Finalize the obfuscated PE.
| 536 | |
| 537 | // Finalize the obfuscated PE. |
| 538 | VOID cobf::finalize_pe(PIMAGE_SECTION_HEADER& sh_sec) |
| 539 | { |
| 540 | // Get the sections. |
| 541 | PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)this->pe_rawf.data(); |
| 542 | PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)&this->pe_rawf.data()[dos_hdr->e_lfanew]; |
| 543 | |
| 544 | // Calculate the needed size. |
| 545 | size_t gap_size = nt_hdrs->OptionalHeader.FileAlignment - (sh_sec->SizeOfRawData % |
| 546 | nt_hdrs->OptionalHeader.FileAlignment); |
| 547 | |
| 548 | // Set the section info. |
| 549 | DWORD sh_sec_offset = (DWORD)((PBYTE)sh_sec - this->pe_rawf.data()); |
| 550 | |
| 551 | // Resize the whole pe. |
| 552 | this->pe_rawf.resize((size_t)sh_sec->PointerToRawData + (size_t)sh_sec->SizeOfRawData + gap_size); |
| 553 | sh_sec = (PIMAGE_SECTION_HEADER)(this->pe_rawf.data() + sh_sec_offset); |
| 554 | |
| 555 | // Update the section information. |
| 556 | sh_sec->Misc.VirtualSize = sh_sec->SizeOfRawData; |
| 557 | sh_sec->SizeOfRawData += (DWORD)gap_size; |
| 558 | nt_hdrs->OptionalHeader.SizeOfImage += sh_sec->Misc.VirtualSize + nt_hdrs->OptionalHeader.SectionAlignment - |
| 559 | (sh_sec->Misc.VirtualSize % nt_hdrs->OptionalHeader.SectionAlignment); |
| 560 | nt_hdrs->OptionalHeader.CheckSum = 0; |
| 561 | }; |
| 562 | |
| 563 | // Matching with the module name or any symbol. |
| 564 | BOOL cobf::csym::match_wildcard(PCCH wild_card, PCCH string) |