Printable Version of Topic Click here to view this topic in its original format

Forum > Newbies > TLS Callback Functions

Posted by: samael Dec 28 2007, 10:44 AM

Hi all, I was checking out the new http://www.ollydbg.de/ (Released 25 Dec. 2007). Among the new features is the support & recognition of TLS Callbacks. Here are a couple of articles that describe what are TLS Callbacks: ● http://www.hexblog.com/2005/10/tls_callbacks.html ● http://www.cyberarmy.net/library/article/1653 ● http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx I have created an application featuring 5 TLS Callback functions. Turns out the new Ollydbg correctly recognizes them, but only breaks on the first one... Well, i think it should break on all TLS Callbacks, not only during the initialization of the PE by the loader, but also during deinitialization. What do you think on this? Anyway, for those interested in the subject, or want to check out the new feature of Ollydbg, here are the related files & projects. Files Description: ● TLSCallbacks - This is the program featuring 5 TLS Callback functions. When you will compile it, it should execute winmain(), because two values need to be updated in the TLS_Directory of the PE. I haven't found a way to set these values through the MS linker, so i ended up coding another little utility, which scans the file for a pattern that precedes the TLS Table and sets the two values in the TLS_Directory (someone could do this manually; this utility is merely intended for automation of the process...). ● UpdateTLSDirectoryEntries - This is the aforementioned utility.

Posted by: Vrane Dec 28 2007, 02:15 PM

Here are 2 more examples for MASM & TASM. Attachment edited by samael (30 Dec 2007) Reason: Converted to ZIP archive Previous downloads: 9