|
|
|
|
|
|
|
WARNING: This documentation is in need of update. The full decryption source code is provided within PESuite, for easy linking into your application. It should work fine with any unmanaged application. Although the decryption code is C++, any clever programmer can integrate it as a library or rewrite it in another language. For thread safety, it is now exposed as an OO class.
This PE tool encrypts/obfuscates marked strings so that even in the decompressed virtual image they are not in their plaintext form. At runtime, when these strings are referenced, an application must use special functions to retrieve the plaintext version of the strings.
To facilitate the string decryption at run-time is PEHTLIB. It can be statically linked, or a DLL can be provided (email us). Registered users also have access to the source code, so they can simply link its C++ source into their project to utilize the string decryption functions.
The idea is to mark strings for encryption by prefixing them with a special set of characters. This lets PEHideText find them and encrypt them. At runtime, only your application knows where these strings are located. Your code will have been written to use the PEHTLIB decryption functions, and will access the encrypted strings at whatever addresses they happened to be linked to.
When examining the virtual memory your process occupies, plaintext strings are easily visible, and often automatically extracted by advanced task managers. This will help prevent that by keeping the plaintext strings in dynamically allocated memory. The dynamically allocted memory can live for a brief microsecond as-needed, or remain so it need not be decrypted again.
The prefixes for string-encryption are defined in a C++ header file, PEHT.H.
One of the unique capabilities is for *optional* re-use of deobfuscated returned buffers. That way, if you decrypted the same text 1000 times, you'd get a singular and instance to its plaintext form. This is optional though, and simply freeing the derypted buffer with the provided API will result in a normal new allocation.
For multi-byte (ascii) strings, define a string with PEHT_DEFINE_ENCRYPTED_TEXT_A
For wide-character (unicode) strings, define a string with PEHT_DEFINE_ENCRYPTED_TEXT_W
For TCHARs (type defined at compile time) strings, define a string with PEHT_DEFINE_ENCRYPTED_TEXT_T
PEHideText should then be run on the uncompressed application so that it can encrypt/obfuscate these strings.
Applications should then include the PEHT source code, or link with the library. The library has changed, so new documentation is PENDING.