Topic created on: August 8, 2008 23:30 CDT by tweaker .

I started to work on this contest:

http://www.khallenge.com/

and I completed the first file and received the second one.

The second file contains a lot of anti-debugging techniques.  The one that caught my interest was the tls callback.

I found some general information on the net about it, but I'm really not sure what the stack is supposed to look like upon entering a tls callback.  The one instruction that I am confused about is:

arg_4           = dword ptr  8

cmp     [esp+arg_4], 1    

found immediately upon entering the TLS Callback function.  Where are the main's arguments on the stack after entering the TLS Callback?  

Can anyone help me out here?  I'd just look to hear more about tls callbacks from the assembler's POV.