mirror of
https://github.com/d35ha/CallObfuscator
synced 2026-06-08 13:42:37 +00:00
d35ha
530 lines
28 KiB
HTML
530 lines
28 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=9"/>
|
|
<meta name="generator" content="Doxygen 1.8.20"/>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
|
<title>cobf: cobf Class Reference</title>
|
|
<link href="tabs.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="jquery.js"></script>
|
|
<script type="text/javascript" src="dynsections.js"></script>
|
|
<link href="navtree.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="resize.js"></script>
|
|
<script type="text/javascript" src="navtreedata.js"></script>
|
|
<script type="text/javascript" src="navtree.js"></script>
|
|
<link href="search/search.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="search/searchdata.js"></script>
|
|
<script type="text/javascript" src="search/search.js"></script>
|
|
<link href="doxygen.css" rel="stylesheet" type="text/css" />
|
|
</head>
|
|
<body>
|
|
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
|
|
<div id="titlearea">
|
|
<table cellspacing="0" cellpadding="0">
|
|
<tbody>
|
|
<tr style="height: 56px;">
|
|
<td id="projectalign" style="padding-left: 0.5em;">
|
|
<div id="projectname">cobf
|
|
</div>
|
|
<div id="projectbrief">PE imports obfuscator</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<!-- end header part -->
|
|
<!-- Generated by Doxygen 1.8.20 -->
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
|
var searchBox = new SearchBox("searchBox", "search",false,'Search');
|
|
/* @license-end */
|
|
</script>
|
|
<script type="text/javascript" src="menudata.js"></script>
|
|
<script type="text/javascript" src="menu.js"></script>
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
|
$(function() {
|
|
initMenu('',true,false,'search.php','Search');
|
|
$(document).ready(function() { init_search(); });
|
|
});
|
|
/* @license-end */</script>
|
|
<div id="main-nav"></div>
|
|
</div><!-- top -->
|
|
<div id="side-nav" class="ui-resizable side-nav-resizable">
|
|
<div id="nav-tree">
|
|
<div id="nav-tree-contents">
|
|
<div id="nav-sync" class="sync"></div>
|
|
</div>
|
|
</div>
|
|
<div id="splitbar" style="-moz-user-select:none;"
|
|
class="ui-resizable-handle">
|
|
</div>
|
|
</div>
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
|
$(document).ready(function(){initNavTree('classcobf.html',''); initResizable(); });
|
|
/* @license-end */
|
|
</script>
|
|
<div id="doc-content">
|
|
<!-- window showing the filter options -->
|
|
<div id="MSearchSelectWindow"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
onkeydown="return searchBox.OnSearchSelectKey(event)">
|
|
</div>
|
|
|
|
<!-- iframe showing the search results (closed by default) -->
|
|
<div id="MSearchResultsWindow">
|
|
<iframe src="javascript:void(0)" frameborder="0"
|
|
name="MSearchResults" id="MSearchResults">
|
|
</iframe>
|
|
</div>
|
|
|
|
<div class="header">
|
|
<div class="summary">
|
|
<a href="#nested-classes">Classes</a> |
|
|
<a href="#pub-methods">Public Member Functions</a> |
|
|
<a href="classcobf-members.html">List of all members</a> </div>
|
|
<div class="headertitle">
|
|
<div class="title">cobf Class Reference</div> </div>
|
|
</div><!--header-->
|
|
<div class="contents">
|
|
|
|
<p><code>#include <<a class="el" href="cobf_8hpp_source.html">cobf.hpp</a>></code></p>
|
|
<table class="memberdecls">
|
|
<tr class="heading"><td colspan="2"><h2 class="groupheader"><a name="pub-methods"></a>
|
|
Public Member Functions</h2></td></tr>
|
|
<tr class="memitem:a19a9c6f456b8f41baa20101d18b2b218"><td class="memItemLeft" align="right" valign="top"> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#a19a9c6f456b8f41baa20101d18b2b218">cobf</a> (string pe_path)</td></tr>
|
|
<tr class="memdesc:a19a9c6f456b8f41baa20101d18b2b218"><td class="mdescLeft"> </td><td class="mdescRight">Constructor for the obfuscation module. <a href="classcobf.html#a19a9c6f456b8f41baa20101d18b2b218">More...</a><br /></td></tr>
|
|
<tr class="separator:a19a9c6f456b8f41baa20101d18b2b218"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:adb7e7b50621d31d66fc5ba5bddd812d8"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#adb7e7b50621d31d66fc5ba5bddd812d8">load_pe</a> ()</td></tr>
|
|
<tr class="memdesc:adb7e7b50621d31d66fc5ba5bddd812d8"><td class="mdescLeft"> </td><td class="mdescRight">Load the specified PE from disk. <a href="classcobf.html#adb7e7b50621d31d66fc5ba5bddd812d8">More...</a><br /></td></tr>
|
|
<tr class="separator:adb7e7b50621d31d66fc5ba5bddd812d8"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:a8ce6ac5baae19382585fa804f4832a32"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#a8ce6ac5baae19382585fa804f4832a32">unload_pe</a> ()</td></tr>
|
|
<tr class="memdesc:a8ce6ac5baae19382585fa804f4832a32"><td class="mdescLeft"> </td><td class="mdescRight">Unload the specified PE from memory. <a href="classcobf.html#a8ce6ac5baae19382585fa804f4832a32">More...</a><br /></td></tr>
|
|
<tr class="separator:a8ce6ac5baae19382585fa804f4832a32"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:acb13b47887432073f83d0b73acc58bf1"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#acb13b47887432073f83d0b73acc58bf1">obf_sym</a> (string dll_name, string sym_name, string obf_name)</td></tr>
|
|
<tr class="memdesc:acb13b47887432073f83d0b73acc58bf1"><td class="mdescLeft"> </td><td class="mdescRight">Obfuscate one symbol (name) with another (name). <a href="classcobf.html#acb13b47887432073f83d0b73acc58bf1">More...</a><br /></td></tr>
|
|
<tr class="separator:acb13b47887432073f83d0b73acc58bf1"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:a84deecc507137eca446f8c8bd9b8951c"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#a84deecc507137eca446f8c8bd9b8951c">obf_sym</a> (string dll_name, string sym_name, WORD obf_ord)</td></tr>
|
|
<tr class="memdesc:a84deecc507137eca446f8c8bd9b8951c"><td class="mdescLeft"> </td><td class="mdescRight">Obfuscate one symbol (name) with another (ordinal). <a href="classcobf.html#a84deecc507137eca446f8c8bd9b8951c">More...</a><br /></td></tr>
|
|
<tr class="separator:a84deecc507137eca446f8c8bd9b8951c"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:ac549c84a0f762798a93f4cc8ff09094a"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#ac549c84a0f762798a93f4cc8ff09094a">obf_sym</a> (string dll_name, WORD sym_ord, WORD obf_ord)</td></tr>
|
|
<tr class="memdesc:ac549c84a0f762798a93f4cc8ff09094a"><td class="mdescLeft"> </td><td class="mdescRight">Obfuscate one symbol (ordinal) with another (ordinal). <a href="classcobf.html#ac549c84a0f762798a93f4cc8ff09094a">More...</a><br /></td></tr>
|
|
<tr class="separator:ac549c84a0f762798a93f4cc8ff09094a"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:ad2b65f3e1e50b340f90a7131b69fc0f4"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#ad2b65f3e1e50b340f90a7131b69fc0f4">obf_sym</a> (string dll_name, WORD sym_ord, string obf_name)</td></tr>
|
|
<tr class="memdesc:ad2b65f3e1e50b340f90a7131b69fc0f4"><td class="mdescLeft"> </td><td class="mdescRight">Obfuscate one symbol (ordinal) with another (name). <a href="classcobf.html#ad2b65f3e1e50b340f90a7131b69fc0f4">More...</a><br /></td></tr>
|
|
<tr class="separator:ad2b65f3e1e50b340f90a7131b69fc0f4"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:ade434a9ce1c13a11ebe3b3b62578ba98"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#ade434a9ce1c13a11ebe3b3b62578ba98">unobf_sym</a> (string dll_name, string sym_name)</td></tr>
|
|
<tr class="memdesc:ade434a9ce1c13a11ebe3b3b62578ba98"><td class="mdescLeft"> </td><td class="mdescRight">Unobfuscate one symbol (name). <a href="classcobf.html#ade434a9ce1c13a11ebe3b3b62578ba98">More...</a><br /></td></tr>
|
|
<tr class="separator:ade434a9ce1c13a11ebe3b3b62578ba98"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:ae6b259720c2892c3f0e04ee441ffdc34"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#ae6b259720c2892c3f0e04ee441ffdc34">unobf_sym</a> (string dll_name, WORD sym_ord)</td></tr>
|
|
<tr class="memdesc:ae6b259720c2892c3f0e04ee441ffdc34"><td class="mdescLeft"> </td><td class="mdescRight">Unobfuscate one symbol (ordinal). <a href="classcobf.html#ae6b259720c2892c3f0e04ee441ffdc34">More...</a><br /></td></tr>
|
|
<tr class="separator:ae6b259720c2892c3f0e04ee441ffdc34"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:a5c476b34e992454395e316ccd595ac64"><td class="memItemLeft" align="right" valign="top"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> </td><td class="memItemRight" valign="bottom"><a class="el" href="classcobf.html#a5c476b34e992454395e316ccd595ac64">generate</a> (string out_file)</td></tr>
|
|
<tr class="memdesc:a5c476b34e992454395e316ccd595ac64"><td class="mdescLeft"> </td><td class="mdescRight">Generate the obfuscated PE. <a href="classcobf.html#a5c476b34e992454395e316ccd595ac64">More...</a><br /></td></tr>
|
|
<tr class="separator:a5c476b34e992454395e316ccd595ac64"><td class="memSeparator" colspan="2"> </td></tr>
|
|
</table>
|
|
<a name="details" id="details"></a><h2 class="groupheader">Detailed Description</h2>
|
|
<div class="textblock"><p>The main obfuscator class, holds the needed load, configure and obfuscate the input PE. </p>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="cobf_8hpp_source.html#l00025">25</a> of file <a class="el" href="cobf_8hpp_source.html">cobf.hpp</a>.</p>
|
|
</div><h2 class="groupheader">Constructor & Destructor Documentation</h2>
|
|
<a id="a19a9c6f456b8f41baa20101d18b2b218"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#a19a9c6f456b8f41baa20101d18b2b218">◆ </a></span>cobf()</h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname">cobf::cobf </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>pe_path</em></td><td>)</td>
|
|
<td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Constructor for the obfuscation module. </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">pe_path</td><td>Path of the PE file to obfuscate. </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>The instance. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="load_8cpp_source.html#l00363">363</a> of file <a class="el" href="load_8cpp_source.html">load.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<h2 class="groupheader">Member Function Documentation</h2>
|
|
<a id="a5c476b34e992454395e316ccd595ac64"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#a5c476b34e992454395e316ccd595ac64">◆ </a></span>generate()</h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::generate </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>out_file</em></td><td>)</td>
|
|
<td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Generate the obfuscated PE. </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">out_file</td><td>The file to write to. </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_PE_UNLOADED if the PE is not loaded. COBF_CANNOT_CREATE_FILE if unable to create the file. COBF_CANNOT_ADD_ENTRY if cannot register the shellcode entry. COBF_CANNOT_DISABLE_RELOCS if cannot strip the relocations. COBF_INVALID_IAT_SECTION if the IAT table is invalid. COBF_CANNOT_REMOVE_DBG_SYMS if unable to strip the symbols. COBF_CANNOT_WRITE_FILE if cannot write to the file. COBF_CANNOT_CLEAR if cannot clear the resources. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="obfuscate_8cpp_source.html#l00078">78</a> of file <a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="adb7e7b50621d31d66fc5ba5bddd812d8"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#adb7e7b50621d31d66fc5ba5bddd812d8">◆ </a></span>load_pe()</h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::load_pe </td>
|
|
<td>(</td>
|
|
<td class="paramname"></td><td>)</td>
|
|
<td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Load the specified PE from disk. </p>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_PE_LOADED if the PE is already loaded. COBF_CANNOT_OPEN_FILE if the file cannot be opened. COBF_CANNOT_GET_SIZE if the loader cannot get the size. COBF_CANNOT_READ_FILE if the loaded cannot read the file. COBF_INVALID_DOS_HDR if the PE has invalid dos header. COBF_INVALID_NT_HDRS if the PE has invalid nt headers. COBF_UNSUPPORTED_PE if the PE type is unsupported. COBF_INVALID_SECTION_HDR if the PE has invalid section header. COBF_INVALID_IMPORTS_DIR if the PE has invalid imports directory. COBF_CANNOT_PARSE_IMPORTS if the parser cannot parse all of the symbols. COBF_CANNOT_CLEAR if cannot clear the resources. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="load_8cpp_source.html#l00017">17</a> of file <a class="el" href="load_8cpp_source.html">load.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="acb13b47887432073f83d0b73acc58bf1"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#acb13b47887432073f83d0b73acc58bf1">◆ </a></span>obf_sym() <span class="overload">[1/4]</span></h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::obf_sym </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>dll_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>sym_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>obf_name</em> </td>
|
|
</tr>
|
|
<tr>
|
|
<td></td>
|
|
<td>)</td>
|
|
<td></td><td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Obfuscate one symbol (name) with another (name). </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">dll_name</td><td>The dll name. </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">sym_name</td><td>The symbol to unobfuscate (name). </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">obf_name</td><td>The new symbol to obfuscate with (name). </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="obfuscate_8cpp_source.html#l00032">32</a> of file <a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="a84deecc507137eca446f8c8bd9b8951c"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#a84deecc507137eca446f8c8bd9b8951c">◆ </a></span>obf_sym() <span class="overload">[2/4]</span></h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::obf_sym </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>dll_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>sym_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">WORD </td>
|
|
<td class="paramname"><em>obf_ord</em> </td>
|
|
</tr>
|
|
<tr>
|
|
<td></td>
|
|
<td>)</td>
|
|
<td></td><td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Obfuscate one symbol (name) with another (ordinal). </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">dll_name</td><td>The dll name. </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">sym_name</td><td>The symbol to unobfuscate (name). </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">obf_ord</td><td>The new symbol to obfuscate with (ordinal). </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="obfuscate_8cpp_source.html#l00037">37</a> of file <a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="ad2b65f3e1e50b340f90a7131b69fc0f4"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#ad2b65f3e1e50b340f90a7131b69fc0f4">◆ </a></span>obf_sym() <span class="overload">[3/4]</span></h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::obf_sym </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>dll_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">WORD </td>
|
|
<td class="paramname"><em>sym_ord</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>obf_name</em> </td>
|
|
</tr>
|
|
<tr>
|
|
<td></td>
|
|
<td>)</td>
|
|
<td></td><td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Obfuscate one symbol (ordinal) with another (name). </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">dll_name</td><td>The dll name. </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">sym_ord</td><td>The symbol to unobfuscate (ordinal). </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">obf_name</td><td>The new symbol to obfuscate with (name). </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="obfuscate_8cpp_source.html#l00047">47</a> of file <a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="ac549c84a0f762798a93f4cc8ff09094a"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#ac549c84a0f762798a93f4cc8ff09094a">◆ </a></span>obf_sym() <span class="overload">[4/4]</span></h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::obf_sym </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>dll_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">WORD </td>
|
|
<td class="paramname"><em>sym_ord</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">WORD </td>
|
|
<td class="paramname"><em>obf_ord</em> </td>
|
|
</tr>
|
|
<tr>
|
|
<td></td>
|
|
<td>)</td>
|
|
<td></td><td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Obfuscate one symbol (ordinal) with another (ordinal). </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">dll_name</td><td>The dll name. </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">sym_ord</td><td>The symbol to unobfuscate (ordinal). </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">obf_ord</td><td>The new symbol to obfuscate with (ordinal). </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="obfuscate_8cpp_source.html#l00042">42</a> of file <a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="a8ce6ac5baae19382585fa804f4832a32"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#a8ce6ac5baae19382585fa804f4832a32">◆ </a></span>unload_pe()</h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::unload_pe </td>
|
|
<td>(</td>
|
|
<td class="paramname"></td><td>)</td>
|
|
<td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Unload the specified PE from memory. </p>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_PE_UNLOADED if the PE is already unloaded. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="load_8cpp_source.html#l00138">138</a> of file <a class="el" href="load_8cpp_source.html">load.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="ade434a9ce1c13a11ebe3b3b62578ba98"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#ade434a9ce1c13a11ebe3b3b62578ba98">◆ </a></span>unobf_sym() <span class="overload">[1/2]</span></h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::unobf_sym </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>dll_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>sym_name</em> </td>
|
|
</tr>
|
|
<tr>
|
|
<td></td>
|
|
<td>)</td>
|
|
<td></td><td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Unobfuscate one symbol (name). </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">dll_name</td><td>The dll name. </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">sym_name</td><td>The symbol to unobfuscate (name). </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="obfuscate_8cpp_source.html#l00068">68</a> of file <a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<a id="ae6b259720c2892c3f0e04ee441ffdc34"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#ae6b259720c2892c3f0e04ee441ffdc34">◆ </a></span>unobf_sym() <span class="overload">[2/2]</span></h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname"><a class="el" href="utils_8hpp.html#a420d571bdf7fb85bb7d45320e10f3522">cobf_error</a> cobf::unobf_sym </td>
|
|
<td>(</td>
|
|
<td class="paramtype">string </td>
|
|
<td class="paramname"><em>dll_name</em>, </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="paramkey"></td>
|
|
<td></td>
|
|
<td class="paramtype">WORD </td>
|
|
<td class="paramname"><em>sym_ord</em> </td>
|
|
</tr>
|
|
<tr>
|
|
<td></td>
|
|
<td>)</td>
|
|
<td></td><td></td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p>Unobfuscate one symbol (ordinal). </p>
|
|
<dl class="params"><dt>Parameters</dt><dd>
|
|
<table class="params">
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">dll_name</td><td>The dll name. </td></tr>
|
|
<tr><td class="paramdir">[in]</td><td class="paramname">sym_ord</td><td>The symbol to unobfuscate (ordinal). </td></tr>
|
|
</table>
|
|
</dd>
|
|
</dl>
|
|
<dl class="section return"><dt>Returns</dt><dd>COBF_NO_ERROR if done successfully. COBF_SYMS_NOT_FOUND if the symbol is not imported. </dd></dl>
|
|
<dl class="section note"><dt>Note</dt><dd>It's not thread-safe, be cautious. </dd></dl>
|
|
|
|
<p class="definition">Definition at line <a class="el" href="obfuscate_8cpp_source.html#l00073">73</a> of file <a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
<hr/>The documentation for this class was generated from the following files:<ul>
|
|
<li>include/<a class="el" href="cobf_8hpp_source.html">cobf.hpp</a></li>
|
|
<li>src/<a class="el" href="load_8cpp_source.html">load.cpp</a></li>
|
|
<li>src/<a class="el" href="obfuscate_8cpp_source.html">obfuscate.cpp</a></li>
|
|
</ul>
|
|
</div><!-- contents -->
|
|
</div><!-- doc-content -->
|
|
<!-- start footer part -->
|
|
<div id="nav-path" class="navpath"><!-- id is needed for treeview function! -->
|
|
<ul>
|
|
<li class="navelem"><a class="el" href="classcobf.html">cobf</a></li>
|
|
<li class="footer">Generated by <a href="http://www.doxygen.org/index.html"><img class="footer" src="doxygen.svg" width="104" height="31" alt="doxygen"/></a> 1.8.20 </li>
|
|
</ul>
|
|
</div>
|
|
</body>
|
|
</html>
|