Jump to content
Tuts 4 You

A PE trick, the Thread Local Storage


Recommended Posts

  • 2 weeks later...
Peter Ferrie

A PE trick, the Thread Local Storage

It's old, and it's not quite correct. Execution of TLS does not rely on the number of DLLs, it's _which_ DLL is imported. It doesn't work if only kernel32.dll or ntdll.dll is used.

The reason why is in one of my anti-unpacker papers, and descriptions of other TLS tricks are available from my site (pferrie.tripod.com).

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...