I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has anti-debugging features and as far as I can understand it modifies its code during the the tls callbacks (at least thats what IDA indicated when stepping through the tls callbacks, there are 3 of them). I suspect the tls callbacks check for debuggers and also it unpacks the executable.
I would like to ask a couple of questions in connection with this.
How would you go about reversing a code that is heavly obfuscated? (Lots of jumps and opaque predicates.) Maybe after the tls callbacks finish the code is unpacked and some of the obfuscation is removed?
I have added breakpoints to the main debug checking functions from ntdll.dll and kernel32.dll to see if they call any, I saw they had multiple calls to ntqueryprocessinformation, I suspect they are querying their own process?
Also, if i want to read the memory of the application during runtime, I will need to find a way to bypass their anti debug features, meaning I have to figure out what they are doing with the tls callbacks and also from the entry point of the PE?
I am looking for any general or specific guidelines you guys can throw me, in order to defeat their obfuscation.