From beb6d369cbe1d8fb21c36c0c6d8559f7be2fa147 Mon Sep 17 00:00:00 2001
From: Winslow <33692631+senzee1984@users.noreply.github.com>
Date: Thu, 11 Apr 2024 16:17:15 -0400
Subject: [PATCH] Update README.md

---
 README.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 12fcd04..3713860 100644
--- a/README.md
+++ b/README.md
@@ -5,9 +5,11 @@ Article: <https://winslow1984.com/books/malware/page/reflectiveloading-and-infla
 In this section, major updates are provided. Major updates do include added supports or features.
 
 ### 4/11/2024 Added PE Signature Obfuscation
-Only a few bytes in the PE header, such as e_lfanew, RVA of Import Directory, are essential for us to complete the loading process. Therefore, other bytes can be overwritten with random ones to hide PE header signatures.
+Only a few bytes in the PE header, such as e_lfanew, RVA of Import Directory, are essential to complete the loading process. Therefore, other bytes can be overwritten with random ones to hide PE header signatures.
+
+After all the processes are completed, even these bytes will be overwritten for complete obfuscation. For instance, from the screenshot below, we can notice that the PE header is mostly obfuscated, but e_lfanew remains obfuscated for loading purposes. But after the loading process, e_lfanew is also obfuscated. 
+![image](/screenshot/header_obfuscation.jpg)
 
-After all the processes are completed, even these bytes will be overwritten for complete obfuscation.
 
 ### 4/11/2024 Replace padded NOP with NOP-Like instruction sequences
 Before the update, 0x90/NOP instructions are padded after the actual shellcode stub to align a memory page. Many NOPs could be a detection, therefore, InflativeLoading script dynamically selects preset NOP-Like instruction sequences. User can also add new ones or replace existing ones to achieve better obfuscation.
@@ -35,6 +37,8 @@ The size of image is 0x58000.
 However, some RVA are larger than the number.
 ![image](/screenshot/improved-logic2.jpg)
 
+Besides, the shellcode gracefully exits the program after executing the converted shellcode.
+
 
 ### 4/11/2024 Improved PE Dumper
 Now the dumper can display more information and provide suggestions for memory allocation: