PE-Packer is a simple packer for Windows PE files. The new PE file after packing can obstruct the process of reverse engineering.
It will do the following things when packing a PE file:
- Transforming the original import table.
- Encrypting sections.
- Clearing section names.
- Installing the shell-entry.
When running a packed PE file, the shell-entry will decrypt and load the original program as follows:
- Decrypting sections.
- Initializing the original import table.
- Relocation.
Before packing, using some disassembly tools can disassemble the executable file to analyze the code, such as IDA Pro.
Disassembling the code.
![]()
Searching constant strings.
![]()
Analyzing the import table.
![]()
After packing, the reverseanalysis will be obstructed.
Disassembling the code.
![]()
Searching constant strings.
![]()
Analyzing the import table.
![]()
This project is just a demo for beginners to study Windows PE Format and Assembly Language. It still has some compatibility problems and bugs that cannot be used in practice.
Getting Started
Prerequisites
The project must configure on/for Windows 32-bit and can only process 32-bit.exe programs now.
- Install MASM32.
- Install MinGW-w64, select
i686architecture. - Install CMake.
- Set the
PATHenvironment variables of these three tools.
Building
> mkdir -p build
> cd build
> cmake .. -D CMAKE_C_COMPILER=gcc -G "MinGW Makefiles"
> cmake --build .Or run the build.ps1 file directly:
> .\build.ps1Usage
To pack a program, you must specify its input name and the output name.
PE-Packer <input-file> <output-file>For example:
PE-Packer hello.exe hello-pack.exeDocuments
You can use Doxygen to generate the document.
In order to avoid scanning.md files, you must add *.md to the EXCLUDE_PATTERNS configuration option.
EXCLUDE_PATTERNS = *.md
This option is in "Expert" -> "Input" page.
References
PE Format - Windows Dev Center
Contact
GitHub: https://github.com/czs108/
E-Mail: chenzs108@outlook.com
WeChat: chenzs108