Vol1-Mod1.3Process-Slide14 - Suggestion

[BlueSkeye]

At point 6 you states BaseProcessStart invokes EntryPoint which is right.

However this might not be the very first user provided code that is executed. One of the well known technic used by malwares is to use thread local storage (TLS) and associated callbacks that are defined in the IMAGE_TLS_DIRECTORY data directory. These callbacks if present would be invoked at point 5 by LdrpInitialize. I can't remind wether it is before or after DLL imports.

I don't know if you wish to state it here or consider this as an advanced topic you will deal with later in your slides.

[hasherezade]

I wanted to show the most typical scenario for the simplicity, but ok, I will add the info about TLS callbacks here.