Unable To break TLS callback function using ollydbg

Question

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint reached.but i am viewing the calls imported by Ntdll.dll

I am attaching a screenshot for the reference i already got the TLS section by IDA PRO,and got the address in the range 400000 but when viewing olly,i can see the address starting from 7.check the picture . And below are the sample Assembly when started by olly

77420542    8975 FC         MOV DWORD PTR [EBP-4],ESI
77420545    EB 0E           JMP SHORT ntdll.77420555
77420547    33C0            XOR EAX,EAX
77420549    40              INC EAX
7742054A    C3              RET
7742054B    8B65 E8         MOV ESP,DWORD PTR [EBP-18]
7742054E    C745 FC FEFFFFF>MOV DWORD PTR [EBP-4],-2
77420555    E8 DF22FBFF     CALL ntdll.773D2839
7742055A    C3              RET
7742055B    90              NOP
7742055C    90              NOP
7742055D    90              NOP
7742055E    90              NOP
7742055F    90              NOP
77420560    8BFF            MOV EDI,EDI
77420562    55              PUSH EBP
77420563    8BEC            MOV EBP,ESP
77420565    83EC 10         SUB ESP,10
77420568    803D EC02FE7F 0>CMP BYTE PTR [7FFE02EC],0
7742056F    74 11           JE SHORT ntdll.77420582
77420571    8B45 0C         MOV EAX,DWORD PTR [EBP+C]
77420574    8160 68 FFFEFFF>AND DWORD PTR [EAX+68],FDFFFEFF

It will be great if anyone can help

Answer 1

you need to stop on one of these functions and single step from there in latest os
if you were on xp-sp3 you could toggle peb->NtGlobalFlag to show Loader snaps
one of the DebugPrint Messages on the spew is entry point for Tls Callback

(take a look at old Ntglobalflag plugin for odbg110 for refreshing about how tls works and how the pluging caught the callback

the following call stack is from win7 set a break on one of them and you should be good to go

Call stack of main thread
Stack     Data      Procedure
0012FA20  7761D8F1  /ntdll.LdrpCallInitRoutine
0012FA24  00402000  |  Arg1 = mytls.<TLS_Callback_1>
0012FA28  00400000  |  Arg2 = mytls.400000
0012FA2C  00000001  |  Arg3 = 1
0012FA30  00000000  \  Arg4 = 0
0012FA64  775B166B  /ntdll.LdrpCallTlsInitializers
0012FA68  00000001  |  Arg1 = 1
0012FA6C  006020F0  \  Arg2 = 6020F0
0012FB50  77606175  /ntdll.LdrpRunInitializeRoutines
0012FB54  0012FD24  \  Arg1 = 12FD24
0012FCB4  77606077  /ntdll.LdrpInitializeProcess
0012FCB8  0012FD24  |  Arg1 = 12FD24
0012FCBC  775A0000  \  Arg2 = ntdll.<STRUCT IMAGE_DOS_HEADER>
0012FD04  77603663  /ntdll.LdrpInitialize
0012FD08  0012FD24  |  Arg1 = 12FD24
0012FD0C  775A0000  \  Arg2 = ntdll.<STRUCT IMAGE_DOS_HEADER>

i dont remember right but look into ollydbg 2.01 log window if there is a tls callback iirc it showed where it was in ollydbg 2.01

it seems you are using ollydbg 1.01 from your screen shot (odbg2.01 has an option to set a breakpoint on tls callbacks

Answer 2

i got the answer after spending some time by going each and evry call.i got the address of TLS callback address in the range 400000.Basically the file is using relocation,that's why it is showing address at 0012FA20. Remove Relocatable option using CFF explorer.and we can reach upto TLS callback address. It is also can be seen by using command

ALT+M in ollydbg.so that we can see at what memory address PE section is mapped. Thanks All