Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 10-02-2006, 20:23
Archer's Avatar
Archer Archer is offline
retired
 
Join Date: Aug 2005
Posts: 243
Rept. Given: 1
Rept. Rcvd 46 Times in 19 Posts
Thanks Given: 3
Thanks Rcvd at 387 Times in 57 Posts
Archer Reputation: 46
Take a look at the TLS callback, used in Execryptor and some crackmes, maybe this trick can help.
Reply With Quote
  #2  
Old 10-02-2006, 22:46
Shub-Nigurrath's Avatar
Shub-Nigurrath Shub-Nigurrath is offline
VIP
 
Join Date: Mar 2004
Location: Obscure Kadath
Posts: 971
Rept. Given: 70
Rept. Rcvd 431 Times in 101 Posts
Thanks Given: 83
Thanks Rcvd at 405 Times in 127 Posts
Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499 Shub-Nigurrath Reputation: 400-499
the TLS is meant for this.

Try the attached example code (C++),

Anyway consider that the TLS is not the only option, the same result is obtained putting your code into the DllMain of a dll added to the import table. The Dll is loaded by the system loader and the import table resolved. The DllMain of each dll is called at this stage.

This latter approach requires an external dll anyway, but a solution to this is to add an export to your own program and adding itself to the export table doing a circular reference to itself.
Attached Files
File Type: zip tlscallback.zip (25.1 KB, 45 views)
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪)
There are only 10 types of people in the world: Those who understand binary, and those who don't
http://www.accessroot.com
Reply With Quote
  #3  
Old 10-02-2006, 23:37
Vrane Vrane is offline
Friend
 
Join Date: Jan 2006
Location: Croatia
Posts: 104
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 3 Times in 3 Posts
Vrane Reputation: 0
if u need here's tlscallback in asm..
Attached Files
File Type: rar TLS-CallBack in asm.rar (1.9 KB, 45 views)
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Code snippet for Base34 Encoding TempoMat General Discussion 11 03-29-2020 17:58
Code timing snippet Git Developer Section 5 01-05-2018 02:05
Load and Execute unsigned code into kernel in Windows 10x64 TechLord General Discussion 1 03-12-2017 16:30
Any ideas about executing phpinfo() in this code snippet XnHandt General Discussion 0 12-28-2012 00:46


All times are GMT +8. The time now is 18:36.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )