9

In looking at some assembly, I have come across a few instructions using segment prefixes. For example

<address>: ....  mov eax,DWORD PTR gs:0x20

I understand the basics of memory segments, but how could I get the 'absolute' memory address (particularly in GDB) of the data being accessed here? For example, I may want to break on further access, or examine the memory in that area.

Edit: I know how to get the value of $gs, but not sure how to use that information with the given instruction to get the actual address of memory. And yes, this is under Linux.

perror
  • 19,083
  • 29
  • 87
  • 150
HenryC
  • 91
  • 1
  • 3
    You should specify what operating system you are targeting because the usage of these register is OS dependent (though I suppose this is a Unix-based system because you refer to GDB). – perror Jul 11 '14 at 08:09
  • 1
    Are you ask how you get the value of GS or how to use that value to make absolute address? – Simeon Pilgrim Jul 11 '14 at 13:43

1 Answers1

10

On Linux, in protected mode, the segment registers aren't standard "segments" anymore, instead, they're called selectors, and include information if the segment is readable/writable/executable. The real address they're pointing to is "hidden" in a table in the kernel and the segment register is used as an index into that table, but the physical address shouldn't matter to you much anyway, since your application deals with virtual memory only, and the virtual address that gs maps to isn't even accessible in your "normal", ds/ss-referenced, virtual address space.

Linux uses the gs register to make some per-cpu-information available to the process. The special offset 0x20, which you're using in your example, is initialized to some random value, which the compiler reads whenever it enters a function and writes on the stack, and checks when the functions terminates, to detect buffer overflows.

Read more about the overflow protection on wikipedia, and more about the percpu structure in the linux kernel source.

Guntram Blohm
  • 12,950
  • 2
  • 22
  • 32
  • 1
    On Windows, you can use GetThreadSelectorEntry() in user-mode to get the base address of a segment. But as @guntram-blohm said above, it looks like there's no such user-mode functionality in Linux. – Jason Geffner Jul 11 '14 at 18:11
  • In his particular example, as well, it looks like it's just the glibc stack canary code anyways, although thread local storage uses fs or gs typically as well. – broadway Jul 12 '14 at 00:09