Jump to content
Tuts 4 You

A PE trick, the Thread Local Storage


CodeExplorer

Recommended Posts

CodeExplorer

A PE trick, the Thread Local Storage
/>http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html

Link to comment
Share on other sites

  • 2 weeks later...
Peter Ferrie

A PE trick, the Thread Local Storage
/>http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html

It's old, and it's not quite correct. Execution of TLS does not rely on the number of DLLs, it's _which_ DLL is imported. It doesn't work if only kernel32.dll or ntdll.dll is used.

The reason why is in one of my anti-unpacker papers, and descriptions of other TLS tricks are available from my site (pferrie.tripod.com).

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...