Generate the obfuscated PE.
| 76 | |
| 77 | // Generate the obfuscated PE. |
| 78 | cobf_error cobf::generate(string out_file) |
| 79 | { |
| 80 | // Check if not loaded and getting a copy of the original PE. |
| 81 | if (this->pe_rawf.empty()) return cobf_error::COBF_PE_UNLOADED; |
| 82 | |
| 83 | // Needed locals. |
| 84 | cobf_error ret_err = cobf_error::COBF_NO_ERROR; |
| 85 | PIMAGE_SECTION_HEADER sh_sec; |
| 86 | DWORD stub_entry; |
| 87 | DWORD funs_table; |
| 88 | DWORD symbols; |
| 89 | DWORD written; |
| 90 | |
| 91 | // Open the file. |
| 92 | HANDLE h_file = CreateFileA( |
| 93 | out_file.c_str(), // The PE file path. |
| 94 | GENERIC_WRITE, // Access options. |
| 95 | FILE_SHARE_WRITE, // The share mode. |
| 96 | NULL, // Security attributes. |
| 97 | CREATE_ALWAYS, // Disposition. |
| 98 | FILE_ATTRIBUTE_NORMAL, // File attributes. |
| 99 | NULL // The template handle. |
| 100 | ); |
| 101 | |
| 102 | // Check the return. |
| 103 | if (h_file == INVALID_HANDLE_VALUE) |
| 104 | { |
| 105 | // Cannot create the specified file. |
| 106 | return cobf_error::COBF_CANNOT_CREATE_FILE; |
| 107 | }; |
| 108 | |
| 109 | // Save the original copy. |
| 110 | auto orig_pe = this->pe_rawf; |
| 111 | |
| 112 | // Creating the shellcode section. |
| 113 | if (!this->create_shellcode_section(sh_sec, funs_table)) |
| 114 | { |
| 115 | // Cannot create the section. |
| 116 | ret_err = cobf_error::COBF_CANNOT_CREATE_SECTION; |
| 117 | goto OBFUSCATE_FINISH; |
| 118 | }; |
| 119 | |
| 120 | // Applying the obfuscations. |
| 121 | this->apply_obfuscations(sh_sec, symbols); |
| 122 | |
| 123 | // Adding the stub for the shellcode. |
| 124 | this->add_shellcode_stub(sh_sec, funs_table, symbols, stub_entry); |
| 125 | |
| 126 | // Add the shellcode entry as a tls callback. |
| 127 | if (!this->add_shellcode_entry(sh_sec, stub_entry)) |
| 128 | { |
| 129 | // Cannot do it. |
| 130 | ret_err = cobf_error::COBF_CANNOT_ADD_ENTRY; |
| 131 | goto OBFUSCATE_FINISH; |
| 132 | }; |
| 133 | |
| 134 | // Make it unrelocatable. |
| 135 | if (!this->disable_the_relocation()) |
no test coverage detected