FS registers in the Windows environment

• -FS register points to the TEB structure of the currently active thread

• 1 // struct _TEB 2 +0x000  nttib                   : _nt_tib3 ... 4 +0x030//  pointer to current process PEB

• -fs:[0x0] point to a _NT_TIB structure

• 1 // struct _nt_tib 2 +0x000 exceptionlist    //  SEH exception handling chain pointer 3 +0x004 StackBase        //  thread stack bottom pointer 4 +0x008 stacklimit       //  Thread stack limit 5 ...

FS Register in Windows environment