Results 1 to 3 of 3

Thread: TLSCatch An ollydbg plugin to catch Tlscallbacks easily.

  1. #1

    TLSCatch An ollydbg plugin to catch Tlscallbacks easily.

    This plugin simply intercepts any new module loaded into the current process address space ,searchs it for tlscallbacks and sets a one-shot breakpoint on every callback found.
    It lets the malware analyst catch any tls callback in ollydbg. Just copy the plugin dll into olly plugin directory then fire ollydbg. Tested on ollydbg v1 on windows xp and Vista.

    original article here http://waleedassar.blogspot.com/2010/10/quick-look-at-tls-callbacks.html
    plugin uploaded on google code http://ollytlscatch.googlecode.com/files/TlsCatch.dll
    Still working on it to make it catch dynamically added tlscallbacks.

    waliedassar@gmail.com

  2. #2
    Administrator dELTA's Avatar
    Join Date
    Oct 2000
    Location
    Ring -1
    Posts
    4,206
    Blog Entries
    5
    Looks nice.

    CRCETL:
    http://www.woodmann.com/collaborative/tools/index.php/Ollytlscatch

    You are also very welcome to update this CRCETL entry yourself when new versions are released.
    "Give a man a quote from the FAQ, and he'll ignore it. Print the FAQ, shove it up his ass, kick him in the balls, DDoS his ass and kick/ban him, and the point usually gets through eventually."

  3. #3
    bp LdrpCallTlsInitializers

    ntdll!ShowSnaps -> TRUE or GF -> FLG_SHOW_LDR_SNAPS. Log:

    "LDR: Tls Callbacks Found. Imagebase %p Tls %p CallBacks %p",LF,""

    "LDR: Calling Tls Callback Imagebase %p Function %p",LF,""

Similar Threads

  1. winapihelp plugin for ollydbg 1.10
    By blabberer in forum Blogs Forum
    Replies: 27
    Last Post: August 21st, 2013, 18:39
  2. How to install plugin for ollydbg 2.x.x?
    By blueflycn in forum The Newbie Forum
    Replies: 4
    Last Post: January 29th, 2013, 01:36
  3. ollydbg 2.x plugin OLLY_LKD
    By blabberer in forum Blogs Forum
    Replies: 30
    Last Post: November 1st, 2012, 10:14
  4. ollydbg plugin list
    By muxum in forum Plugins (General)
    Replies: 4
    Last Post: February 19th, 2006, 19:28
  5. hooking a plugin export entry in ollydbg?
    By _Servil_ in forum Plugins (General)
    Replies: 6
    Last Post: November 20th, 2002, 22:09

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •