加壳机（vc源码）源码在vc7+xp-sp2下编译通过

原理：对Pe文件的.data节，.text节进行XOR加密，然后将带解密的Loader写入文件头和第一个段的开头之间，修改Entry Point使其指向Loader.

测试用例：使用vc6.0自动生成的mfc对话框应用程序。

参考文献：(1)def源码

(2)黑客调试技术揭秘

(3)yoda s protector源码

存在问题：只对.data节,.text节加密，且其中不能包含Resource，Import Table.....等结构,通用性很差

下图为测试用例的section table和directory table。 工具打包源码。加壳机

试用例.

加壳机源码.

加壳机静态mfc

-Packers machine (vc source) source in vc7+ xp-sp2 compiled by Principle: The Pe file. Data section,. Text section to XOR encryption, decryption of the Loader and then written to a file with the first and the beginning of a paragraph between the modified Entry Point to point Loader. test case: automatically generated using vc6.0 mfc dialog application. References: (1) def source (2) hackers debug Uncovered (3) yoda' s protector Source problem: only. Data section,. Text section of encryption, and which can not contain Resource, Import Table ..... structure of , generic photo shows poor test case under the section table and directory table. Tool Package source. Packers machine trial cases. Packers machine source. Packers machine static mfc相关搜索： yoda
protector