selfrando icon indicating copy to clipboard operation
selfrando copied to clipboard

Intercept TLS callbacks on Windows

Open ahomescu opened this issue 8 years ago • 0 comments

Normally, Windows calls the library/executable entry point (DllMain, WinMain or equivalent) at program startup. However, there is an additional set of entry point functions that may be called before that: the TLS callbacks. These callbacks are called before program startup and shutdown, as well as a few other major program events.

Selfrando correctly updates the callback pointers (since they have associated based relocations), so any calls to these callbacks after randomization should work correctly. However, the callbacks may be called before randomization. We should intercept the callbacks and perform our randomization before any callback is executed.

This has not been a problem for Firefox (xul.dll registers two such callbacks, but they do nothing during program startup), but it may be a problem for other Windows software.

ahomescu avatar Feb 14 '17 01:02 ahomescu