Method apply_obfuscation

src/obfuscate.cpp:640–687

Apply the obfuscation.

// Apply the obfuscation.
VOID cobf::csym::apply_obfuscation(PBYTE pe_rawf, DWORD strings_off, vector<BYTE>& strings,
    vector<shellcode::obfuscated_sym>& symbols)
{
    // Check if not obfuscated.
    if (!this->obfuscated) return;

    // Build the symbol.
    shellcode::obfuscated_sym symbol;
    symbol.dll_name = this->dll_rva;
    symbol.sym_thnk = this->fth_rva;

    // Test if imported by name.
    if (symbol.by_name = this->by_name)
    {
        // Imported by name.
        symbol.sym_info.sym_hash = shellcode::hash_string((PCHAR)this->sym_name.c_str());

        // Removing the old name.
        for (size_t idx = 0; idx < this->sym_name.size() + sizeof(CHAR); idx++)
        {
            // Randomize it.
            pe_rawf[this->name_off + idx] = rand();
        };
    }
    // Imported by ordinal.
    else symbol.sym_info.sym_ord = this->obf_ord;

    // Calculating the thunk data.
    PVOID thunk_data;
    if (this->to_name)
    {
        // Obfuscated to name.
        thunk_data = (PVOID)(strings_off + strings.size());

        // Append a new import by name struct.
        strings.push_back(rand());
        strings.push_back(rand());
        strings.insert(strings.end(), this->obf_name.data(),
            this->obf_name.data() + this->obf_name.size() + 
            sizeof(CHAR));
    }
    // Obfuscated to ordinal.
    else thunk_data = (PVOID)(this->obf_ord | IMAGE_ORDINAL_FLAG);

    // Save the symbol.
    symbols.push_back(symbol);
    *(PVOID*)&pe_rawf[this->oth_off] = thunk_data;
};

// Constructor.
cobf::csym::csym(string sym_name, DWORD dll_rva, DWORD fth_rva, DWORD oth_off, DWORD name_off)