Hi,

I'm trying to xor (as told in a previous topic) the whole .code section of an exe file (still CALC.EXE).

Here is the code :



My problem is the following : It encrypts the IAT which is at the beggining of the .code section.
So the import table is screwed up, and so the end file is corrupted.
I hardly find anything to help myself on the internet, no doc, no source, no explanation, nothing.

Does anyone has a clue for me to investigate ?

Thanks

I'm actually "playing" with the PE headers of the incrimined file (CALC.EXE)

It seems that just reset the IAT directory structure to
VA = 00000000
VS = 00000000

and reseting the boundimport directory structure to
VA = 00000000
VS = 00000000

Does NOT corrupt the execution of the file.

Is the IAT optional ? is this just a "helper" to resolve APIS faster ?? (instead of directly looking into the import table ?

I checked the MSDN documentation about the PE headers but it does not seems to be very clear for me !

Thanks for the help.

IAT is necessary for the executable to function correctly.

You have to careful to only encrypt what is needed.

Can you actually encrypt the IAT? I don't think you can as the Windows process loader loads the IAT into memory before the execution of your program, so it wont work like that. I may be wrong, so please correct me if I am.

You could always use GetProcAddress and decrypt data upon loading. It would be a much better method. You could replace all calls to an API with injected code (IAT patching).

Hi,

Thank you for your answer.
I spent some time on the all import stuff and found out it's better to "fake" an import table importing loadlibrary and getprocaddress, and then restore the APIs during the file runtime, just as pal said.

This way I dont have to take care of what code portion i encrypt ! This sounds good to me, if there is anything that would make it impossible, illuminate me :p

Thank you again