-
Notifications
You must be signed in to change notification settings - Fork 184
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Vol1-Mod1.3Process-Slide14 - Suggestion #10
Comments
I wanted to show the most typical scenario for the simplicity, but ok, I will add the info about TLS callbacks here. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
At point 6 you states BaseProcessStart invokes EntryPoint which is right.
However this might not be the very first user provided code that is executed. One of the well known technic used by malwares is to use thread local storage (TLS) and associated callbacks that are defined in the IMAGE_TLS_DIRECTORY data directory. These callbacks if present would be invoked at point 5 by LdrpInitialize. I can't remind wether it is before or after DLL imports.
I don't know if you wish to state it here or consider this as an advanced topic you will deal with later in your slides.
The text was updated successfully, but these errors were encountered: