gdt from softice
Code:
:gdt
...
0030 Data32 FFDFF000 00001FFF 0 P RW <--- KPCR
003B Data32 7FFDE000 00000FFF 3 P RW <--- TEB
so to read address of fs:[124h] you should type
dd FFDFF000+124
when you get address you might wanna play with it a little bit with:
dt nt!_ETHREAD <address> and so on, to explore state of some interesting structures of system. I don't know if something changed on win2k3 but you can always use wARK to get gdt and you will get address of fs without a problem
As I said maybe they have changed something in internal structures so maybe fs:[124] doesn't point to CurentThread, to be sure you should explore strucutres with:
dt nt!_structure (eg. dt nt!_KPCR, dt nt!_KPRCB etc...)
Regards