Contents
What is a TLS callback?
TLS callback functions allow malware authors to execute malicious code before the debugger has a chance to pause at the traditional Entry Point. This allows malware to infect the system or disable the debugger before the analyst has a chance to look at the sample’s code.
How does Anti-debugging work?
Anti-debugging is a set of techniques used within the code of an application to detect and prevent the act of debugging. This stops attackers from dynamically running applications, trying to understand how they work and changing the behavior of certain features or checks within the application.
What is Anti-debugging in the code?
For those that don’t know, anti-debugging is the implementation of one or more techniques within computer code that hinders attempts at reverse engineering or debugging a target process. Typically this is achieved by detecting minute differences in memory, operating system, process information, latency, etc.
How does thread local storage work?
With thread local storage (TLS), you can provide unique data for each thread that the process can access using a global index. One thread allocates the index, which can be used by the other threads to retrieve the unique data associated with the index.
When is TLS callback function executed in OllyDbg?
TLS callback functions are actually executed before executing code at the traditional Original Entry Point (OEP). If you try to load such a malware in OllyDbg with the default options, you will notice that it stops (see the Terminated status):
Which is called the thread local storage ( TLS ) callback?
Among the different anti-reverse / anti-debugging techniques, there is one which is called the Thread Local Storage (TLS) callback. TLS callback functions are actually executed before executing code at the traditional Original Entry Point (OEP).
How to bypass TLS callback in IDA Pro?
On way to bypass it is to reconfigure OllyDbg to pause at “system breakpoint” instead of the default “WinMain”: To find the TLS callback, open the malware in IDA Pro and press Ctrl+E: You can also use pescanner.py :
What causes a server to use TLS 1.0?
If you enable the FIPS security policy setting for either the client or a server, Secure Channel (Schannel) negotiation can cause them to use TLS 1.0. This behavior happens even if you disable the protocol in the registry. To investigate, enable Secure Channel event logging, and then review Schannel events in the system log.