TLS Modification¶

LIEF can be used to modify, create, or remove Thread Local Storage (TLS) information.

TLS Modifications¶

All attributes of the interface can be modified as long as the changes are consistent with the layout of the PE binary. For instance, you can adjust the TLS callbacks by removing, reordering, or adding addresses:

pe: lief.PE.Binary

tls = pe.tls
assert isinstance(tls, lief.PE.TLS)

callbacks: list[int] = tls.callbacks

# Remove the last entry
callbacks.pop()

# Add an address
callbacks.append(0x140001010)

tls.callbacks = callbacks

pe.write("tls_modified.exe")

std::unique_ptr<LIEF::PE::Binary> pe;

TLS* tls = pe->tls();

std::vector<uint64_t> callbacks = tls->callbacks();

// Remove the last entry
callbacks.pop_back();

// Add an address
callbacks.push_back(0x140001010);

tls->callbacks(std::move(callbacks));

pe->write("tls_modified.exe");

let pe: &mut lief::pe::Binary = some_pe;

let mut tls = pe.tls().unwrap();

let mut callbacks: Vec<u64> = tls.callbacks();

// Remove the last entry
callbacks.pop();

// Add an address
callbacks.push(0x140001010);

tls.set_callbacks(&callbacks);

pe.write("tls_modified.exe");

Relocations

Note that LIEF automatically manages the relocations that must be created or removed when modifying the TLS callbacks.

TLS Creation¶

If a PE binary does not contain TLS metadata, LIEF can be used to create this structure.

First, we can create and initialize a TLS instance:

tls = lief.PE.TLS()

tls.callbacks = [
    0x140001000,
    0x140001010,
]

LIEF::PE::TLS tls;

tls.callbacks(std::vector<uint64_t>{
    0x140001000,
    0x140001010,
});

let mut tls = lief::pe::TLS::new();

tls.set_callbacks(&[0x140001000, 0x140001010]);

And then, we can add this instance to a :

pe.tls = tls  # `tls` defined previously

pe.write("tls_demo.exe")

pe->tls(tls); // `tls` defined previously

pe->write("tls_demo.exe");

pe.set_tls(&tls); // `tls` defined previously

pe.write("tls_demo.exe");

Relocations

Similar to TLS callback modifications, LIEF automatically manages relocations. In addition, it automatically initializes (if not set by the user) AddressOfIndex, which is required when setting up TLS metadata.