Method create_shellcode_section

src/obfuscate.cpp:201–264

Create a new entry at the sections header.

// Create a new entry at the sections header.
BOOL cobf::create_shellcode_section(PIMAGE_SECTION_HEADER& sh_sec, DWORD& funs_rva)
{
    // Get the sections.
    PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)this->pe_rawf.data();
    PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)&this->pe_rawf.data()[dos_hdr->e_lfanew];

    // Verify the existence of a new section.
    if (nt_hdrs->OptionalHeader.SizeOfHeaders < dos_hdr->e_lfanew + sizeof(nt_hdrs->Signature) +
        sizeof(nt_hdrs->FileHeader) + nt_hdrs->FileHeader.SizeOfOptionalHeader +
        ((size_t)nt_hdrs->FileHeader.NumberOfSections + 1) * sizeof(IMAGE_SECTION_HEADER))
        return FALSE;

    // Get the section of the shellcode.
    sh_sec = (PIMAGE_SECTION_HEADER)&this->pe_rawf[dos_hdr->e_lfanew +
        sizeof(nt_hdrs->Signature) + sizeof(nt_hdrs->FileHeader) +
        nt_hdrs->FileHeader.SizeOfOptionalHeader + nt_hdrs->FileHeader.NumberOfSections *
        sizeof(IMAGE_SECTION_HEADER)];

    // Set the shellcode section properties.
    PIMAGE_SECTION_HEADER prev_sec = sh_sec - 1;
    sh_sec->Name[0] = '.'; sh_sec->Name[1] = 'c';
    sh_sec->Name[2] = 'o'; sh_sec->Name[3] = 'b';
    sh_sec->Name[4] = 'f'; sh_sec->Name[5] = '\0';
    sh_sec->Name[6] = '\0'; sh_sec->Name[7] = '\0';
    sh_sec->NumberOfLinenumbers = 0;
    sh_sec->NumberOfRelocations = 0;
    sh_sec->PointerToRelocations = 0;
    sh_sec->PointerToLinenumbers = 0;
    sh_sec->Misc.VirtualSize = 0;
    sh_sec->SizeOfRawData = shellcode::shellcode_size + sizeof(shellcode::shellcodes_funs);
    sh_sec->PointerToRawData = prev_sec->PointerToRawData + prev_sec->SizeOfRawData;
    sh_sec->VirtualAddress = prev_sec->VirtualAddress + prev_sec->Misc.VirtualSize +
        nt_hdrs->OptionalHeader.SectionAlignment - (prev_sec->Misc.VirtualSize %
        nt_hdrs->OptionalHeader.SectionAlignment);
    sh_sec->Characteristics = IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE;
    nt_hdrs->FileHeader.NumberOfSections++;

    // Set the section info.
    DWORD sh_sec_offset = (DWORD)((PBYTE)sh_sec - this->pe_rawf.data());

    // Resize the whole pe.
    this->pe_rawf.resize(this->pe_rawf.size() + sh_sec->SizeOfRawData + 
        sizeof(shellcode::shellcodes_funs));
    sh_sec = (PIMAGE_SECTION_HEADER)(this->pe_rawf.data() + sh_sec_offset);
    funs_rva = sh_sec->VirtualAddress + shellcode::shellcode_size;

    // Copy the shellcode and the table.
    memcpy_s(this->pe_rawf.data() + sh_sec->PointerToRawData, sh_sec->SizeOfRawData,
        shellcode::shellcode_start, shellcode::shellcode_size);
    memcpy_s(this->pe_rawf.data() + sh_sec->PointerToRawData + shellcode::shellcode_size,
        sizeof(shellcode::shellcodes_funs), shellcode::shellcodes_funs,
        sizeof(shellcode::shellcodes_funs));

    // Updating the functions offsets.
    PDWORD p_sh_funs = (PDWORD)(this->pe_rawf.data() + sh_sec->PointerToRawData + shellcode::shellcode_size);
    for (size_t idx = 0; idx < sizeof(shellcode::shellcodes_funs) / sizeof(*shellcode::shellcodes_funs); idx++)
    {
        // Update the offset.