MCPcopy Create free account
hub / github.com/d35ha/CallObfuscator / generate

Method generate

src/obfuscate.cpp:78–184  ·  view source on GitHub ↗

Generate the obfuscated PE.

Source from the content-addressed store, hash-verified

76
77// Generate the obfuscated PE.
78cobf_error cobf::generate(string out_file)
79{
80 // Check if not loaded and getting a copy of the original PE.
81 if (this->pe_rawf.empty()) return cobf_error::COBF_PE_UNLOADED;
82
83 // Needed locals.
84 cobf_error ret_err = cobf_error::COBF_NO_ERROR;
85 PIMAGE_SECTION_HEADER sh_sec;
86 DWORD stub_entry;
87 DWORD funs_table;
88 DWORD symbols;
89 DWORD written;
90
91 // Open the file.
92 HANDLE h_file = CreateFileA(
93 out_file.c_str(), // The PE file path.
94 GENERIC_WRITE, // Access options.
95 FILE_SHARE_WRITE, // The share mode.
96 NULL, // Security attributes.
97 CREATE_ALWAYS, // Disposition.
98 FILE_ATTRIBUTE_NORMAL, // File attributes.
99 NULL // The template handle.
100 );
101
102 // Check the return.
103 if (h_file == INVALID_HANDLE_VALUE)
104 {
105 // Cannot create the specified file.
106 return cobf_error::COBF_CANNOT_CREATE_FILE;
107 };
108
109 // Save the original copy.
110 auto orig_pe = this->pe_rawf;
111
112 // Creating the shellcode section.
113 if (!this->create_shellcode_section(sh_sec, funs_table))
114 {
115 // Cannot create the section.
116 ret_err = cobf_error::COBF_CANNOT_CREATE_SECTION;
117 goto OBFUSCATE_FINISH;
118 };
119
120 // Applying the obfuscations.
121 this->apply_obfuscations(sh_sec, symbols);
122
123 // Adding the stub for the shellcode.
124 this->add_shellcode_stub(sh_sec, funs_table, symbols, stub_entry);
125
126 // Add the shellcode entry as a tls callback.
127 if (!this->add_shellcode_entry(sh_sec, stub_entry))
128 {
129 // Cannot do it.
130 ret_err = cobf_error::COBF_CANNOT_ADD_ENTRY;
131 goto OBFUSCATE_FINISH;
132 };
133
134 // Make it unrelocatable.
135 if (!this->disable_the_relocation())

Callers 1

mainFunction · 0.80

Calls 7

apply_obfuscationsMethod · 0.95
add_shellcode_entryMethod · 0.95
make_the_iat_writableMethod · 0.95
remove_debug_symbolsMethod · 0.95
finalize_peMethod · 0.95

Tested by

no test coverage detected