From 3377942e091d21d1fd52c3d8ae762c6cd63afab7 Mon Sep 17 00:00:00 2001 From: Winslow <33692631+senzee1984@users.noreply.github.com> Date: Thu, 11 Apr 2024 21:18:19 -0400 Subject: [PATCH] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a482227..7ef2ffc 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ In this section, major updates are provided. Major updates do include added supp ### 4/11/2024 Added PE Signature Obfuscation Only a few bytes in the PE header, such as `e_lfanew`, RVA of Import Directory, are essential to complete the loading process. Therefore, other bytes can be overwritten with random ones to hide PE header signatures. -After all the processes are completed, even these bytes will be overwritten for complete obfuscation. For instance, from the screenshot below, we can notice that the PE header is mostly obfuscated, but e_lfanew remains obfuscated for loading purposes. But after the loading process, `e_lfanew` is also obfuscated. +After all the processes are completed, even these bytes will be overwritten for complete obfuscation. For instance, from the screenshot below, we can notice that the PE header is mostly obfuscated, but `e_lfanew` remains obfuscated for loading purposes. But after the loading process, `e_lfanew` is also obfuscated. ![image](/screenshot/header_obfuscation.jpg)