Malware development trick 66: TLS callbacks before main. Simple C example
Brief
﷽
Hello, cybersecurity enthusiasts and white hackers!
Today I want to look at a small Windows execution-order trick: a function can run before the executable reaches its PE entry point, and therefore before our C main function. The mechanism is a Thread Local Storage callback , usually called a TLS callback.
Suppose we open an unfamiliar program in a debugger, put a breakpoint on main , and start reading from there. By the time that breakpoint fires, application code may already have changed the program’s state. That makes TLS callbacks interesting for malware analysis and for understanding the execution paths available to a red team tool.
Our experiment asks a specific question: can two tiny callbacks leave an observable record of their execution order before main ? We will write a small C example, build it with MinGW-w64 on Linux, and inspect the resulting PE.