Method apply_obfuscations

src/obfuscate.cpp:267–297

Apply the patches to the PE.

// Apply the patches to the PE.
VOID cobf::apply_obfuscations(PIMAGE_SECTION_HEADER& sh_sec, DWORD& syms_rva)
{
    // The array of symbols to load.
    vector<BYTE> strings_of_imports;
    vector<shellcode::obfuscated_sym> symbols;

    // Enumerate the obfuscate by name array.
    DWORD c_rva = sh_sec->VirtualAddress + (DWORD_PTR)sh_sec->SizeOfRawData;
    for (auto& mod : this->pe_mods) for (auto& sym : mod.mod_syms) sym.apply_obfuscation(
        this->pe_rawf.data(), c_rva, strings_of_imports, symbols);

    // Set the section info.
    symbols.push_back({ 0 });
    DWORD sh_sec_offset = (DWORD)((PBYTE)sh_sec - this->pe_rawf.data());

    // Resize the whole pe.
    size_t size_of_symbols = symbols.size() * sizeof(shellcode::obfuscated_sym);
    this->pe_rawf.resize(this->pe_rawf.size() + strings_of_imports.size() + size_of_symbols);
    sh_sec = (PIMAGE_SECTION_HEADER)(this->pe_rawf.data() + sh_sec_offset);

    // Copy the strings and the symbols.
    memcpy_s(this->pe_rawf.data() + sh_sec->PointerToRawData + sh_sec->SizeOfRawData,
        strings_of_imports.size() + size_of_symbols, strings_of_imports.data(),
        strings_of_imports.size());
    memcpy_s(this->pe_rawf.data() + sh_sec->PointerToRawData + sh_sec->SizeOfRawData + 
        strings_of_imports.size(), size_of_symbols, symbols.data(), size_of_symbols);

    // Edit the properties.
    syms_rva = sh_sec->VirtualAddress + sh_sec->SizeOfRawData + (DWORD)strings_of_imports.size();
    sh_sec->SizeOfRawData += (DWORD)strings_of_imports.size() + (DWORD)size_of_symbols;
};

// Add the stub for shellcode.
VOID cobf::add_shellcode_stub(PIMAGE_SECTION_HEADER& sh_sec, DWORD funs_offset, DWORD syms_rva, DWORD& entry)