Posted March 22, 201114 yr A PE trick, the Thread Local Storage />http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html
March 30, 201114 yr A PE trick, the Thread Local Storage />http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.htmlIt's old, and it's not quite correct. Execution of TLS does not rely on the number of DLLs, it's _which_ DLL is imported. It doesn't work if only kernel32.dll or ntdll.dll is used.The reason why is in one of my anti-unpacker papers, and descriptions of other TLS tricks are available from my site (pferrie.tripod.com).
Create an account or sign in to comment