Friday, June 26, 2009

Breaking into a process before the TLS gets executed

I found out about this from the SANS blog: you can make Olly break before the TLS get executed. Just Debugging Options –> Events and set “Make first pause at” to “System breakpoint” instead of “WinMain”. Cool! (until now I was patching executables with TLS to avoid them being executed).

image

No comments:

Post a Comment