I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS VIOLATION exception, because Tls callback gets executed, with the following content:
.text:0063EE70 public TlsCallback_0
.text:0063EE70 TlsCallback_0: ; DATA XREF: .CRT:TlsCallbacks_0
.text:0063EE70 mov [esi-6Dh], ebx
.text:0063EE73 xlat byte ptr gs:[ebx]
.text:0063EE75 retf 155h
How is that even possible?? Are the registers inside tlscallback by default point to some sections/segments? Here the esi is used, but it has some default value, from the ntdll:ntdll_LdrShutdownThread+386
I attach the full stack trace, this is the stack trace from which this callback is called, when i run the application under ida pro+windbg, tls callback is hit prior to entry point.
esi points to some DATA
segment inside the application, is this the default os behaviour?
Also the TLS directory here is defined like so:
As you can see TLS_end and TLS_start points to the image base.
So my question is, how is this callback not crashing the program without debugger? And why it is when i attach the debugger? It is some kind of anti-debuggin technique i can't understand