0

I came across an unfamilar syntax when studying a dissassembly with Ghidra.

One line contains

MOV EAX,GS:[0x14]

what does the colon syntax mean?

I'm actually fairly new to all of this, both ASM and Ghidra analysis. I understand that this instruction moves "something from somewhere" into the 32 bit register EAX, but I don't understand how to interpret either the GS or the colon symbols.

1201ProgramAlarm
  • 32,384
  • 7
  • 42
  • 56
FreelanceConsultant
  • 13,167
  • 27
  • 115
  • 225
  • 2
    Strong chance this is a thread local read - gs is a segment register: https://stackoverflow.com/questions/12234817/what-does-this-instruction-do-mov-gs0x14-eax – Michael Dorgan Mar 10 '21 at 22:36

1 Answers1

0

The colon means that this is a segment override, if you don't use the default segment register.

Devolus
  • 21,661
  • 13
  • 66
  • 113