public void ImageTlsDirectory32ConstructorWorks_Test() { var tlsDirectory = new IMAGE_TLS_DIRECTORY(RawStructures.RawTlsDirectory32, 2, false); Assert.Equal((ulong)0x33221100, tlsDirectory.StartAddressOfRawData); Assert.Equal((ulong)0x77665544, tlsDirectory.EndAddressOfRawData); Assert.Equal((ulong)0xeeddccbb, tlsDirectory.AddressOfIndex); Assert.Equal((ulong)0x66554433, tlsDirectory.AddressOfCallBacks); Assert.Equal((uint)0x44332211, tlsDirectory.SizeOfZeroFill); Assert.Equal((uint)0x99887766, tlsDirectory.Characteristics); }
static void ExecuteTLS(ref IMAGE_NT_HEADERS OrgNTHeaders, IntPtr pCode, IntPtr pNTHeaders) { if (OrgNTHeaders.OptionalHeader.TLSTable.VirtualAddress == 0) { return; } IMAGE_TLS_DIRECTORY tlsDir = PtrRead <IMAGE_TLS_DIRECTORY>(PtrAdd(pCode, OrgNTHeaders.OptionalHeader.TLSTable.VirtualAddress)); IntPtr pCallBack = tlsDir.AddressOfCallBacks; if (pCallBack != IntPtr.Zero) { for (IntPtr Callback; (Callback = PtrRead <IntPtr>(pCallBack)) != IntPtr.Zero; pCallBack = PtrAdd(pCallBack, IntPtr.Size)) { ImageTlsDelegate tls = (ImageTlsDelegate)Marshal.GetDelegateForFunctionPointer(Callback, typeof(ImageTlsDelegate)); tls(pCode, DllReason.DLL_PROCESS_ATTACH, IntPtr.Zero); } } }