Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 69,
    "key": "tls-callback",
    "unprotect_id": "U0124",
    "name": "TLS Callback",
    "description": "TLS (Thread Local Storage) callbacks are a mechanism in Windows that allows a program to define a function that will be called when a thread is created. These callbacks can be used to perform various tasks, such as initializing thread-specific data or modifying the behavior of the thread.\r\n\r\nAs an anti-debugging technique, a program can use a TLS callback to execute code before the main entry point of the program, which is defined in the PE (Portable Executable) header. This allows the program to run secretly in a debugger, as the debugger will typically start at the main entry point and may not be aware of the TLS callback.\r\n\r\nThe program can use the TLS callback to detect whether it is being debugged, and if it is, it can terminate the process or take other actions to evade debugging. This technique can be used to make it more difficult for a debugger to attach to the process and to hinder reverse engineering efforts.",
    "resources": "https://resources.infosecinstitute.com/debugging-tls-callbacks/#gref\nhttps://isc.sans.edu/diary/How+Malware+Defends+Itself+Using+TLS+Callback+Functions/6655",
    "creation_date": "2019-03-18T13:40:19Z",
    "tags": "TLS callbacks,\r\nanti-debugging technique,\r\nthread,\r\nmain entry point,\r\ndebugger,",
    "modification_date": "2023-10-04T10:44:42.226000Z",
    "category": [
        3
    ],
    "rules": [
        1
    ],
    "attachments": [],
    "featured_api": [
        364
    ],
    "contributors": []
}