v-p-b / pecloakcapstone

Platform independent peCloak fork based on Capstone

peCloak - Capstone

This is a simple fork of SecuritySift's peCloak that uses Capstone. The intention is to provide a fork based on a well-maintained, up-to-date disassembly library and to make the script multi-platform.

Here's what I did so far:

• Replaced pydasm with Capstone
  • Included a patched version of SectionDoubleP as it also relied on pydasm
• Made data (un)packing platform independent by always using standard sizes

This way I managed to create obfuscated 32-bit Windows executables on 64-bit Linux which is nice :)

Still, this is just a quick hack, bugs most probably hide here and there and I probably left some dead code too.

pecloakcapstone's Issues

quick question

Can this be used on 64bit exe's?

Struct Error

Not sure if I am doing this right, but upon installing all the dependencies, I ran into a problem:
Traceback (most recent call last): File "peCloak.py", line 1189, in <module> main(sys.argv[1:]) File "peCloak.py", line 1166, in main decoder = encode_data(pe, section_to_encode, encoder) File "peCloak.py", line 678, in encode_data decode_start = struct.pack("<L", section_start + encode_offset) struct.error: 'L' format requires 0 <= number <= 4294967295
Perhaps something wrong with the file read?

[!] ERROR: Could not save modified PE file. Check write permissions and ensure the file is not in use

Hi,

I got this error message when I run this version of peCloak, can you give me a help on this? thank you.

/Ray