mov eax, large fs:30h

Question

I was analyzing some x86 binary and found the following instruction which I can not understand. Can someone please explain me following instruction?

mov     eax, large fs:30h

I googled this, and it turns out it is some anti-debugging stuff... but that's all I know.

what does large means?? And what does fs:30 means??

I know about segmentation but I don't know when the fs register is used. For say cs:, ds: are implicitly skipped when instruction is referencing code or data. But what is fs, and what is gs?

Solution

Looks like it's Windows code, loading the address of the Process Environment Block (PEB), via the Thread Information Block, which can be accessed via the FS segment.

The PEB contains, amongest other things, a flag indicating if the process is being debugged.

MSDN has a page about it here

Comments

[sergmat]

Via Thread Environment Block (TEB) _TEB +0x030 ProcessEnvironmentBlock : Ptr32 _PEB Thread Information Block (TIB) _NT_TIB - first member of TEB +0x000 NtTib : _NT_TIB

[GalacticJello]

Yes, exactly. fs:[30] + 0xC = PEB_LDR_Data, + 0x0C = InMemoryOrderModuleList of loaded modules. Then you can explore their exports.