Home/ Questions/Q 9183403
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T18:47:38+00:00

I was analyzing some x86 binary and found the following instruction which I can

  • 0

I was analyzing some x86 binary and found the following instruction which I can not understand. Can someone please explain me following instruction?

mov     eax, large fs:30h

I googled this, and it turns out it is some anti-debugging stuff… but that’s all I know.

what does large means?? And what does fs:30 means??

I know about segmentation but I don’t know when the fs register is used. For say cs:, ds: are implicitly skipped when instruction is referencing code or data. But what is fs, and what is gs?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Looks like it’s Windows code, loading the address of the Process Environment Block (PEB), via the Thread Information Block, which can be accessed via the FS segment.

    The PEB contains, amongest other things, a flag indicating if the process is being debugged.

    MSDN has a page about it here

    • 0