Oct. 3, 2016
8:11 p.m.
Dear all, When I analyzed one coredump and read some assembly code, I encounter one specific segment register : gs. I googled it and found the following links: [1] http://stackoverflow.com/questions/10810203/what-is-the-fs-gs-register-inten... [2] http://reverseengineering.stackexchange.com/questions/2006/how-are-the-segme... [3] http://stackoverflow.com/questions/6611346/how-are-the-fs-gs-registers-used-... In IA32 FS is used by Windows and GS by glibc to reference TLS entry. And in my 32bit linux, I found fs is 0 in my coredump and gs is 0x33. -- My best regards to you. No System Is Safe! Dongliang Mu