VX Heaven

Library Collection Sources Engines Constructors Simulators Utilities Links Forum

Unexpected Resutls [sic]

Peter Ferrie
Virus Bulletin, June 2002, pp.4-5
ISSN 0956-9979
June 2002

PDFDownload PDF (38.93Kb) (You need to be registered on forum)
[Back to index] [Comments]


In early 2000, while studying the latest release of the Portable Executable format documentation from Microsoft, I noticed the word `callback' in a section describing data initialization. The section was called `Thread Local Storage (TLS)'; in previous revisions of the documentation I had disregarded it, considering it uninteresting, but this time it had my full attention.

Where there are callbacks, there is executable code and where there is executable code, there may be viruses. However, it was a further two years before the appearance, in 2002, of the first virus that is aware of Thread Local Storage: W32/Chiton.

[Read the article]

By accessing, viewing, downloading or otherwise using this content you agree to be bound by the Terms of Use! aka