selfrando
selfrando copied to clipboard
Intercept TLS callbacks on Windows
Normally, Windows calls the library/executable entry point (DllMain
, WinMain
or equivalent) at program startup. However, there is an additional set of entry point functions that may be called before that: the TLS callbacks. These callbacks are called before program startup and shutdown, as well as a few other major program events.
Selfrando correctly updates the callback pointers (since they have associated based relocations), so any calls to these callbacks after randomization should work correctly. However, the callbacks may be called before randomization. We should intercept the callbacks and perform our randomization before any callback is executed.
This has not been a problem for Firefox (xul.dll
registers two such callbacks, but they do nothing during program startup), but it may be a problem for other Windows software.