8 Dec
2022
8 Dec
'22
5:12 p.m.
dbghelp.ImageDirectoryEntryToDataEx does most of the painful job for you
I didn't see anything in there that indicated that it would properly read memory from the target process
(line 216 in winedbg/symbol: addr = (DWORD_PTR)(is_dir64 ? tls.dir64.AddressOfIndex : tls.dir32.AddressOfIndex);) doesn't seem to be relocated
I think it is. You can see ntdll functions dereferencing it directly here https://gitlab.winehq.org/wine/wine/-/blob/7acd3aa429f2d45d96f4699906dc81e47...
I couldn't figure out how to load a pdb in winedbg to test it though (or is there another way to get debug symbols that contain msvc-style tls)