Содержание
- 2. Thread Local Storage callbacks were discovered in 2000. However, widespread use didn’t occur until 2004. Now,
- 3. Peter Ferrie, Microsoft Corporation Entry Point
- 4. Peter Ferrie, Microsoft Corporation C3 RET
- 5. So the main file does nothing. If we assume that the structure is normal, then we
- 6. Peter Ferrie, Microsoft Corporation TLS is present (size doesn’t matter)
- 7. Peter Ferrie, Microsoft Corporation Callback pointer Callback array
- 8. So the search moves to the callbacks, of which there is only one, but it looks
- 9. Peter Ferrie, Microsoft Corporation
- 10. Imported TLS callbac We know that the TLS callback array can be altered at runtime. We
- 11. Peter Ferrie, Microsoft Corporation TLS3.DLL
- 12. Peter Ferrie, Microsoft Corporation a
- 13. So the search moves to TLS3.DLL, and the mysterious function called ‘a’. Peter Ferrie, Microsoft Corporation
- 14. Peter Ferrie, Microsoft Corporation
- 15. So that’s how it’s done. If we let it run… Peter Ferrie, Microsoft Corporation
- 16. Peter Ferrie, Microsoft Corporation
- 17. The code runs. Peter Ferrie, Microsoft Corporation
- 19. Скачать презентацию