FS: [124] corresponds to currentthread

During the disassembly of kernel functions, mov eax, FS: [124] is often seen. It has never been clear what the FS register stores in ring0. I checked the information today.

The FS register points in ring0 to a data structure called kpcr, that is, the starting point of the FS segment is aligned with the kpcr structure.

The details are as follows:

Kd> dt _ kpcr
NT! _ Kpcr
+ 0x000 nttib: _ nt_tib
+ 0x01c selfpcr: ptr32 _ kpcr
+ 0x020 prcb: ptr32 _ kprcb
+ 0x024 IRQL: uchar
+ 0x028 IRR: uint4b
+ 0x02c irractive: uint4b
+ 0x030 IDR: uint4b
+ 0x034 kdversionblock: ptr32 void
+ 0x038 IDT: ptr32 _ kidtentry
+ 0x03c gdt: ptr32 _ kgdtentry
+ 0x040 TSS: ptr32 _ ktss
+ 0x044 majorversion: uint2b
+ 0x046 minorversion: uint2b
+ 0x048 setmember: uint4b
+ 0x04c stallscalefactor: uint4b
+ 0x050 debugactive: uchar
+ 0x051 number: uchar
+ 0x052 spare0: uchar
+ 0x053 secondlevelcacheassociativity: uchar
+ 0x054 vdmalert: uint4b
+ 0x058 kernelreserved: [14] uint4b
+ 0x090 secondlevelcachesize: uint4b
+ 0x094 halreserved: [16] uint4b
+ 0x0d4 interruptmode: uint4b
+ 0x0d8 spare1: uchar
+ 0x0dc kernelreserved2: [17] uint4b

+ 0x120 prcbdata: _ kprcb

Kd> dt _ kprcb
NT! _ Kprcb
+ 0x000 minorversion: uint2b
+ 0x002 majorversion: uint2b
+ 0x004 currentthread: ptr32 _ kthread
+ 0x008 nextthread: ptr32 _ kthread
+ 0x00c idlethread: ptr32 _ kthread
......