Comments on nzight: A PE trick, the Thread Local Storage

Thanks for sharing this information. I was searchi...

2007-11-19T21:42:00.000+01:00

Thanks for sharing this information. I was searching for the explanation of this behavior for 2 days. I thought that my program had the bug.

Thanks for the info. I didn't know that the window...

2007-05-24T13:40:55.240+02:00

Thanks for the info. I didn't know that the windows loader was so forgiving in that case.

Also, FYI, the Windows loader (which IMHO is as br...

2007-05-24T13:30:00.000+02:00

Also, FYI, the Windows loader (which IMHO is as brainded as it can be and tries to load anything that even looks like PE without performing validation - probably in the name of "backwards compatibility") executes TLS even if in the Data Directory the size is specified as zero, but IDA doesn't show it in this case (of course you can always patch it with a hex editor ;-)).

http://www.amazon.com/Computer-Virus-Research-Defe...

2007-05-21T07:59:00.000+02:00

http://www.amazon.com/Computer-Virus-Research-Defense-Symantec/dp/0321304543/ref=sr_1_1/002-1556081-5220863?ie=UTF8&s=books&qid=1179727152&sr=8-1

using TLS as entry point. just a quick mention - not sure if it is worth to buy the book just to read about it :)

I don't know if you have read this but here's an i...

2007-05-02T18:53:00.000+02:00

I don't know if you have read this but here's an interesting article discussing the Shrug aka Chifton Virus LINK

According to Symantec the virus W32.Shrug was the ...

2007-04-01T23:33:08.095+02:00

According to Symantec the virus W32.Shrug was the first know to use TLS

Could you elaborate a bit more on that please?

2007-03-20T23:42:15.474+01:00

Could you elaborate a bit more on that please?

FYI: virii use TLS' entry points too."comparing ex...

2007-03-20T22:33:00.000+01:00

FYI: virii use TLS' entry points too.

"comparing execution paths..." respect.