| 688 | |
| 689 | |
| 690 | def ExecuteTLS(self): |
| 691 | codebase = self._codebaseaddr |
| 692 | |
| 693 | directory = self.OPTIONAL_HEADER.DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_TLS] |
| 694 | if directory.VirtualAddress <= 0: |
| 695 | self.dbg("no TLS address found") |
| 696 | return True |
| 697 | |
| 698 | tlsaddr = codebase + directory.VirtualAddress |
| 699 | tls = IMAGE_TLS_DIRECTORY.from_address(tlsaddr) |
| 700 | callback = IMAGE_TLS_CALLBACK.from_address(tls.AddressOfCallBacks) |
| 701 | callbackaddr=tls.AddressOfCallBacks |
| 702 | |
| 703 | while(callback): |
| 704 | TLSexec=TLSexecProc(callback.value) |
| 705 | tlsres= TLSexec( cast(codebase,LPVOID), DLL_PROCESS_ATTACH, 0) |
| 706 | if not bool(tlsres): |
| 707 | raise WindowsError('TLS could not be executed.') |
| 708 | else: |
| 709 | # 8 bytes step - this is the size of the callback field in the TLS callbacks table. Need to initialize callback to IMAGE_TLS_CALLBACK with |
| 710 | # the updated address, otherwise callback.value won't be null when the callback table is finished and the while won't exit |
| 711 | self.dbg("TLS callback executed") |
| 712 | callbackaddr+=sizeof(c_ulonglong) |
| 713 | callback= IMAGE_TLS_CALLBACK.from_address(callbackaddr) |
| 714 | |
| 715 | def finalize_sections(self): |
| 716 | sectionaddr = self.IMAGE_FIRST_SECTION() |