fs:[0]到底表示什么？fs段寄存器在WINDOWS系统中的作用

在进行WINDOWS开发的过程中，有一个重要的地址保存着每个程序或者说代码运行的关键信息，它就是fs:[0]地址的所指向的一块数据区，它其实就是用来保存当前进程关键信息的进程控制块数据结构，在内核态环境下，它表示的是进行控制块KPCB结构体，在用户态环境下，它的表示形式是线程控制块的用户态形式TEB，为了容易阅读，这里使用了REACTOS的相关源码来描述：

typedef struct _KPCR

{

_ANONYMOUS_UNION union

{

NT_TIB NtTib; //这里是当前线程的控制块

_ANONYMOUS_STRUCT struct

{

union _KGDTENTRY64 *GdtBase; ///gdt表

struct _KTSS64 *TssBase;

ULONG64 UserRsp;

struct _KPCR *Self;

struct _KPRCB *CurrentPrcb;

PKSPIN_LOCK_QUEUE LockArray;

PVOID Used_Self;

};

};

union _KIDTENTRY64 *IdtBase;

ULONG64 Unused[2];

KIRQL Irql;

UCHAR SecondLevelCacheAssociativity;

UCHAR ObsoleteNumber;

UCHAR Fill0;

ULONG Unused0[3];

USHORT MajorVersion;

USHORT MinorVersion;

ULONG StallScaleFactor;

PVOID Unused1[3];

ULONG KernelReserved[15];

ULONG SecondLevelCacheSize;

ULONG HalReserved[16];

ULONG Unused2;

PVOID KdVersionBlock;

PVOID Unused3;

ULONG PcrAlign1[24];

} KPCR, *PKPCR;

经常会有这样的使用方式：

mov eax, fs:[0];

mov ecx, dword ptr [ eax ];

这里访问的是PCB的第一个成员，就是线程控制块的第一个成员变量，就是ExceptionList，SEH异常控制块链表。

它的结构定义是：

typedef struct _NT_TIB {

struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList; //最常使用的异常控制块链表

PVOID StackBase;

PVOID StackLimit;

PVOID SubSystemTib;

_ANONYMOUS_UNION union {

PVOID FiberData;

ULONG Version;

} DUMMYUNIONNAME;

PVOID ArbitraryUserPointer;

struct _NT_TIB *Self;

} NT_TIB, *PNT_TIB;

用户态下的TEB结构体的定义：

typedef struct _TEB {

NT_TIB NtTib;

PVOID EnvironmentPointer;

CLIENT_ID ClientId;

PVOID ActiveRpcHandle;

PVOID ThreadLocalStoragePointer;

PPEB ProcessEnvironmentBlock;

ULONG LastErrorValue;

ULONG CountOfOwnedCriticalSections;

PVOID CsrClientThread;

PVOID Win32ThreadInfo; // PtiCurrent

ULONG Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH]; // User32 Client Info

PVOID WOW32Reserved; // used by WOW

LCID CurrentLocale;

ULONG FpSoftwareStatusRegister;

PVOID SystemReserved1[54]; // Used by FP emulator

PVOID Spare1; // unused

NTSTATUS ExceptionCode; // for RaiseUserException

UCHAR SpareBytes1[40];

PVOID SystemReserved2[10]; // Used by user/console for temp obja

GDI_TEB_BATCH GdiTebBatch; // Gdi batching

ULONG gdiRgn;

ULONG gdiPen;

ULONG gdiBrush;

CLIENT_ID RealClientId;

HANDLE GdiCachedProcessHandle;

ULONG GdiClientPID;

ULONG GdiClientTID;

PVOID GdiThreadLocalInfo;

PVOID UserReserved[5]; // unused

PVOID glDispatchTable[280]; // OpenGL

ULONG glReserved1[26]; // OpenGL

PVOID glReserved2; // OpenGL

PVOID glSectionInfo; // OpenGL

PVOID glSection; // OpenGL

PVOID glTable; // OpenGL

PVOID glCurrentRC; // OpenGL

PVOID glContext; // OpenGL

ULONG LastStatusValue;

UNICODE_STRING StaticUnicodeString;

WCHAR StaticUnicodeBuffer[STATIC_UNICODE_BUFFER_LENGTH];

PVOID DeallocationStack;

PVOID TlsSlots[TLS_MINIMUM_AVAILABLE];

LIST_ENTRY TlsLinks;

PVOID Vdm;

PVOID ReservedForNtRpc;

PVOID DbgSsReserved[2];

ULONG HardErrorsAreDisabled;

PVOID Instrumentation[16];

PVOID WinSockData; // WinSock

ULONG GdiBatchCount;

ULONG Spare2;

ULONG Spare3;

ULONG Spare4;

PVOID ReservedForOle;

ULONG WaitingOnLoaderLock;

} TEB;

它的成员ProcessEnvironmentBlock对应的PEB结构的定义：

typedef struct _PEB {

BOOLEAN InheritedAddressSpace; // These four fields cannot change unless the

BOOLEAN ReadImageFileExecOptions; //

BOOLEAN BeingDebugged; //

BOOLEAN SpareBool; //

HANDLE Mutant; // INITIAL_PEB structure is also updated.

PVOID ImageBaseAddress;

PPEB_LDR_DATA Ldr;

struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;

PVOID SubSystemData;

PVOID ProcessHeap;

PVOID FastPebLock;

PVOID FastPebLockRoutine;

PVOID FastPebUnlockRoutine;

ULONG EnvironmentUpdateCount;

PVOID KernelCallbackTable;

HANDLE EventLogSection;

PVOID EventLog;

PPEB_FREE_BLOCK FreeList;

ULONG TlsExpansionCounter;

PVOID TlsBitmap;

ULONG TlsBitmapBits[2]; // relates to TLS_MINIMUM_AVAILABLE

PVOID ReadOnlySharedMemoryBase;

PVOID ReadOnlySharedMemoryHeap;

PVOID *ReadOnlyStaticServerData;

PVOID AnsiCodePageData;

PVOID OemCodePageData;

PVOID UnicodeCaseTableData;

// Useful information for LdrpInitialize

ULONG NumberOfProcessors;

ULONG NtGlobalFlag;

// Passed up from MmCreatePeb from Session Manager registry key

LARGE_INTEGER CriticalSectionTimeout;

ULONG HeapSegmentReserve;

ULONG HeapSegmentCommit;

ULONG HeapDeCommitTotalFreeThreshold;

ULONG HeapDeCommitFreeBlockThreshold;

// Where heap manager keeps track of all heaps created for a process

// Fields initialized by MmCreatePeb. ProcessHeaps is initialized

// to point to the first free byte after the PEB and MaximumNumberOfHeaps

// is computed from the page size used to hold the PEB, less the fixed

// size of this data structure.

ULONG NumberOfHeaps;

ULONG MaximumNumberOfHeaps;

PVOID *ProcessHeaps;

//

//

PVOID GdiSharedHandleTable;

PVOID ProcessStarterHelper;

PVOID GdiDCAttributeList;

PVOID LoaderLock;

// Following fields filled in by MmCreatePeb from system values and/or

// image header.

ULONG OSMajorVersion;

ULONG OSMinorVersion;

ULONG OSBuildNumber;

ULONG OSPlatformId;

ULONG ImageSubsystem;

ULONG ImageSubsystemMajorVersion;

ULONG ImageSubsystemMinorVersion;

ULONG ImageProcessAffinityMask;

ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE];

} PEB, *PPEB;

真实的WINDOWS定义的形式为：

kd> dt ntkrnlpa!_KPCR

+0x000 NtTib : _NT_TIB

+0x01c SelfPcr : Ptr32 _KPCR

+0x020 Prcb : Ptr32 _KPRCB

+0x024 Irql : UChar

+0x028 IRR : Uint4B

+0x02c IrrActive : Uint4B

+0x030 IDR : Uint4B

+0x034 KdVersionBlock : Ptr32 Void

+0x038 IDT : Ptr32 _KIDTENTRY

+0x03c GDT : Ptr32 _KGDTENTRY

+0x040 TSS : Ptr32 _KTSS

+0x044 MajorVersion : Uint2B

+0x046 MinorVersion : Uint2B

+0x048 SetMember : Uint4B

+0x04c StallScaleFactor : Uint4B

+0x050 DebugActive : UChar

+0x051 Number : UChar

+0x052 Spare0 : UChar

+0x053 SecondLevelCacheAssociativity : UChar

+0x054 VdmAlert : Uint4B

+0x058 KernelReserved : [14] Uint4B

+0x090 SecondLevelCacheSize : Uint4B

+0x094 HalReserved : [16] Uint4B

+0x0d4 InterruptMode : Uint4B

+0x0d8 Spare1 : UChar

+0x0dc KernelReserved2 : [17] Uint4B

+0x120 PrcbData : _KPRCB

它的第3个成员Prcb的KPRCB结构的定义为：

dt ntkrnlpa!_KPRCB

+0x000 MinorVersion : Uint2B

+0x002 MajorVersion : Uint2B

+0x004 CurrentThread : Ptr32 _KTHREAD

+0x008 NextThread : Ptr32 _KTHREAD

+0x00c IdleThread : Ptr32 _KTHREAD

+0x010 Number : Char

+0x011 Reserved : Char

+0x012 BuildType : Uint2B

+0x014 SetMember : Uint4B

+0x018 CpuType : Char

+0x019 CpuID : Char

+0x01a CpuStep : Uint2B

+0x01c ProcessorState : _KPROCESSOR_STATE

+0x33c KernelReserved : [16] Uint4B

+0x37c HalReserved : [16] Uint4B

+0x3bc PrcbPad0 : [92] UChar

+0x418 LockQueue : [16] _KSPIN_LOCK_QUEUE

+0x498 PrcbPad1 : [8] UChar

+0x4a0 NpxThread : Ptr32 _KTHREAD

+0x4a4 InterruptCount : Uint4B

+0x4a8 KernelTime : Uint4B

+0x4ac UserTime : Uint4B

+0x4b0 DpcTime : Uint4B

+0x4b4 DebugDpcTime : Uint4B

+0x4b8 InterruptTime : Uint4B

+0x4bc AdjustDpcThreshold : Uint4B

+0x4c0 PageColor : Uint4B

+0x4c4 SkipTick : Uint4B

+0x4c8 MultiThreadSetBusy : UChar

+0x4c9 Spare2 : [3] UChar

+0x4cc ParentNode : Ptr32 _KNODE

+0x4d0 MultiThreadProcessorSet : Uint4B

+0x4d4 MultiThreadSetMaster : Ptr32 _KPRCB

+0x4d8 ThreadStartCount : [2] Uint4B

+0x4e0 CcFastReadNoWait : Uint4B

+0x4e4 CcFastReadWait : Uint4B

+0x4e8 CcFastReadNotPossible : Uint4B

+0x4ec CcCopyReadNoWait : Uint4B

+0x4f0 CcCopyReadWait : Uint4B

+0x4f4 CcCopyReadNoWaitMiss : Uint4B

+0x4f8 KeAlignmentFixupCount : Uint4B

+0x4fc KeContextSwitches : Uint4B

+0x500 KeDcacheFlushCount : Uint4B

+0x504 KeExceptionDispatchCount : Uint4B

+0x508 KeFirstLevelTbFills : Uint4B

+0x50c KeFloatingEmulationCount : Uint4B

+0x510 KeIcacheFlushCount : Uint4B

+0x514 KeSecondLevelTbFills : Uint4B

+0x518 KeSystemCalls : Uint4B

+0x51c SpareCounter0 : [1] Uint4B

+0x520 PPLookasideList : [16] _PP_LOOKASIDE_LIST

+0x5a0 PPNPagedLookasideList : [32] _PP_LOOKASIDE_LIST

+0x6a0 PPPagedLookasideList : [32] _PP_LOOKASIDE_LIST

+0x7a0 PacketBarrier : Uint4B

+0x7a4 ReverseStall : Uint4B

+0x7a8 IpiFrame : Ptr32 Void

+0x7ac PrcbPad2 : [52] UChar

+0x7e0 CurrentPacket : [3] Ptr32 Void

+0x7ec TargetSet : Uint4B

+0x7f0 WorkerRoutine : Ptr32 void

+0x7f4 IpiFrozen : Uint4B

+0x7f8 PrcbPad3 : [40] UChar

+0x820 RequestSummary : Uint4B

+0x824 SignalDone : Ptr32 _KPRCB

+0x828 PrcbPad4 : [56] UChar

+0x860 DpcListHead : _LIST_ENTRY

+0x868 DpcStack : Ptr32 Void

+0x86c DpcCount : Uint4B

+0x870 DpcQueueDepth : Uint4B

+0x874 DpcRoutineActive : Uint4B

+0x878 DpcInterruptRequested : Uint4B

+0x87c DpcLastCount : Uint4B

+0x880 DpcRequestRate : Uint4B

+0x884 MaximumDpcQueueDepth : Uint4B

+0x888 MinimumDpcRate : Uint4B

+0x88c QuantumEnd : Uint4B

+0x890 PrcbPad5 : [16] UChar

+0x8a0 DpcLock : Uint4B

+0x8a4 PrcbPad6 : [28] UChar

+0x8c0 CallDpc : _KDPC

+0x8e0 ChainedInterruptList : Ptr32 Void

+0x8e4 LookasideIrpFloat : Int4B

+0x8e8 SpareFields0 : [6] Uint4B

+0x900 VendorString : [13] UChar

+0x90d InitialApicId : UChar

+0x90e LogicalProcessorsPerPhysicalProcessor : UChar

+0x910 MHz : Uint4B

+0x914 FeatureBits : Uint4B

+0x918 UpdateSignature : _LARGE_INTEGER

+0x920 NpxSaveArea : _FX_SAVE_AREA

+0xb30 PowerState : _PROCESSOR_POWER_STATE

第1个成员NtTib对应的NT_TIB结构定义如下：

nt!_NT_TIB

+0x000 ExceptionList : Ptr32 _EXCEPTION_REGISTRATION_RECORD

+0x004 StackBase : Ptr32 Void

+0x008 StackLimit : Ptr32 Void

+0x00c SubSystemTib : Ptr32 Void

+0x010 FiberData : Ptr32 Void

+0x010 Version : Uint4B

+0x014 ArbitraryUserPointer : Ptr32 Void

+0x018 Self : Ptr32 _NT_TIB

在用户态环境下，fs:[0]对应的TEB结构定义：

dt nt!_TEB

+0x000 NtTib : _NT_TIB

+0x01c EnvironmentPointer : Ptr32 Void

+0x020 ClientId : _CLIENT_ID

+0x028 ActiveRpcHandle : Ptr32 Void

+0x02c ThreadLocalStoragePointer : Ptr32 Void

+0x030 ProcessEnvironmentBlock : Ptr32 _PEB

+0x034 LastErrorValue : Uint4B

+0x038 CountOfOwnedCriticalSections : Uint4B

+0x03c CsrClientThread : Ptr32 Void

+0x040 Win32ThreadInfo : Ptr32 Void

+0x044 User32Reserved : [26] Uint4B

+0x0ac UserReserved : [5] Uint4B

+0x0c0 WOW32Reserved : Ptr32 Void

+0x0c4 CurrentLocale : Uint4B

+0x0c8 FpSoftwareStatusRegister : Uint4B

+0x0cc SystemReserved1 : [54] Ptr32 Void

+0x1a4 ExceptionCode : Int4B

+0x1a8 ActivationContextStack : _ACTIVATION_CONTEXT_STACK

+0x1bc SpareBytes1 : [24] UChar

+0x1d4 GdiTebBatch : _GDI_TEB_BATCH

+0x6b4 RealClientId : _CLIENT_ID

+0x6bc GdiCachedProcessHandle : Ptr32 Void

+0x6c0 GdiClientPID : Uint4B

+0x6c4 GdiClientTID : Uint4B

+0x6c8 GdiThreadLocalInfo : Ptr32 Void

+0x6cc Win32ClientInfo : [62] Uint4B

+0x7c4 glDispatchTable : [233] Ptr32 Void

+0xb68 glReserved1 : [29] Uint4B

+0xbdc glReserved2 : Ptr32 Void

+0xbe0 glSectionInfo : Ptr32 Void

+0xbe4 glSection : Ptr32 Void

+0xbe8 glTable : Ptr32 Void

+0xbec glCurrentRC : Ptr32 Void

+0xbf0 glContext : Ptr32 Void

+0xbf4 LastStatusValue : Uint4B

+0xbf8 StaticUnicodeString : _UNICODE_STRING

+0xc00 StaticUnicodeBuffer : [261] Uint2B

+0xe0c DeallocationStack : Ptr32 Void

+0xe10 TlsSlots : [64] Ptr32 Void

+0xf10 TlsLinks : _LIST_ENTRY

+0xf18 Vdm : Ptr32 Void

+0xf1c ReservedForNtRpc : Ptr32 Void

+0xf20 DbgSsReserved : [2] Ptr32 Void

+0xf28 HardErrorsAreDisabled : Uint4B

+0xf2c Instrumentation : [16] Ptr32 Void

+0xf6c WinSockData : Ptr32 Void

+0xf70 GdiBatchCount : Uint4B

+0xf74 InDbgPrint : UChar

+0xf75 FreeStackOnTermination : UChar

+0xf76 HasFiberData : UChar

+0xf77 IdealProcessor : UChar

+0xf78 Spare3 : Uint4B

+0xf7c ReservedForPerf : Ptr32 Void

+0xf80 ReservedForOle : Ptr32 Void

+0xf84 WaitingOnLoaderLock : Uint4B

+0xf88 Wx86Thread : _Wx86ThreadState

+0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void

+0xf98 ImpersonationLocale : Uint4B

+0xf9c IsImpersonating : Uint4B

+0xfa0 NlsCache : Ptr32 Void

+0xfa4 pShimData : Ptr32 Void

+0xfa8 HeapVirtualAffinity : Uint4B

+0xfac CurrentTransactionHandle : Ptr32 Void

+0xfb0 ActiveFrame : Ptr32 _TEB_ACTIVE_FRAME

+0xfb4 SafeThunkCall : UChar

+0xfb5 BooleanSpare : [3] UChar

它的成员ProcessEnvironmentBlock对应的_PEB结构的定义：

nt!_PEB

+0x000 InheritedAddressSpace : UChar

+0x001 ReadImageFileExecOptions : UChar

+0x002 BeingDebugged : UChar

+0x003 SpareBool : UChar

+0x004 Mutant : Ptr32 Void

+0x008 ImageBaseAddress : Ptr32 Void

+0x00c Ldr : Ptr32 _PEB_LDR_DATA

+0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS

+0x014 SubSystemData : Ptr32 Void

+0x018 ProcessHeap : Ptr32 Void

+0x01c FastPebLock : Ptr32 _RTL_CRITICAL_SECTION

+0x020 FastPebLockRoutine : Ptr32 Void

+0x024 FastPebUnlockRoutine : Ptr32 Void

+0x028 EnvironmentUpdateCount : Uint4B

+0x02c KernelCallbackTable : Ptr32 Void

+0x030 SystemReserved : [1] Uint4B

+0x034 AtlThunkSListPtr32 : Uint4B

+0x038 FreeList : Ptr32 _PEB_FREE_BLOCK

+0x03c TlsExpansionCounter : Uint4B

+0x040 TlsBitmap : Ptr32 Void

+0x044 TlsBitmapBits : [2] Uint4B

+0x04c ReadOnlySharedMemoryBase : Ptr32 Void

+0x050 ReadOnlySharedMemoryHeap : Ptr32 Void

+0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void

+0x058 AnsiCodePageData : Ptr32 Void

+0x05c OemCodePageData : Ptr32 Void

+0x060 UnicodeCaseTableData : Ptr32 Void

+0x064 NumberOfProcessors : Uint4B

+0x068 NtGlobalFlag : Uint4B

+0x070 CriticalSectionTimeout : _LARGE_INTEGER

+0x078 HeapSegmentReserve : Uint4B

+0x07c HeapSegmentCommit : Uint4B

+0x080 HeapDeCommitTotalFreeThreshold : Uint4B

+0x084 HeapDeCommitFreeBlockThreshold : Uint4B

+0x088 NumberOfHeaps : Uint4B

+0x08c MaximumNumberOfHeaps : Uint4B

+0x090 ProcessHeaps : Ptr32 Ptr32 Void

+0x094 GdiSharedHandleTable : Ptr32 Void

+0x098 ProcessStarterHelper : Ptr32 Void

+0x09c GdiDCAttributeList : Uint4B

+0x0a0 LoaderLock : Ptr32 Void

+0x0a4 OSMajorVersion : Uint4B

+0x0a8 OSMinorVersion : Uint4B

+0x0ac OSBuildNumber : Uint2B

+0x0ae OSCSDVersion : Uint2B

+0x0b0 OSPlatformId : Uint4B

+0x0b4 ImageSubsystem : Uint4B

+0x0b8 ImageSubsystemMajorVersion : Uint4B

+0x0bc ImageSubsystemMinorVersion : Uint4B

+0x0c0 ImageProcessAffinityMask : Uint4B

+0x0c4 GdiHandleBuffer : [34] Uint4B

+0x14c PostProcessInitRoutine : Ptr32 void

+0x150 TlsExpansionBitmap : Ptr32 Void

+0x154 TlsExpansionBitmapBits : [32] Uint4B

+0x1d4 SessionId : Uint4B

+0x1d8 AppCompatFlags : _ULARGE_INTEGER

+0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER

+0x1e8 pShimData : Ptr32 Void

+0x1ec AppCompatInfo : Ptr32 Void

+0x1f0 CSDVersion : _UNICODE_STRING

+0x1f8 ActivationContextData : Ptr32 Void

+0x1fc ProcessAssemblyStorageMap : Ptr32 Void

+0x200 SystemDefaultActivationContextData : Ptr32 Void

+0x204 SystemAssemblyStorageMap : Ptr32 Void

+0x208 MinimumStackCommit : Uint4B

使用以上信息来查询相关的数据访问指令，可以搞清楚操作的含义。