A PE trick, the Thread Local Storage

[CodeExplorer]

A PE trick, the Thread Local Storage
/>http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html

[Peter Ferrie]

A PE trick, the Thread Local Storage
/>http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html

It's old, and it's not quite correct. Execution of TLS does not rely on the number of DLLs, it's _which_ DLL is imported. It doesn't work if only kernel32.dll or ntdll.dll is used.

The reason why is in one of my anti-unpacker papers, and descriptions of other TLS tricks are available from my site (pferrie.tripod.com).