Method add_shellcode_entry

src/obfuscate.cpp:463–535

Add the shellcode entry as a callback.

// Add the shellcode entry as a callback.
BOOL cobf::add_shellcode_entry(PIMAGE_SECTION_HEADER& sh_sec, DWORD entry)
{
    // Get the headers.
    PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)this->pe_rawf.data();
    PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)&this->pe_rawf.data()[dos_hdr->e_lfanew];

    // Build the array of addresses.
    vector<PVOID> tls_cbs = { (PVOID)(nt_hdrs->OptionalHeader.ImageBase + entry) };
    vector<BYTE> tls_data;

    // Get the table.
    PIMAGE_TLS_DIRECTORY p_tls; size_t tls_size;
    if (!this->get_data_table(IMAGE_DIRECTORY_ENTRY_TLS, (PVOID*)&p_tls, tls_size))
    {
        // Cannot verify the tls table.
        return FALSE;
    };

    // The tls directory can be existing or not.
    if (p_tls)
    {
        // Get the offset to the array.
        DWORD tls_cbs_off = (DWORD)(p_tls->AddressOfCallBacks - nt_hdrs->OptionalHeader.ImageBase);
        if (!this->rva_to_offset(tls_cbs_off, tls_cbs_off)) return FALSE;

        // Adding the availible callbacks.
        PVOID* p_tls_cbs = (PVOID*)&this->pe_rawf[tls_cbs_off];

        // Insert and remove the old pointer.
        do { tls_cbs.push_back(*p_tls_cbs);
        } while (*p_tls_cbs && (*p_tls_cbs++ = NULL, TRUE));

        // Removing the old array and pointer.
        p_tls->AddressOfCallBacks = nt_hdrs->OptionalHeader.ImageBase + sh_sec->VirtualAddress +
            sh_sec->SizeOfRawData;
    }
    else
    {
        // Building a new tls directory.
        IMAGE_TLS_DIRECTORY tls_dir = { 0 }; DWORD index = 0;
        tls_dir.AddressOfIndex = nt_hdrs->OptionalHeader.ImageBase + sh_sec->VirtualAddress +
            sh_sec->SizeOfRawData + sizeof(tls_dir);
        tls_dir.AddressOfCallBacks = tls_dir.AddressOfIndex + sizeof(index);

        // Build up the bytes array.
        tls_data.insert(tls_data.end(), (PBYTE)&tls_dir, (PBYTE)&tls_dir + sizeof(tls_dir));
        tls_data.insert(tls_data.end(), (PBYTE)&index, (PBYTE)&index + sizeof(index));
        tls_cbs.push_back(NULL);

        // Point to the new table.
        nt_hdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS] = {
            sh_sec->VirtualAddress + sh_sec->SizeOfRawData,
            (DWORD)(sizeof(tls_dir) + sizeof(index) + tls_cbs.size() * sizeof(PVOID))
        };
    };

    // Writing to the shellcode section.
    DWORD sh_sec_offset = (DWORD)((PBYTE)sh_sec - this->pe_rawf.data());