2

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the stub function. But I can't implement the same method in PE32+ executable(64bit exe) as it won't support inline assembly. I am able to add the stub and encrypt the text segment.

Issue is with the decryption logic in the stub.

I tried adding separate .asm files but failed as I am new to assembly language. Is it possible to do without assembly language? Please help me with any good documentation or samples on PE32+ segment encryption.

0

If you're going to use assembly stubs, you can just patch it directly to the binary. You don't really need to use c++ to do that for you.
To do that for both 32 and 64 bit, you can use CreateFile, CreateFileMapping, and MapViewOfFile. This will allow you to dump the .text section, basically all sections, of the PE and you can do whatever you want to it. Then you can add a function to decrypt it or whatever and/or write a stub to do the decrypting portion of it in a space big enough to fit that stub or just add another section to the PE

| improve this answer | |
  • Thank you. I am not trying the assembly code now. Is it possible to get some sample code/documentation links for 64bit encryption? Because all the docs I found is for 32 bit. When I tried to apply the same in 64bit, it is not working as expected. – AcCoder Nov 11 '19 at 4:14
  • Oh boy, there's a LOT of sources out there for encryption. For you, I would recommend something as simple as a XOR encryption. Once you map out the binary, you can iterate through each section, usually the .text section, and then for each byte in that section, you can XOR it with whatever key. Once you have that, save the new XOR'ed bytes into the binary that way your stub will be able to decrypt it with the same key you used to encrypt it. This is more than enough information to get you going. – Jon Nov 11 '19 at 6:38
  • Thank you very much for the reply. But my issue is not with the encryption or decryption. I am able to encrypt the .text segment and added the stub as entry point. I am trying to load the PE sections into memory, decrypt the .text segment there and execute it from memory. It is not happening. I am trying to get a proper way to load, decrypt and run 'PE64' from memory using .stub segment as PE entry point. – AcCoder Nov 11 '19 at 9:46
  • I will try the CreateFile,CreateFileMapping and MapViewOfFile as you suggested. – AcCoder Nov 11 '19 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.