cobf Class Reference

#include <cobf.hpp>

Public Member Functions
	cobf (string pe_path)
	Constructor for the obfuscation module. More...
cobf_error	load_pe ()
	Load the specified PE from disk. More...
cobf_error	unload_pe ()
	Unload the specified PE from memory. More...
cobf_error	obf_sym (string dll_name, string sym_name, string obf_name)
	Obfuscate one symbol (name) with another (name). More...
cobf_error	obf_sym (string dll_name, string sym_name, WORD obf_ord)
	Obfuscate one symbol (name) with another (ordinal). More...
cobf_error	obf_sym (string dll_name, WORD sym_ord, WORD obf_ord)
	Obfuscate one symbol (ordinal) with another (ordinal). More...
cobf_error	obf_sym (string dll_name, WORD sym_ord, string obf_name)
	Obfuscate one symbol (ordinal) with another (name). More...
cobf_error	unobf_sym (string dll_name, string sym_name)
	Unobfuscate one symbol (name). More...
cobf_error	unobf_sym (string dll_name, WORD sym_ord)
	Unobfuscate one symbol (ordinal). More...
cobf_error	generate (string out_file)
	Generate the obfuscated PE. More...

Detailed Description

The main obfuscator class, holds the needed load, configure and obfuscate the input PE.

Definition at line 25 of file cobf.hpp.

Constructor & Destructor Documentation

cobf()

cobf::cobf

(

string

pe_path

)

Constructor for the obfuscation module.

Parameters

[in]

pe_path

Path of the PE file to obfuscate.

Returns

The instance.

Definition at line 363 of file load.cpp.

Member Function Documentation

generate()

cobf_error cobf::generate

(

string

out_file

)

Generate the obfuscated PE.

Parameters

[in]

out_file

The file to write to.

Returns

COBF_NO_ERROR if done successfully. COBF_PE_UNLOADED if the PE is not loaded. COBF_CANNOT_CREATE_FILE if unable to create the file. COBF_CANNOT_ADD_ENTRY if cannot register the shellcode entry. COBF_CANNOT_DISABLE_RELOCS if cannot strip the relocations. COBF_INVALID_IAT_SECTION if the IAT table is invalid. COBF_CANNOT_REMOVE_DBG_SYMS if unable to strip the symbols. COBF_CANNOT_WRITE_FILE if cannot write to the file. COBF_CANNOT_CLEAR if cannot clear the resources.

Note

It's not thread-safe, be cautious.

Definition at line 78 of file obfuscate.cpp.

load_pe()

cobf_error cobf::load_pe

(

)

Load the specified PE from disk.

Returns

COBF_NO_ERROR if done successfully. COBF_PE_LOADED if the PE is already loaded. COBF_CANNOT_OPEN_FILE if the file cannot be opened. COBF_CANNOT_GET_SIZE if the loader cannot get the size. COBF_CANNOT_READ_FILE if the loaded cannot read the file. COBF_INVALID_DOS_HDR if the PE has invalid dos header. COBF_INVALID_NT_HDRS if the PE has invalid nt headers. COBF_UNSUPPORTED_PE if the PE type is unsupported. COBF_INVALID_SECTION_HDR if the PE has invalid section header. COBF_INVALID_IMPORTS_DIR if the PE has invalid imports directory. COBF_CANNOT_PARSE_IMPORTS if the parser cannot parse all of the symbols. COBF_CANNOT_CLEAR if cannot clear the resources.

Note

It's not thread-safe, be cautious.

Definition at line 17 of file load.cpp.

obf_sym() [1/4]

cobf_error cobf::obf_sym	(	string	dll_name,
		string	sym_name,
		string	obf_name
	)

Obfuscate one symbol (name) with another (name).

Parameters

[in]	dll_name	The dll name.
[in]	sym_name	The symbol to unobfuscate (name).
[in]	obf_name	The new symbol to obfuscate with (name).

Returns

COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported.

Note

It's not thread-safe, be cautious.

Definition at line 32 of file obfuscate.cpp.

obf_sym() [2/4]

cobf_error cobf::obf_sym	(	string	dll_name,
		string	sym_name,
		WORD	obf_ord
	)

Obfuscate one symbol (name) with another (ordinal).

Parameters

[in]	dll_name	The dll name.
[in]	sym_name	The symbol to unobfuscate (name).
[in]	obf_ord	The new symbol to obfuscate with (ordinal).

Returns

COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported.

Note

It's not thread-safe, be cautious.

Definition at line 37 of file obfuscate.cpp.

obf_sym() [3/4]

cobf_error cobf::obf_sym	(	string	dll_name,
		WORD	sym_ord,
		string	obf_name
	)

Obfuscate one symbol (ordinal) with another (name).

Parameters

[in]	dll_name	The dll name.
[in]	sym_ord	The symbol to unobfuscate (ordinal).
[in]	obf_name	The new symbol to obfuscate with (name).

Returns

COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported.

Note

It's not thread-safe, be cautious.

Definition at line 47 of file obfuscate.cpp.

obf_sym() [4/4]

cobf_error cobf::obf_sym	(	string	dll_name,
		WORD	sym_ord,
		WORD	obf_ord
	)

Obfuscate one symbol (ordinal) with another (ordinal).

Parameters

[in]	dll_name	The dll name.
[in]	sym_ord	The symbol to unobfuscate (ordinal).
[in]	obf_ord	The new symbol to obfuscate with (ordinal).

Returns

COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported.

Note

It's not thread-safe, be cautious.

Definition at line 42 of file obfuscate.cpp.

unload_pe()

cobf_error cobf::unload_pe

(

)

Unload the specified PE from memory.

Returns

COBF_NO_ERROR if done successfully. COBF_PE_UNLOADED if the PE is already unloaded.

Note

It's not thread-safe, be cautious.

Definition at line 138 of file load.cpp.

unobf_sym() [1/2]

cobf_error cobf::unobf_sym	(	string	dll_name,
		string	sym_name
	)

Unobfuscate one symbol (name).

Parameters

[in]	dll_name	The dll name.
[in]	sym_name	The symbol to unobfuscate (name).

Returns

COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported.

Note

It's not thread-safe, be cautious.

Definition at line 68 of file obfuscate.cpp.

unobf_sym() [2/2]

cobf_error cobf::unobf_sym	(	string	dll_name,
		WORD	sym_ord
	)

Unobfuscate one symbol (ordinal).

Parameters

[in]	dll_name	The dll name.
[in]	sym_ord	The symbol to unobfuscate (ordinal).

Returns

COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported.

Note

It's not thread-safe, be cautious.

Definition at line 73 of file obfuscate.cpp.

---

The documentation for this class was generated from the following files:

• include/cobf.hpp
• src/load.cpp
• src/obfuscate.cpp