Скачать с ютуб What are TLS Callbacks and How to Find Them! в хорошем качестве

What are TLS Callbacks and How to Find Them!

We continue to explore the PE file format in this video by investigating TLS (thread local storage) callbacks. 🔥 Join this channel to get access to perks:    / @jstrosch   TLS callbacks are used by malware authors to execute code before the main entry point of the program. This technique is primarily used as an anti-debugging technique, allowing malware to execute before the debugger takes control at the programs entry. How prevalent is this technique still? We'll explore that as well in this video using Yara, as well as use MalCat and 010 editor to look at the internal structures of a PE file that support TLS callbacks. Yaraify Link and Yara rule name - (pe_detect_tls_callbacks): https://yaraify.abuse.ch/yarahub/ MSDN: https://unprotect.it/technique/tls-ca... Sample code: https://unprotect.it/technique/tls-ca... Cybersecurity, reverse engineering, malware analysis and ethical hacking content! 🎓 Courses on Pluralsight 👉🏻 https://www.pluralsight.com/authors/j... 🌶️ YouTube 👉🏻 Like, Comment & Subscribe! 🙏🏻 Support my work 👉🏻   / joshstroschein   🌎 Follow me 👉🏻   / jstrosch  ,   / joshstroschein   ⚙️ Tinker with me on Github 👉🏻 https://github.com/jstrosch 🤝 Join the Discord community and more 👉🏻 https://www.thecyberyeti.com 1:30 Definition of TLS on MSDN 2:58 TLS Structure Definition 3:48 Our Sample Program 5:27 Identifying TLS Callbacks in 010 7:40 Finding the First Callback in 010 10:00 TLS Callbacks in IDA Pro 11:13 Switching to Malcat 12:19 Why Do We Need to Know This? 12:54 How Prevalent are TLS Callbacks? Investigating with Yara 13:49 Expanding our Search with Yaraify 15:03 Investigating Recent Examples