CFF says there’s a call back and that the tables is located in the BSS section. But the offset actually puts the addressofCallbacks in the top of the .rdata section the value points to the sizeofZerofill segment, which when static is 0.

Perhaps its dynamic or perhaps its meant to make me waste my time…weird

You cann’t imagine just how so much time I had spent for this info! Thanks!

About one decade ago I was cracking dos programs.
Since then I got in the automotive business and lost the contact with CPP, C# and co.

Now, I was trying to reverse M a n i c T i m e for a colleague to get access to the pro features and I got lost in threads.

I have just a small request. When time is at hand, please have a look at the app and let me know how hard do you find it to break it.

I don’t want the solution maybe just some pointers to what to learn, to do it on my own.

Thank you for the excellent tutorials, I’ve read a few.

; 32-bit executable
format PE GUI
entry start

include ‘win32a.inc’
include ‘\macro\proc32.inc’
;————————————————
section ‘all’ code data readable writable executable

start:
cinvoke printf, buf, fmt, [count]
invoke msgbox, 0, buf, t_main, 0
invoke exit, 0
;————————————————
tls_callback0:
inc dword [count]
cmp dword [count], 0×10 ; callback executed 0×10 times?
jge tls_end

; add another callback entry before returning
mov eax, [count]
mov dword [tls_callbacks+4*eax], tls_callback0

tls_end:
ret 0x0c
;————————————————
t_main db ‘main’,0
buf db 0×100 dup (0)
fmt db ‘tls count: %d’,0
count dd 0
;————————————————
; TLS directory
; !!! it’s possible to change tls table WHILE IN TLS CALLBACK itself,
; fex you have only 1 tls at first, but this tls adds some more -
; those added will execute normally (table is not cached by loader)!
align 0×10
data 9 ; tls
dd 0 ;Raw Data Start VA
dd 0 ;Raw Data End VA
dd tls_index ;Address of Index
dd tls_callbacks ;Address of Callbacks
dd 0 ;Size of Zero Fill
dd 0 ;Reserved

tls_index dd 0
tls_callbacks: ; only one callback is present initially
dd tls_callback0 ; callback proc
dd 0xff dup (0) ; space reserved for more callback entries (but null at load time)
dd 0
end data
;————————————————

; invoke ExitProcess, 0

data import

library user, ‘user32.dll’,\
kernel, ‘kernel32.dll’

import user,\
printf, ‘wsprintfA’,\
msgbox, ‘MessageBoxA’

import kernel,\
exit, ‘ExitProcess’
end data
;————————————————

2T2

409718 not 409781

409781 not 409718

at least I think