From 76b3d92f0b54502f757dd3d6cd9b53eabd7d1f3f Mon Sep 17 00:00:00 2001 From: Winslow <33692631+senzee1984@users.noreply.github.com> Date: Fri, 12 Apr 2024 13:14:07 -0400 Subject: [PATCH] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index aff26db..64ecc0b 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ In this section, major updates are provided. Major updates do include added supp ### 4/11/2024 Added PE Signature Obfuscation Only a few bytes in the PE header, such as `e_lfanew`, RVA of Import Directory, are essential to complete the loading process. Therefore, other bytes can be overwritten with random ones to hide PE header signatures. -After all the processes are completed, even these bytes will be overwritten for complete obfuscation. For instance, from the screenshot below, we can notice that the PE header is mostly obfuscated, but `e_lfanew` remains obfuscated for loading purposes. But after the loading process, `e_lfanew` is also obfuscated. +After all the processes are completed, even these bytes will be overwritten for complete obfuscation. For instance, from the screenshot below, we can notice that the PE header is mostly obfuscated, but `e_lfanew` remains unobfuscated for loading purposes. But after the loading process, `e_lfanew` is also obfuscated. ![image](/screenshot/header_obfuscation.jpg)