windowsnt-native-api

What lies at fs:[0x0] on windows?


The TEB on 32-bit Windows is located at fs:[0x0018]. What exactly is found in those 24 bytes between fs:0 and fs:0x18? (Yes, I know this undocumented and subject to change, but it'd be interesting to know...)


Solution

  • It is start of Thread Information Block at FS:[0]. The very first field of this structure is Current Structured Exception Handling (SEH) frame.

    Thus, at FS:[0] is the pointer to ExceptionList

    Source

    It is pointer to Exception Callback Functions linked list head.

    BTW it is pretty documented and everything from FS:[0] to FS:[0x1C] (excluding) is not part of change, it is very basic structure, MS would not change it in NT OSes.