Example #1
0
        public void ImageTlsDirectory32ConstructorWorks_Test()
        {
            var tlsDirectory = new IMAGE_TLS_DIRECTORY(RawStructures.RawTlsDirectory32, 2, false);

            Assert.Equal((ulong)0x33221100, tlsDirectory.StartAddressOfRawData);
            Assert.Equal((ulong)0x77665544, tlsDirectory.EndAddressOfRawData);
            Assert.Equal((ulong)0xeeddccbb, tlsDirectory.AddressOfIndex);
            Assert.Equal((ulong)0x66554433, tlsDirectory.AddressOfCallBacks);
            Assert.Equal((uint)0x44332211, tlsDirectory.SizeOfZeroFill);
            Assert.Equal((uint)0x99887766, tlsDirectory.Characteristics);
        }
    static void ExecuteTLS(ref IMAGE_NT_HEADERS OrgNTHeaders, IntPtr pCode, IntPtr pNTHeaders)
    {
        if (OrgNTHeaders.OptionalHeader.TLSTable.VirtualAddress == 0)
        {
            return;
        }
        IMAGE_TLS_DIRECTORY tlsDir = PtrRead <IMAGE_TLS_DIRECTORY>(PtrAdd(pCode, OrgNTHeaders.OptionalHeader.TLSTable.VirtualAddress));
        IntPtr pCallBack           = tlsDir.AddressOfCallBacks;

        if (pCallBack != IntPtr.Zero)
        {
            for (IntPtr Callback; (Callback = PtrRead <IntPtr>(pCallBack)) != IntPtr.Zero; pCallBack = PtrAdd(pCallBack, IntPtr.Size))
            {
                ImageTlsDelegate tls = (ImageTlsDelegate)Marshal.GetDelegateForFunctionPointer(Callback, typeof(ImageTlsDelegate));
                tls(pCode, DllReason.DLL_PROCESS_ATTACH, IntPtr.Zero);
            }
        }
    }