FS默认为error，指向TIB

是不是就使SEH使用FS

fs:[0]指向线程的SEH链

在用户态下gs被置成0,这个段寄存器应该是没有使用,否则它表示的意思是:0环的段,段描述符在GDT的第0项,按Intel CPU的规则,GDT的第0项是不可用的,否则CPU异常,所以gs应该没有用

好深奥，不太明白！

FS:[0x00]  Win9x and NT Current SEH frame
FS:[0x04]  Win9x and NT Top of stack
FS:[0x08]  Win9x and NT Current bottom of stack
FS:[0x10]  NT Fiber data
FS:[0x14]  Win9x and NT Arbitrary data slot
FS:[0x18]  Win9x and NT Linear address of TIB（TEB--- 也叫做线程信息块 TIB）
FS:[0x20]  NT Process ID
FS:[0x24]  NT Current thread ID
FS:[0x2C]  Win9x and NT Linear address of the thread local storage array
FS:[0x30]  Pointer to PEB
FS:[0x34]  NT Current error number
FS:[0x38]  CountOfOwnedCriticalSections
FS:[0x3c]  CsrClientThread
FS:[0x40]  Win32ThreadInfo
FS:[0x44]  Win32ClientInfo[0x1f]
FS:[0xc0]  WOW32Reserved
FS:[0xc4]  CurrentLocale
FS:[0xc8]  FpSoftwareStatusRegister
FS:[0xcc]  SystemReserved1[0x36]
FS:[0x1a4] Spare1
FS:[0x1a8] ExceptionCode
FS:[0x1ac] SpareBytes1[0x28]
FS:[0x1d4] SystemReserved2[0xA]
FS:[0x1fc] GDI_TEB_BATCH
FS:[0x6dc] gdiRgn
FS:[0x6e0] gdiPen
FS:[0x6e4] gdiBrush
FS:[0x6e8] CLIENT_ID
FS:[0x6f0] GdiCachedProcessHandle
FS:[0x6f4] GdiClientPID
FS:[0x6f8] GdiClientTID
FS:[0x6fc] GdiThreadLocaleInfo
FS:[0x700] UserReserved[5]
FS:[0x714] glDispatchTable[0x118]
FS:[0xb74] glReserved1[0x1A]
FS:[0xbdc] glReserved2
FS:[0xbe0] glSectionInfo
FS:[0xbe4] glSection
FS:[0xbe8] glTable
FS:[0xbec] glCurrentRC
FS:[0xbf0] glContext
FS:[0xbf4] NTSTATUS
FS:[0xbf8] StaticUnicodeString
FS:[0xc00] StaticUnicodeBuffer[0x105]
FS:[0xe0c] DeallocationStack
FS:[0xe10] TlsSlots[0x40]
FS:[0xf10] TlsLinks
FS:[0xf18] Vdm
FS:[0xf1c] ReservedForNtRpc
FS:[0xf20] DbgSsReserved[0x2]
FS:[0xf28] HardErrorDisabled
FS:[0xf2c] Instrumentation[0x10]
FS:[0xf6c] WinSockData
FS:[0xf70] GdiBatchCount
FS:[0xf74] Spare2
FS:[0xf78] Spare3
FS:[0xf7c] Spare4
FS:[0xf80] ReservedForOle
FS:[0xf84] WaitingOnLoaderLock
FS:[0xf88] StackCommit
FS:[0xf8c] StackCommitMax
FS:[0xf90] StackReserve

楼上，请教一下，你是在哪得到这么详细的资料？？可以给个链接一类的吗？

[QUOTE=linxer;300686]fs:[0]指向线程的SEH链

在用户态下gs被置成0,这个段寄存器应该是没有使用,否则它表示的意思是:0环的段,段描述符在GDT的第0项,按Intel CPU的规则,GDT的第0项是不可用的,否则CPU异常,所以gs应该没有用[/QUOTE]

学习了

6搂的列表是一种情况，应该如下：

fs段在用户模式（Ring3）和系统模式（Ring0）分别指向两个最重要的系统结构：
Ring3:
fs --> TEB (Thread Environment Block)结构表 --> 7FFDE000
即“线程环境块”。

Ring0:
fs --> KPCR (Kernel Processor Control Region)结构表 --> FFFDF000
即“内核处理器控制域”。

fs:在不同层，指向不同的结构。