Debugging with FS Segment Register

Question

I need to debug an application written in C that reads and writes to the register of FS segments. To debug this application, I need to see the memory address pointed to by FS.

The application uses the following code:

mov rdx, fs:[rcx]
mov fs:[rcx], rsi

How to get linear virtual read / write address from / to segment registers? I can compile this application for Linux or Winodws.

Answer 1

In linux you can use arch_prctl(ARCH_GET_FS, &fsbase). In windows, if it FSpoints to TEB, as usual, you can read fs:[0x18]to get the base address, or use the functions of your debugger, if available.