Содержание
- 2. Thread Local Storage callbacks were discovered in 2000. However, widespread use didn’t occur until 2004. Now,
- 3. Peter Ferrie, Microsoft Corporation Entry Point
- 4. Peter Ferrie, Microsoft Corporation C3 RET
- 5. So the main file does nothing. If we assume that the structure is normal, then we
- 6. Peter Ferrie, Microsoft Corporation TLS is present (size doesn’t matter)
- 7. Peter Ferrie, Microsoft Corporation Callback pointer Callback array
- 8. So the search moves to the callbacks, of which there is only one... or is there?
- 9. Peter Ferrie, Microsoft Corporation
- 10. Am I Missing Somethi CODE:00401010 push offset LibFileName ; "tls2" CODE:00401005 call j_LoadLibraryA CODE:0040100A mov ds:TlsCallbacksEnd,
- 11. I Am Missing Somethi No, that’s not it. Peter Ferrie, Microsoft Corporation
- 12. Let’s revisit the code: CODE:00401010 push offset LibFileName ; "tls2" CODE:00401005 call j_LoadLibraryA CODE:0040100A mov ds:TlsCallbacksEnd,
- 13. It’s All About Image It’s the TlsCallBacks extended array trick again. Q. What value does the
- 14. Peter Ferrie, Microsoft Corporation
- 15. Of course it will. You just have to ask nicely. Or take a cue from a
- 16. When the SectionAlignment value is less than 4kb, the file header is marked Writable and Executable
- 17. So we go from this… Peter Ferrie, Microsoft Corporation
- 18. To this… Peter Ferrie, Microsoft Corporation
- 19. Peter Ferrie, Microsoft Corporation
- 21. Скачать презентацию