How to get value of gs:0xc with LTS note in coredump?

Tue Oct 4 01:00:00 GMT 2016

Dear all,

I have a question about gs and TLS in core dump. When I read the
assembly code from one coredump, there is one memory dereference :
gs:[edx] or gs:0xc.

I googled gs register and found it points to Thread Local Storage.
However, gs is a selector to GDT and this structure is in the kernel.
And I could not obtain it in coredump.

Then I searched all the segments in core dump. I found a note entry
with type NT_386_TLS, length 0x30. Is gs:0xc in this note ? And gs:0xc
is the 12th element of this note entry?

My best regards to you.

     No System Is Safe!
     Dongliang Mu

More information about the Gdb mailing list