Index
> Main > How to implement tls.callbacks and question? |
| Author |
|
|
Reverend 18 Oct 2005, 12:11
tls.callback? I have no idea what is this, but such definition 'name PROTO :DWORD, :DWORD' is masm-specific. Convert the code to fasm first. And use 'Search', this topic was mentioned about three times afair
|
|||
18 Oct 2005, 12:11 |
|
|
RedGhost 18 Oct 2005, 16:37
Reverend wrote: tls.callback? I have no idea what is this, but such definition 'name PROTO :DWORD, :DWORD' is masm-specific. Convert the code to fasm first. And use 'Search', this topic was mentioned about three times afair tls? threadlocalstorage? fs:[18] is a pointer to fs, aka teb, and from there you can check for the tlspointer _________________ redghost.ca |
|||
|
18 Oct 2005, 16:37 |
|
|
Reverend 18 Oct 2005, 17:41
I know TLS stands for Thread Local Storage, but what does it have to do with
Quote: C:\Documents and Settings\Owner\Desktop\crap\fasmexp\aplib.inc [7]: |
|||
|
18 Oct 2005, 17:41 |
|
|
shism2 18 Oct 2005, 19:15
It doesn't have anything to do with the proto... It was just a seprate question.
THREAD LOCAL STORAGE CALLBACKS ... How can I implement these in fasm? |
|||
|
18 Oct 2005, 19:15 |
|
|
Ancient One 19 Oct 2005, 02:51
tls callback is only used in NT Windows. in 9x it does not have any effects. u need to write the tls directory manually in fasm..
Code: data 9 ;here goes the tls directory. end data here's one example Code: include 'win32ax.inc' .code start : ret proc tls_callback DllHandle, Reason, Reserved .if [Reason] = 1 invoke MessageBox, 0, "Process_Attach", "tls_callback", 0 .elseif {Reason] = 0 invoke MessageBox, 0, "Process_Detach", "tls_callback", 0 .endif endp .end start .data data 9 dd 0 ;Raw Data Start VA dd 0 ;Raw Data End VA dd tls_index ;Address of Index dd tls_callbacks ;Address of Callbacks dd 0 ;Size of Zero Fill dd 0 ;Reserved tls_index dd 0 tls_callbacks dd tls_callback, 0 end data the tls_callbacks is virtual address that points to array of tls callbacks function and terminated by 0 and are called one by one by Windows. tls_callback procedure itself have the same arguments as DLL entrypoint. Please note that all addresses in tls directory are NOT rva. I hope Privalov may include tls macro set in the future in the std win32 include. |
|||
|
19 Oct 2005, 02:51 |
|
|
shism2 19 Oct 2005, 03:49
Thank you ancient.... That example is what I was looking for thank you so much
 .... !!!!!
My friend used this as an anti-debug .. but I had no idea how to do it in fasm sigh.... THANKS! |
|||
|
19 Oct 2005, 03:49 |
|
|
Ancient One 20 Oct 2005, 01:32
u can also download PE/coff specification from M$ site.. the info are there.
|
|||
|
20 Oct 2005, 01:32 |
|
|
Cthulhu 07 Nov 2005, 13:19
What type of data is "data 9" ?
|
|||
|
07 Nov 2005, 13:19 |
|
|
shism2 08 Nov 2005, 01:50
data 9
dd 0 ;Raw Data Start VA dd 0 ;Raw Data End VA dd tls_index ;Address of Index dd tls_callbacks ;Address of Callbacks dd 0 ;Size of Zero Fill dd 0 ;Reserved tls_index dd 0 tls_callbacks dd tls_callback, 0 end data I think it's probably just a structure |
|||
|
08 Nov 2005, 01:50 |
|
< Last Thread | Next Thread > |
Forum Rules:
|