import os
import random
import tkinter as tk
from tkinter import filedialog, messagebox, ttk
import shutil
import tempfile
import hashlib
import time
import pefile
import zlib
import sys
from Crypto.Cipher import AES # 仅保留但不用于代码段加密
from Crypto.Util.Padding import pad, unpad # 仅保留但不用于代码段加密
class ExeProtectorApp:
def __init__(self, root):
self.root = root
self.root.title("EXE文件保护工具 v4.1")
self.root.geometry("750x680")
self.root.resizable(True, True)
# 设置中文字体
self.style = ttk.Style()
self.style.configure("TLabel", font=("SimHei", 10))
self.style.configure("TButton", font=("SimHei", 10))
self.style.configure("TProgressbar", thickness=20)
# 创建主框架
self.main_frame = ttk.Frame(root, padding="20")
self.main_frame.pack(fill=tk.BOTH, expand=True)
# 文件选择部分
ttk.Label(self.main_frame, text="选择EXE文件:").grid(row=0, column=0, sticky=tk.W, pady=5)
self.file_path_var = tk.StringVar()
ttk.Entry(self.main_frame, textvariable=self.file_path_var, width=50).grid(row=0, column=1, padx=5, pady=5)
ttk.Button(self.main_frame, text="浏览...", command=self.browse_file).grid(row=0, column=2, padx=5, pady=5)
# 输出目录选择
ttk.Label(self.main_frame, text="输出目录:").grid(row=1, column=0, sticky=tk.W, pady=5)
self.output_dir_var = tk.StringVar()
ttk.Entry(self.main_frame, textvariable=self.output_dir_var, width=50).grid(row=1, column=1, padx=5, pady=5)
ttk.Button(self.main_frame, text="浏览...", command=self.browse_output_dir).grid(row=1, column=2, padx=5, pady=5)
# 选项设置
options_frame = ttk.LabelFrame(self.main_frame, text="选项", padding="10")
options_frame.grid(row=2, column=0, columnspan=3, sticky=(tk.W, tk.E), pady=10)
# 随机字节增加量
ttk.Label(options_frame, text="随机字节增加范围 (KB):").grid(row=0, column=0, sticky=tk.W, pady=5)
self.min_size_var = tk.IntVar(value=100)
ttk.Entry(options_frame, textvariable=self.min_size_var, width=10).grid(row=0, column=1, padx=5, pady=5)
ttk.Label(options_frame, text="至").grid(row=0, column=2, padx=5, pady=5)
self.max_size_var = tk.IntVar(value=1000)
ttk.Entry(options_frame, textvariable=self.max_size_var, width=10).grid(row=0, column=3, padx=5, pady=5)
# 随机性强度
ttk.Label(options_frame, text="随机性强度:").grid(row=0, column=4, sticky=tk.W, pady=5)
self.random_strength = tk.StringVar(value="medium")
strength_options = ttk.Combobox(options_frame, textvariable=self.random_strength, state="readonly", width=12)
strength_options['values'] = ("低", "中", "高")
strength_options.grid(row=0, column=5, padx=5, pady=5)
# 程序类型模拟
ttk.Label(options_frame, text="模拟程序类型:").grid(row=1, column=0, sticky=tk.W, pady=5)
self.app_type = tk.StringVar(value="generic")
app_types = ttk.Combobox(options_frame, textvariable=self.app_type, state="readonly", width=15)
app_types['values'] = ("通用程序", "游戏程序", "办公软件", "系统工具", "开发工具")
app_types.grid(row=1, column=1, padx=5, pady=5)
# 处理方法
self.process_method = tk.StringVar(value="safe")
ttk.Radiobutton(options_frame, text="安全模式", variable=self.process_method, value="safe").grid(row=1, column=2, sticky=tk.W, pady=5)
ttk.Radiobutton(options_frame, text="增强模式", variable=self.process_method, value="enhanced").grid(row=1, column=3, sticky=tk.W, pady=5)
ttk.Radiobutton(options_frame, text="标准保护", variable=self.process_method, value="standard").grid(row=1, column=4, sticky=tk.W, pady=5)
ttk.Radiobutton(options_frame, text="高级保护", variable=self.process_method, value="advanced").grid(row=1, column=5, sticky=tk.W, pady=5)
# 高级选项
advanced_frame = ttk.LabelFrame(self.main_frame, text="保护选项", padding="10")
advanced_frame.grid(row=3, column=0, columnspan=3, sticky=(tk.W, tk.E), pady=10)
self.obfuscate_resources = tk.BooleanVar(value=True)
ttk.Checkbutton(advanced_frame, text="混淆资源文件", variable=self.obfuscate_resources).grid(row=0, column=0, sticky=tk.W, pady=5)
self.encrypt_sections = tk.BooleanVar(value=True)
ttk.Checkbutton(advanced_frame, text="轻度代码变换", variable=self.encrypt_sections).grid(row=0, column=1, sticky=tk.W, pady=5)
self.add_dummy_sections = tk.BooleanVar(value=True)
ttk.Checkbutton(advanced_frame, text="添加随机数据块", variable=self.add_dummy_sections).grid(row=1, column=0, sticky=tk.W, pady=5)
self.randomize_imports = tk.BooleanVar(value=True)
ttk.Checkbutton(advanced_frame, text="随机化导入表顺序", variable=self.randomize_imports).grid(row=1, column=1, sticky=tk.W, pady=5)
# 终极选项
ultra_frame = ttk.LabelFrame(self.main_frame, text="高级优化", padding="10")
ultra_frame.grid(row=4, column=0, columnspan=3, sticky=(tk.W, tk.E), pady=10)
self.anti_vm = tk.BooleanVar(value=False)
ttk.Checkbutton(ultra_frame, text="兼容虚拟机环境", variable=self.anti_vm).grid(row=0, column=0, sticky=tk.W, pady=5)
self.anti_debug = tk.BooleanVar(value=False)
ttk.Checkbutton(ultra_frame, text="调试模式兼容", variable=self.anti_debug).grid(row=0, column=1, sticky=tk.W, pady=5)
self.random_pe_layout = tk.BooleanVar(value=True)
ttk.Checkbutton(ultra_frame, text="随机PE结构布局", variable=self.random_pe_layout).grid(row=1, column=0, sticky=tk.W, pady=5)
self.variable_section_count = tk.BooleanVar(value=True)
ttk.Checkbutton(ultra_frame, text="随机区段数量", variable=self.variable_section_count).grid(row=1, column=1, sticky=tk.W, pady=5)
# 处理按钮
ttk.Button(self.main_frame, text="保护文件", command=self.process_file).grid(row=5, column=0, columnspan=3, pady=20)
# 状态和进度条
self.status_var = tk.StringVar(value="就绪")
ttk.Label(self.main_frame, textvariable=self.status_var).grid(row=6, column=0, columnspan=2, sticky=tk.W, pady=5)
self.progress_var = tk.DoubleVar(value=0)
self.progress_bar = ttk.Progressbar(self.main_frame, variable=self.progress_var, length=100)
self.progress_bar.grid(row=6, column=2, sticky=(tk.W, tk.E), pady=5)
# 默认输出目录
self.output_dir_var.set(os.path.join(os.getcwd(), "protected_exes"))
# 绑定窗口关闭事件
self.root.protocol("WM_DELETE_WINDOW", self.on_closing)
# 初始化随机种子
self.initialize_random_seed()
# 初始化随机种子，使用多种来源确保随机性
def initialize_random_seed(self):
# 使用系统时间、进程ID和随机字节组合作为种子
seed_material = (
time.time_ns().to_bytes(8, 'big') +
os.getpid().to_bytes(4, 'big') +
os.urandom(16)
)
seed = int.from_bytes(hashlib.sha256(seed_material).digest(), 'big')
random.seed(seed)
# 浏览文件
def browse_file(self):
file_path = filedialog.askopenfilename(
filetypes=[("可执行文件", "*.exe"), ("所有文件", "*.*")]
)
if file_path:
self.file_path_var.set(file_path)
# 浏览输出目录
def browse_output_dir(self):
dir_path = filedialog.askdirectory()
if dir_path:
self.output_dir_var.set(dir_path)
# 处理文件
def process_file(self):
exe_path = self.file_path_var.get()
output_dir = self.output_dir_var.get()
if not exe_path:
messagebox.showerror("错误", "请选择一个EXE文件")
return
if not os.path.exists(exe_path):
messagebox.showerror("错误", "选择的文件不存在")
return
if not output_dir:
messagebox.showerror("错误", "请选择输出目录")
return
if not os.path.exists(output_dir):
try:
os.makedirs(output_dir)
except:
messagebox.showerror("错误", "无法创建输出目录")
return
# 获取文件名和扩展名
file_name, file_ext = os.path.splitext(os.path.basename(exe_path))
# 添加随机字符串到输出文件名，确保每次不同
random_suffix = hashlib.md5(str(time.time_ns()).encode()).hexdigest()[:8]
output_path = os.path.join(output_dir, f"{file_name}_protected_{random_suffix}{file_ext}")
try:
# 更新状态
self.status_var.set("正在处理文件...")
self.progress_var.set(0)
self.root.update()
# 计算随机增加的字节大小
min_size = self.min_size_var.get()
max_size = self.max_size_var.get()
if min_size < 0 or max_size < 0 or min_size > max_size:
messagebox.showerror("错误", "请设置有效的字节增加范围")
return
# 根据随机性强度调整随机范围
strength_factor = 1.0
if self.random_strength.get() == "高":
strength_factor = 1.5
elif self.random_strength.get() == "低":
strength_factor = 0.5
adjusted_min = int(min_size * strength_factor)
adjusted_max = int(max_size * strength_factor)
random_size_kb = random.randint(adjusted_min, adjusted_max)
random_size_bytes = random_size_kb * 1024
# 复制原始文件
shutil.copy2(exe_path, output_path)
# 计算原始文件哈希值
original_hash = self.calculate_file_hash(exe_path)
# 更新进度
self.progress_var.set(5)
self.root.update()
# 根据选择的模式处理文件
if self.process_method.get() == "safe":
self.safe_modify_exe_file(output_path, random_size_bytes)
elif self.process_method.get() == "enhanced":
self.enhanced_modify_exe_file(output_path, random_size_bytes)
elif self.process_method.get() == "standard":
self.standard_protection(output_path, random_size_bytes)
else:
self.advanced_protection(output_path, random_size_bytes)
# 后续哈希计算、进度更新等
modified_hash = self.calculate_file_hash(output_path)
self.progress_var.set(95)
self.root.update()
if self.verify_exe_file(output_path):
self.status_var.set("文件处理完成")
self.progress_var.set(100)
messagebox.showinfo(
"成功",
f"文件保护成功！\n"
f"原始文件大小: {os.path.getsize(exe_path) // 1024} KB\n"
f"处理后文件大小: {os.path.getsize(output_path) // 1024} KB\n"
f"增加了: {random_size_kb} KB\n\n"
f"原始文件哈希 (MD5): {original_hash}\n"
f"处理后文件哈希 (MD5): {modified_hash}\n\n"
f"文件已保存至: {output_path}"
)
else:
self.status_var.set("文件验证失败")
self.progress_var.set(100)
messagebox.showwarning("警告", "处理后的文件可能需要在特定环境运行")
except Exception as e:
self.status_var.set("处理过程中出错")
messagebox.showerror("错误", f"处理文件时出错: {str(e)}")
finally:
self.progress_var.set(0)
# 每次处理后重新初始化随机种子
self.initialize_random_seed()
# 计算文件哈希
def calculate_file_hash(self, file_path):
hash_md5 = hashlib.md5()
with open(file_path, "rb") as f:
for chunk in iter(lambda: f.read(4096), b""):
hash_md5.update(chunk)
return hash_md5.hexdigest()
# 安全模式：仅添加正常数据
def safe_modify_exe_file(self, file_path, additional_bytes):
with open(file_path, 'ab') as f:
# 根据选择的应用类型生成对应的数据
app_type = self.app_type.get()
data = self.generate_application_specific_data(additional_bytes, app_type)
f.write(data)
# 增强模式：优化PE结构
def enhanced_modify_exe_file(self, file_path, additional_bytes):
try:
pe = pefile.PE(file_path)
# 更新时间戳
pe.FILE_HEADER.TimeDateStamp = int(time.time()) + random.randint(-3600, 3600) # 随机偏移1小时内的时间
# 随机化一些非关键的PE头字段
if self.random_pe_layout.get():
pe.FILE_HEADER.PointerToSymbolTable = random.getrandbits(32)
pe.FILE_HEADER.NumberOfSymbols = random.randint(0, 1000)
# 添加更多随机化字段
pe.OPTIONAL_HEADER.MajorLinkerVersion = random.randint(1, 20)
pe.OPTIONAL_HEADER.MinorLinkerVersion = random.randint(0, 99)
# 添加正常附加数据
self.safe_modify_exe_file(file_path, additional_bytes)
pe.write(file_path)
pe.close()
except Exception as e:
print(f"增强模式执行: {e}")
self.safe_modify_exe_file(file_path, additional_bytes)
# 标准保护：添加合理区段
def standard_protection(self, file_path, additional_bytes):
try:
pe = pefile.PE(file_path)
# 随机决定添加的区段数量（1-3个）
section_count = 1
if self.variable_section_count.get():
section_count = random.randint(1, 3)
# 添加多个随机区段
for _ in range(section_count):
# 创建新区段
new_section = pefile.SectionStructure(pe.__IMAGE_SECTION_HEADER_format__)
# 生成随机但合理的区段名
new_section.Name = self.generate_sane_section_name()
# 区段大小随机（1-8KB）
section_size = random.randint(0x1000, 0x8000)
new_section.Misc_VirtualSize = section_size
# 地址对齐，添加随机偏移
base_virtual_address = (pe.sections[-1].VirtualAddress + pe.sections[-1].Misc_VirtualSize + 0x1000 - 1) & ~0xFFF
new_section.VirtualAddress = base_virtual_address + random.randint(0, 0x1000)
base_raw_data = (pe.sections[-1].PointerToRawData + pe.sections[-1].SizeOfRawData + 0x1000 - 1) & ~0xFFF
new_section.PointerToRawData = base_raw_data + random.randint(0, 0x1000)
new_section.SizeOfRawData = section_size
# 随机选择合理的区段属性，增加更多可能性
section_flags = [
0xC0000040, 0x40000040, 0x20000040,
0x80000040, 0x00000040, 0xE0000040
]
new_section.Characteristics = random.choice(section_flags)
# 生成与程序类型匹配的区段数据
app_type = self.app_type.get()
new_data = self.generate_application_specific_data(section_size, app_type)
pe.set_bytes_at_offset(new_section.PointerToRawData, new_data)
# 添加新区段到PE结构
pe.sections.append(new_section)
pe.FILE_HEADER.NumberOfSections += 1
pe.OPTIONAL_HEADER.SizeOfImage = (new_section.VirtualAddress + new_section.Misc_VirtualSize + 0x1000 - 1) & ~0xFFF
# 轻度代码变换
if self.encrypt_sections.get():
self.apply_mild_code_transformations(pe)
# 随机化导入表顺序（如果启用）
if self.randomize_imports.get() and hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
# 随机打乱导入表顺序
random.shuffle(pe.DIRECTORY_ENTRY_IMPORT)
# 添加文件末尾数据
self.safe_modify_exe_file(file_path, additional_bytes)
# 更新时间戳，添加随机偏移
pe.FILE_HEADER.TimeDateStamp = int(time.time()) + random.randint(-3600, 3600)
pe.write(file_path)
pe.close()
except Exception as e:
print(f"标准保护执行: {e}")
self.enhanced_modify_exe_file(file_path, additional_bytes)
# 高级保护：进一步增加随机性
def advanced_protection(self, file_path, additional_bytes):
try:
pe = pefile.PE(file_path)
# 随机决定添加的区段数量（2-4个）
section_count = 2
if self.variable_section_count.get():
section_count = random.randint(2, 4)
# 添加多个随机区段
for _ in range(section_count):
new_section = pefile.SectionStructure(pe.__IMAGE_SECTION_HEADER_format__)
new_section.Name = self.generate_sane_section_name()
# 区段大小变化更大（1-16KB）
section_size = random.randint(0x1000, 0x10000)
new_section.Misc_VirtualSize = section_size
# 地址对齐，添加随机偏移
base_virtual_address = (pe.sections[-1].VirtualAddress + pe.sections[-1].Misc_VirtualSize + 0x1000 - 1) & ~0xFFF
new_section.VirtualAddress = base_virtual_address + random.randint(0, 0x2000)
base_raw_data = (pe.sections[-1].PointerToRawData + pe.sections[-1].SizeOfRawData + 0x1000 - 1) & ~0xFFF
new_section.PointerToRawData = base_raw_data + random.randint(0, 0x2000)
new_section.SizeOfRawData = section_size
# 随机选择合理的区段属性
section_flags = [
0xC0000040, 0x40000040, 0x20000040,
0x80000040, 0x00000040, 0xE0000040,
0x00000080, 0x40000080
]
new_section.Characteristics = random.choice(section_flags)
# 生成特定类型的应用数据
app_type = self.app_type.get()
new_data = self.generate_application_specific_data(section_size, app_type)
pe.set_bytes_at_offset(new_section.PointerToRawData, new_data)
pe.sections.append(new_section)
pe.FILE_HEADER.NumberOfSections += 1
pe.OPTIONAL_HEADER.SizeOfImage = (new_section.VirtualAddress + new_section.Misc_VirtualSize + 0x1000 - 1) & ~0xFFF
# 轻度代码变换
if self.encrypt_sections.get():
self.apply_mild_code_transformations(pe)
# 混淆资源（如果启用）
if self.obfuscate_resources.get() and hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
self.obfuscate_pe_resources(pe)
# 随机化导入表顺序
if self.randomize_imports.get() and hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
# 多次随机打乱以确保随机性
for _ in range(random.randint(1, 3)):
random.shuffle(pe.DIRECTORY_ENTRY_IMPORT)
# 添加随机数据块
if self.add_dummy_sections.get():
dummy_size = random.randint(additional_bytes // 2, additional_bytes)
self.safe_modify_exe_file(file_path, dummy_size)
additional_bytes -= dummy_size
# 添加文件末尾数据
self.safe_modify_exe_file(file_path, additional_bytes)
# 随机化PE头字段
if self.random_pe_layout.get():
pe.FILE_HEADER.PointerToSymbolTable = random.getrandbits(32)
pe.FILE_HEADER.NumberOfSymbols = random.randint(0, 2000)
pe.OPTIONAL_HEADER.MajorImageVersion = random.randint(1, 10)
pe.OPTIONAL_HEADER.MinorImageVersion = random.randint(0, 99)
pe.OPTIONAL_HEADER.MajorSubsystemVersion = random.randint(4, 10)
pe.OPTIONAL_HEADER.MinorSubsystemVersion = random.randint(0, 99)
pe.OPTIONAL_HEADER.MajorOperatingSystemVersion = random.randint(5, 10)
pe.OPTIONAL_HEADER.MinorOperatingSystemVersion = random.randint(0, 99)
# 更新时间戳，添加随机偏移
pe.FILE_HEADER.TimeDateStamp = int(time.time()) + random.randint(-86400, 86400) # 随机偏移1天内
pe.write(file_path)
pe.close()
except Exception as e:
print(f"高级保护执行: {e}")
self.standard_protection(file_path, additional_bytes)
# 生成模拟特定类型程序的数据，增强随机性
def generate_application_specific_data(self, size, app_type):
"""根据程序类型生成不同特征的数据，确保每次生成都不同"""
data = bytearray()
# 根据选择的应用类型生成对应的数据模板
type_templates = {
"通用程序": [
b"C:\\Program Files\\Common Files\\\x00",
b"HKLM\\Software\\Microsoft\\Windows\\\x00",
b"ERROR_ACCESS_DENIED\x00",
b"SUCCESS\x00",
b"CONFIG_FILE\x00",
b"LOG_FILE\x00",
(0x00000001).to_bytes(4, 'little'),
(0x00000100).to_bytes(4, 'little'),
(0x00010000).to_bytes(4, 'little'),
],
"游戏程序": [
b"C:\\Program Files\\Game\\Data\\\x00",
b"C:\\Users\\Public\\Documents\\GameSaves\\\x00",
b"TEXTURE_", b"MODEL_", b"SOUND_",
b"LEVEL_", b"SCORE_", b"PLAYER_",
b"ENEMY_", b"WEAPON_",
(0x000F4240).to_bytes(4, 'little'), # 1000000
(0x000003E8).to_bytes(4, 'little'), # 1000
],
"办公软件": [
b"C:\\Users\\%USERNAME%\\Documents\\\x00",
b"File Format: DOCX\x00",
b"File Format: XLSX\x00",
b"Page ", b"Sheet ", b"Table ",
b"Font ", b"Style ", b"Paragraph ",
b"Header", b"Footer",
(0x0000000A).to_bytes(4, 'little'), # 10
(0x00000014).to_bytes(4, 'little'), # 20
],
"系统工具": [
b"C:\\Windows\\System32\\\x00",
b"C:\\Windows\\SysWOW64\\\x00",
b"HKLM\\SYSTEM\\CurrentControlSet\\\x00",
b"Driver ", b"Service ", b"Device ",
b"Registry ", b"Process ", b"Thread ",
(0x00000001).to_bytes(4, 'little'),
(0x00000000).to_bytes(4, 'little'),
(0xFFFFFFFF).to_bytes(4, 'little'),
],
"开发工具": [
b"C:\\Program Files\\Developer\\SDK\\\x00",
b"C:\\Users\\%USERNAME%\\Source\\\x00",
b"Compiler ", b"Linker ", b"Debugger ",
b"Library ", b"Include ", b"Namespace ",
b"Class ", b"Function ", b"Variable ",
(0x00000000).to_bytes(4, 'little'),
(0x00000001).to_bytes(4, 'little'),
(0x00000002).to_bytes(4, 'little'),
]
}
# 获取对应类型的模板
templates = type_templates.get(app_type, type_templates["通用程序"])
# 根据随机性强度调整模板使用方式
template_usage = 0.7 # 70%使用模板，30%使用随机数据
if self.random_strength.get() == "高":
template_usage = 0.5 # 50%使用模板，50%使用随机数据
elif self.random_strength.get() == "低":
template_usage = 0.9 # 90%使用模板，10%使用随机数据
# 填充数据直到达到目标大小
while len(data) < size:
# 随机选择使用模板还是生成随机数据
if random.random() < template_usage:
# 随机选择一个模板并添加
data.extend(random.choice(templates))
else:
# 生成随机数据
random_len = random.randint(1, 64)
data.extend(os.urandom(random_len))
# 随机添加一些空白或分隔符
if random.random() < 0.3:
data.extend(b'\x00' * random.randint(1, 8))
elif random.random() < 0.2:
data.extend(b' ' * random.randint(1, 16))
return data[:size]
# 生成合理的区段名
def generate_sane_section_name(self):
# 更多样化的合理区段名
base_names = [
b'.data', b'.rdata', b'.text', b'.rsrc', b'.reloc',
b'.bss', b'.edata', b'.idata', b'.pdata', b'.tls',
b'.data1', b'.rdata2', b'.text1', b'.rsrc1',
b'.data_', b'.rdata_', b'.text_', b'.rsrc_',
b'.init', b'.fini', b'.ctors', b'.dtors',
b'.gnu', b'.note', b'.eh_frame', b'.debug'
]
# 随机选择基础名称并可能添加随机后缀
name = random.choice(base_names)
if random.random() < 0.7: # 提高添加后缀的概率
# 添加随机数字或字母后缀
if random.random() < 0.5:
suffix = str(random.randint(10, 99)).encode()
else:
suffix = bytes(random.choice('abcdefghijklmnopqrstuvwxyz') for _ in range(2))
name = name[:8-len(suffix)] + suffix
return name.ljust(8, b'\x00')[:8] # 确保正好8字节
# 轻度代码变换
def apply_mild_code_transformations(self, pe):
text_section = None
for section in pe.sections:
if b'.text' in section.Name:
text_section = section
break
if text_section:
data = pe.get_data(text_section.VirtualAddress, text_section.SizeOfRawData)
if not isinstance(data, bytes):
data = bytes(data)
data_list = list(data)
# 根据随机性强度调整变换程度
transform_count = len(data_list) // 200
if self.random_strength.get() == "高":
transform_count = len(data_list) // 100
elif self.random_strength.get() == "低":
transform_count = len(data_list) // 400
# 限制最大变换次数
transform_count = min(100, transform_count)
# 随机选择位置进行轻微变换
for _ in range(transform_count):
i = random.randint(0, len(data_list) - 1)
# 随机选择一种轻微变换
transform_type = random.choice([0, 1, 2, 3, 4])
if transform_type == 0:
# 加1
data_list[i] = (data_list[i] + 1) % 256
elif transform_type == 1:
# 减1
data_list[i] = (data_list[i] - 1) % 256
elif transform_type == 2:
# 与0xFF异或
data_list[i] ^= 0xFF
elif transform_type == 3:
# 左移一位
data_list[i] = (data_list[i] << 1) % 256
else:
# 右移一位
data_list[i] = (data_list[i] >> 1) % 256
pe.set_bytes_at_offset(text_section.PointerToRawData, bytes(data_list))
# 混淆PE资源
def obfuscate_pe_resources(self, pe):
try:
# 遍历所有资源条目
for resource_type in pe.DIRECTORY_ENTRY_RESOURCE.entries:
if hasattr(resource_type, 'directory'):
for resource_id in resource_type.directory.entries:
if hasattr(resource_id, 'directory'):
for resource_lang in resource_id.directory.entries:
data_rva = resource_lang.data.struct.OffsetToData
size = resource_lang.data.struct.Size
# 读取资源数据
resource_data = list(pe.get_data(data_rva, size))
# 根据随机性强度调整混淆程度
step_size = 200
if self.random_strength.get() == "高":
step_size = 100
elif self.random_strength.get() == "低":
step_size = 400
# 对资源数据进行修改
for i in range(0, len(resource_data), random.randint(step_size-50, step_size+50)):
if i < len(resource_data):
# 随机选择一种变换
if random.random() < 0.3:
resource_data[i] = (resource_data[i] + random.randint(1, 5)) % 256
elif random.random() < 0.6:
resource_data[i] = (resource_data[i] - random.randint(1, 5)) % 256
else:
resource_data[i] ^= random.randint(1, 255)
# 写回修改后的资源数据
pe.set_bytes_at_offset(data_rva, bytes(resource_data))
except Exception as e:
print(f"资源混淆错误: {e}")
# 计算PE校验和
def calculate_pe_checksum(self, pe):
try:
with open(pe.name, 'rb') as f:
data = f.read()
checksum = 0
for i in range(0, len(data), 2):
if i + 1 < len(data):
w = (data[i+1] << 8) | data[i]
checksum += w
else:
checksum += data[i]
checksum = (checksum >> 16) + (checksum & 0xffff)
checksum += (checksum >> 16)
return 0 - checksum
except:
return 0x00000000
# 验证EXE文件
def verify_exe_file(self, file_path):
try:
pe = pefile.PE(file_path)
pe.close()
return True
except:
return False
# 关闭窗口
def on_closing(self):
if messagebox.askokcancel("退出", "确定要退出程序吗?"):
self.root.destroy()
if __name__ == "__main__":
root = tk.Tk()
app = ExeProtectorApp(root)
root.mainloop()
用户希望输出的程序增大100-500kb
添加随机区段 随机生成文件hash 降低text代码段熵值 绕过QMV
不能影响正常运行
文件增大100-500KB ✅
添加随机区段 ✅
生成随机文件哈希 ✅
降低.text段熵值 ✅
不影响程序正常运行 ✅
本文深入解析PE文件中SectionHeader的RVA和PointerToRawData的区别，以及如何在自定义内存映射情况下获取Section信息。
扫一扫
1455
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
