Method disable_the_relocation

src/obfuscate.cpp:369–402

Disable the relocations at the PE.

// Disable the relocations at the PE.
BOOL cobf::disable_the_relocation()
{
    // Get the headers.
    PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)this->pe_rawf.data();
    PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)&this->pe_rawf.data()[dos_hdr->e_lfanew];

    // Get the table.
    PIMAGE_RESOURCE_DIRECTORY p_relocs; size_t relocs_size;
    if (!this->get_data_table(IMAGE_DIRECTORY_ENTRY_BASERELOC, (PVOID*)&p_relocs, relocs_size))
    {
        // Cannot verify the relocations.
        return FALSE;
    };

    // Zero it.
    if (p_relocs) ZeroMemory(p_relocs, relocs_size);
    nt_hdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC] = { 0, 0 };

    // Stop the relocations.
    nt_hdrs->FileHeader.Characteristics |= IMAGE_FILE_RELOCS_STRIPPED;

    // Configure the sections.
    PIMAGE_SECTION_HEADER c_sec = (PIMAGE_SECTION_HEADER)&this->pe_rawf[dos_hdr->e_lfanew + 
        sizeof(nt_hdrs->Signature) + sizeof(nt_hdrs->FileHeader) +
        nt_hdrs->FileHeader.SizeOfOptionalHeader];
    for (size_t idx = 0; idx < nt_hdrs->FileHeader.NumberOfSections; idx++)
    {
        // Strip all of the information.
        c_sec[idx].PointerToRelocations = 0;
        c_sec[idx].NumberOfRelocations = 0;
    };

    return TRUE;
};

// Strip any debug symbols from the PE.
BOOL cobf::remove_debug_symbols()