DLL Hijinks: The Hidden World of TLS Callbacks in Windows
Xavier’s diary entry on abusing DLLs EntryPoint led to some delightful tinkering with TLS Callbacks in DLLs. These sneaky little functions can run before the program even says “Hello, world!” So, when testing, don’t just eye the DllMain and exported functions—keep an eye on those mischievous TLS callbacks too!
Hot Take:
Why settle for the same old “Hello World” when you can have a “Hello, I’m a sneaky TLS Callback”? Forget the standard entrances; make a grand entrance with TLS Callbacks that turn your DLL into the party host that greets everyone before the main event begins. It’s like a red carpet for your code!
Key Points:
- TLS (Thread Local Storage) Callbacks execute automatically when a process or thread starts.
- The TLS directory in PE files stores data about where TLS is stored, its size, and callback functions.
- TLS Callbacks can run before the more familiar DllMain function in DLLs.
- Static and dynamic analysis must account for TLS Callbacks to avoid missing critical code execution.
- Debuggers can be configured to break on TLS Callbacks to prevent them from executing unnoticed.
Already a member? Log in here