Hiding Code Behind Thread-Local Storage - Reverse Engineering TLS Callbacks

In this video we'll see how to execute code before the entry point of the application and before the main function and confuse some debuggers along the way. Let's begin.

PoC code:

Analysis tools:

- Immunity debugger
- CFF Explorer
- LordPE
- IDA Pro
- Visual studio IDE

---------------------------------------------------------------------------------------------------

If you liked this video and you want to learn hands-on how to analyse malware, with real samples and practical exercises, find us on Udemy :

---------------------------------------------------------------------------------------------------

Want to support us continue to make great content? Buy us a coffee :

Thank you 🙏

[djpuxo]

Hello. The first thing I would like to tell you is that I love your channel and it is a shame not to see more of your content about reversing today. I have a question related to TLS; A packer adds its own tls callbacks, those calls are in a new section called .rdata00. I have reached the OEP, rebuilt the IAT, and dumped the file. Then from cff I have deleted all the sections of the packer, except rdata00 because it contains the TLS. The problem is that the original TLS are in rdata, if I delete rdata00 I have to redirect the calls to rdata but I don't know how to locate the original tls. At some point are the original rdata tls called from the rdata00 packer section? Sorry if I don't know how to explain better, I'm just an amateur.

[muffinberg]

thank you for the video. Was really useful.

[moviesynopsis]

Didnt know women did this kind of stuff, what made you interested in this?