TLS檢測斷點

// TLS_test.cpp : Defines the entry point for the application.
//
#include "stdafx.h"
#include "TLS_test.h"
#include <windows.h>
#include <winnt.h>
 
#pragma comment(linker, "/INCLUDE:__tls_used")
/*這是PIMAGE_TLS_CALLBACK()函數的原型，其中第一個和第三個參數保留，第二個參數決定函數在那種狀況下*/
void NTAPI my_tls_callback1(PVOID h, DWORD reason, PVOID pv)
{
    /*一共有四個選項DLL_PROCESS_ATTACH、DLL_THREAD_ATTACH、DLL_THREAD_DETACH和DLL_PROCESS_DETACH。詳見微軟發佈的《Microsoft Portable Executable and Common Object File Format Specification v8》*/
    //僅在進程初始化建立主線程時執行的代碼
    if( reason == DLL_PROCESS_ATTACH ){
        MessageBox(NULL,"hi,this is tls callback","title",MB_OK);
    }
    return;
}
#pragma data_seg(".CRT$XLB")
/*若是要定義多個TLS_CallBack函數，能夠把下面這句寫成：
PIMAGE_TLS_CALLBACK p_thread_callback [] = {tls_callback_A, tls_callback_B, tls_callback_C,0};
其中tls_callback_B和tls_callback_C應該是你定義好的其餘TLS_callBack函數
*/
extern "C" PIMAGE_TLS_CALLBACK my_tls_callbacktbl[] = {TlsCallBackFunction1, 0};
#pragma data_seg()
 
int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
    MessageBox(NULL, TEXT("the main function:hello world"), TEXT("Tls test"), MB_OK);
    return 0;
}
 
void NTAPI TlsCallBackFunction1(PVOID h, DWORD reason, PVOID pv)
{
    /*一共有四個選項DLL_PROCESS_ATTACH、DLL_THREAD_ATTACH、DLL_THREAD_DETACH和DLL_PROCESS_DETACH。詳見微軟發佈的《Microsoft Portable Executable and Common Object File Format Specification v8》*/
    //僅在進程初始化建立主線程時執行的代碼
    if( reason == DLL_PROCESS_ATTACH ){
        MessageBox(NULL,"It's my test","tls test",MB_OK);
        IMAGE_DOS_HEADER *dos_head=(IMAGE_DOS_HEADER *)GetModuleHandle(NULL);
        PIMAGE_NT_HEADERS32 nt_head=(PIMAGE_NT_HEADERS32)((DWORD)dos_head+(DWORD)dos_head->e_lfanew);
        BYTE*OEP=(BYTE*)(nt_head->OptionalHeader.AddressOfEntryPoint+(DWORD)dos_head);
    
        for(unsigned long index=0;index<200;index++)
        {
            if(OEP[index]==0xcc)
            {
                ExitProcess(0);
            }
        }
 
 
    }
    return;
}