Method remove_debug_symbols

src/obfuscate.cpp:405–439

Strip any debug symbols from the PE.

// Strip any debug symbols from the PE.
BOOL cobf::remove_debug_symbols()
{
    // Get the headers.
    PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)this->pe_rawf.data();
    PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)&this->pe_rawf.data()[dos_hdr->e_lfanew];

    // Get the table.
    PIMAGE_DEBUG_DIRECTORY p_debug; size_t debug_size;
    if (!this->get_data_table(IMAGE_DIRECTORY_ENTRY_DEBUG, (PVOID*)&p_debug, debug_size))
    {
        // Cannot verify the debug table.
        return FALSE;
    };

    // Zero it.
    if (p_debug) ZeroMemory(p_debug, debug_size);
    nt_hdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG] = { 0, 0 };

    // Strip it.
    nt_hdrs->FileHeader.NumberOfSymbols = 0;
    nt_hdrs->FileHeader.PointerToSymbolTable = 0;

    // Configure the sections.
    PIMAGE_SECTION_HEADER c_sec = (PIMAGE_SECTION_HEADER)&this->pe_rawf[dos_hdr->e_lfanew +
        sizeof(nt_hdrs->Signature) + sizeof(nt_hdrs->FileHeader) +
        nt_hdrs->FileHeader.SizeOfOptionalHeader];
    for (size_t idx = 0; idx < nt_hdrs->FileHeader.NumberOfSections; idx++)
    {
        // Strip all of the information.
        c_sec[idx].PointerToLinenumbers = 0;
        c_sec[idx].NumberOfLinenumbers = 0;
    };

    return TRUE;
};

// Make the import table section writable for the shellcode.
BOOL cobf::make_the_iat_writable()