so I tried rd/wrfsbase since gs looks like it is being used. fs started out as zero, and almost all of the calls into the windows apis set it back to zero. Therefore, it is necessary to save and restore it around calls to foreign code. This actually worked (i.e. I got the same value out of reads inside the program as the value one I wrote once at the beginning of the program) with one caveat: the WindowProc function is called indirectly, so I had to set it to the right value at the beginning of this function. In any case, windows really wants to set that back to zero, so it is necessary to have a method of restoring it inside your functions that can be called from foreign code.

The main problem with using undocumented things is that they are not guaranteed to be consistent for each use. If someone else is on a different version, or patch level, of the OS then they might get different behaviour.

Welp, with longer running programs, fsbase does get randomly set back to zero. So, that is it for windows.

Can't wait for side-channel exploits using this, somehow.

Windows periodically suspends and resumes your process in order to run applications concurrently. During this task switch the fs register is probably set to zero.

https://devblogs.microsoft.com/oldnewthing/20220831-00/?p=107077

I suppose the source for this is the Windows ABI's silence? Where is the Windows ABI?

For absolute clarity, I have observed the following printing anywhere from 50M to 1.5B iterations.
[/code]

Is it being changed by another process, or the OS, or both?

If you run a second process to change fsbase after starting your test code, does that immediately trigger the message?

I will be sure to run those experiments before I delete the windows partition. I am intrigued by the thought of what might happen with lots of processes changing it, though I not sure what difference between attributing it to another process and attributing it to the OS is; I though it was the job of OS (besides collecting telemetrics) to keep the processes separated. I have only observed fsbase changing on its own back to zero - never any other value.