czs108 / windows-pe-packer Goto Github PK

🗜️ A packer for Windows x86 executable files written in C and Intel x86 Assembly. The new file after packing can obstruct reverse engineering.

License: MIT License

CMake 2.86% C 74.88% Assembly 21.75% PowerShell 0.50%

windows reverse-engineering security pe

windows-pe-packer's Introduction

Windows PE Packer

Languages

Introduction

PE-Packer is a simple packer for Windows PE files. The new PE file after packing can obstruct the process of reverse engineering.

It will do the following things when packing a PE file:

Transforming the original import table.
Encrypting sections.
Clearing section names.
Installing the shell-entry.

When running a packed PE file, the shell-entry will decrypt and load the original program as follows:

Decrypting sections.
Initializing the original import table.
Relocation.

Before packing, using some disassembly tools can disassemble the executable file to analyze the code, such as IDA Pro.

Disassembling the code.
Searching constant strings.
Analyzing the import table.

After packing, the reverse analysis will be obstructed.

Disassembling the code.
Searching constant strings.
Analyzing the import table.

Warning

This project is just a demo for beginners to study Windows PE Format and Assembly Language. It still has some compatibility problems and bugs that cannot be used in practice.

Getting Started

Prerequisites

The project must configure on/for Windows 32-bit and can only process 32-bit .exe programs now.

Install MASM32.
Install MinGW-w64, select i686 architecture.
Install CMake.
Set the PATH environment variables of these three tools.

Building

mkdir -p build
cd build
cmake .. -D CMAKE_C_COMPILER=gcc -G "MinGW Makefiles"
cmake --build .

Or run the build.ps1 file directly:

PS> .\build.ps1

Usage

To pack a program, you must specify its input name and the output name.

PE-Packer <input-file> <output-file>

For example:

PE-Packer hello.exe hello-pack.exe

Documents

You can use Doxygen to generate the document.

References

《加密与解密（第3版）》段钢

PE Format - Windows Dev Center

License

Distributed under the MIT License. See LICENSE for more information.

windows-pe-packer's People

Stargazers

Watchers

windows-pe-packer's Issues

[!] Must configuring on/for x86 platform

hello,
when i try to compile the program using .\build.ps1 i get error on x86 arch:

PS C:\temp\PE-Packer> .\build.ps1

Directory: C:\temp\PE-Packer

Mode LastWriteTime Length Name

d----- 2/24/2021 6:03 PM bin
d----- 2/24/2021 6:03 PM build
-- The C compiler identification is GNU 8.1.0
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: C:/ProgramData/chocolatey/bin/gcc.exe - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- The ASM_MASM compiler identification is MSVC
-- Found assembler: C:/masm32/bin/ml.exe
CMake Error at src/shell/CMakeLists.txt:20 (message):
[!] Must configuring on/for x86 platform

running on a windows 10 VM, as the tool required i did install mingw-w64 and cmake using chocolatey repo.
those are the release i found:
mingw: x86_64-8.1.0-release-posix-seh-rt_v6-rev0.7z
cmake: cmake 3.19.5

seems i cannot set , during the compile step the x86 arch, have you any idea ?
thanks

IsFileSmallThan2G in file_access.cpp can't work as it describes

Original IsFileSmallThan2G

it can't correctly determine if the file size is greater than 2G, but 4G.

BOOL IsFileSmallThan2G(
	CONST HANDLE file
) {
	assert(file != INVALID_HANDLE_VALUE);

	DWORD size_high = 0;
	GetFileSize(file, &size_high);
	return size_high == 0;
}

Recommend Fixed Version

BOOL IsFileSmallThan2G(
	CONST HANDLE file
) {
	assert(file != INVALID_HANDLE_VALUE);
	DWORD size_low = GetFileSize(file, NULL);
	return !(size_low & 0x80000000);
}

PE Import Table Issue

Hello Brother,

First of all, thanks for sharing the project.

I embed an extra dll file with STUD_PE in any .exe file, after this embedding process, when I pack it with packer, the embedded file disappears and loses its function.

When I encrypt the relevant .exe file without adding an extra dll file, and when I add the DLL file later, this time the file cannot access the RAM and the program closes.

In short, what needs to be resolved is that any .dll file transferred and embedded in the Import Table with STUD_PE needs to be detected and included by the packer.

Kind Regards.

Feature request: support x64 architecture

Hi @czs108 !

Do you plan adding support for x64 architecture as well?

Cheers,
Mariusz.