Method ModifyTLSCallbackPtr

Process/Process.cpp:545–572

ModifyTLSCallbackPtr - changes the program TLS callback at runtime by modifying the data directory ptr (IMAGE_DIRECTORY_ENTRY_TLS) returns true on success */

    returns true on success
*/
bool Process::ModifyTLSCallbackPtr(__in const uintptr_t NewTLSFunction)
{
    HMODULE hModule = GetModuleHandle(NULL);
    IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)hModule;
    IMAGE_NT_HEADERS* ntHeader = (IMAGE_NT_HEADERS*)((BYTE*)dosHeader + dosHeader->e_lfanew);

    IMAGE_TLS_DIRECTORY* tlsDir = (IMAGE_TLS_DIRECTORY*)((BYTE*)hModule + ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress);

    if (tlsDir == nullptr)
        return false;

    DWORD dwOldProt = 0;
    if (VirtualProtect((LPVOID)tlsDir->AddressOfCallBacks, sizeof(uintptr_t), PAGE_EXECUTE_READWRITE, &dwOldProt))
    {
        __try
        {
            memcpy((void*)(tlsDir->AddressOfCallBacks), (const void*)&NewTLSFunction, sizeof(uintptr_t));
            return true;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            Logger::logf(Err, "Failed to write TLS callback ptr  @ Process::ModifyTLSCallbackPtr");
            return false;
        }
    }

    return false;
}

/*
    _GetProcAddress - Attempt to retrieve address of function of `Module`, given `lpProcName`