

How can I raise an exception in Python so that it can later be caught via an except block?

Read More
How do you assert that a certain exception is thrown in JUnit 4 tests?

How can I use JUnit4 idiomatically to test that some code throws an exception? While I can certainly do something like this: @Test public void testFooThrowsIndexOutOfBoundsException() { boolean thrown = false; try { foo.doStuff(); } catch (IndexOutOfBoundsException e) { thrown = true; } assertTrue(thrown); } I …

Read More