0

I came across an unfamilar syntax when studying a dissassembly with Ghidra.

One line contains

MOV EAX,GS:[0x14]

what does the colon syntax mean?

I'm actually fairly new to all of this, both ASM and Ghidra analysis. I understand that this instruction moves "something from somewhere" into the 32 bit register EAX, but I don't understand how to interpret either the GS or the colon symbols.

1201ProgramAlarm
  • 31,926
  • 7
  • 42
  • 52
FreelanceConsultant
  • 11,249
  • 25
  • 98
  • 189
  • 2
    Strong chance this is a thread local read - gs is a segment register: https://stackoverflow.com/questions/12234817/what-does-this-instruction-do-mov-gs0x14-eax – Michael Dorgan Mar 10 '21 at 22:36

1 Answers1

0

The colon means that this is a segment override, if you don't use the default segment register.

Devolus
  • 21,012
  • 12
  • 62
  • 109