Breaking into a process before the TLS gets executed

I found out about this from the SANS blog: you can make Olly break before the TLS get executed. Just Debugging Options –> Events and set “Make first pause at” to “System breakpoint” instead of “WinMain”. Cool! (until now I was patching executables with TLS to avoid them being executed).


, , ,

Leave a Reply

Your email address will not be published. Required fields are marked *