CodeExplorer Posted March 22, 2011 Share Posted March 22, 2011 A PE trick, the Thread Local Storage />http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html Link to comment Share on other sites More sharing options...
Peter Ferrie Posted March 30, 2011 Share Posted March 30, 2011 A PE trick, the Thread Local Storage />http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.htmlIt's old, and it's not quite correct. Execution of TLS does not rely on the number of DLLs, it's _which_ DLL is imported. It doesn't work if only kernel32.dll or ntdll.dll is used.The reason why is in one of my anti-unpacker papers, and descriptions of other TLS tricks are available from my site (pferrie.tripod.com). Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now