Module 3: PE Internals & Custom Sections

How FunctionPeekaboo embeds metadata and initialization code into the PE file using custom sections.

1. PE File Format Overview

Every Windows executable (.exe, .dll) follows the Portable Executable format. The key structures relevant to FunctionPeekaboo are:

TextPE File Layout:
+-----------------------------+
| DOS Header (MZ)             |  ← Legacy header, contains e_lfanew pointer
+-----------------------------+
| PE Signature ("PE\0\0")     |  ← Identifies file as PE
+-----------------------------+
| COFF File Header            |  ← Machine type, number of sections, timestamp
+-----------------------------+
| Optional Header             |  ← Entry point RVA, image base, section alignment
|   - Data Directories        |  ← Import/export tables, relocations, etc.
+-----------------------------+
| Section Headers             |  ← Array of IMAGE_SECTION_HEADER structures
|   .text  | .rdata | .data   |
|   .funcmeta | .stub         |  ← FunctionPeekaboo's custom sections
+-----------------------------+
| Section Bodies              |  ← Actual code, data, metadata bytes
|   .text body                |
|   .rdata body               |
|   .data body                |
|   .funcmeta body            |  ← Function registration metadata
|   .stub body                |  ← Initialization entry point
+-----------------------------+

2. Critical PE Header Fields

Several fields in the PE Optional Header are directly relevant to how FunctionPeekaboo operates:

3. Section Headers

Each section has an IMAGE_SECTION_HEADER that describes its name, size, location, and permissions:

C// IMAGE_SECTION_HEADER structure (40 bytes each)
typedef struct {
    BYTE  Name[8];           // Section name (".text", ".funcmeta", etc.)
    DWORD VirtualSize;       // Size in memory
    DWORD VirtualAddress;    // RVA (offset from ImageBase) when loaded
    DWORD SizeOfRawData;     // Size on disk
    DWORD PointerToRawData;  // File offset to section data
    DWORD PointerToRelocations;
    DWORD PointerToLinenumbers;
    WORD  NumberOfRelocations;
    WORD  NumberOfLinenumbers;
    DWORD Characteristics;   // Flags: readable, writable, executable, etc.
} IMAGE_SECTION_HEADER;

The Characteristics field is a bitmask of flags that control the section’s memory permissions:

4. The .funcmeta Custom Section

FunctionPeekaboo creates a custom PE section called .funcmeta that stores metadata about every registered (peekaboo-attributed) function. This section is the “registry” that the handler consults at runtime to know which regions to encrypt/decrypt.

C// Each entry in .funcmeta describes one registered function
typedef struct {
    DWORD FunctionRVA;     // RVA of the function start (after prologue stub)
    DWORD FunctionSize;    // Size of the function body in bytes
    BYTE  XorKey;          // Single-byte XOR key for this function
    BYTE  IsEncrypted;     // Current state: 1 = encrypted, 0 = decrypted
    WORD  Reserved;        // Alignment padding
} FUNC_META_ENTRY;

// The section is a flat array:
// [entry_0][entry_1][entry_2]...[entry_N][null terminator]

The section permissions are READ | WRITE (not execute). It contains data only — the handler reads from it to find function locations and writes to it to update the IsEncrypted flag.

5. The .stub Custom Section

The .stub section contains the initialization entry point for FunctionPeekaboo. The PE’s AddressOfEntryPoint is modified (by modifyEP.py) to point here instead of the original entry point.

The .stub section has READ | EXECUTE permissions (it contains code). It is small — typically a few hundred bytes — containing just the initialization logic and a jump to the original entry point.

x86 Assembly; Simplified .stub pseudocode
_stub_entry:
    ; Save all registers (we're hijacking the entry point)
    pushfq
    push rax
    push rcx
    push rdx
    ; ... save all volatile registers ...

    ; Initialize TEB UserReserved fields
    mov qword ptr gs:[0x1488], 0    ; UserReserved[0] = NULL (no active function)
    mov qword ptr gs:[0x1490], 0    ; UserReserved[1] = flags

    ; Walk .funcmeta and XOR-encrypt each function body
    call _initial_encrypt_all

    ; Restore all registers
    ; ... pop all registers ...
    popfq

    ; Jump to original entry point
    jmp original_entry_point

6. Section Alignment and Virtual Addresses

When the Windows PE loader maps a binary into memory, sections are aligned to SectionAlignment boundaries (typically 4096 bytes / one page). This means:

The relationship between RVAs and virtual addresses:

C// Converting between RVA and Virtual Address
// RVA = Relative Virtual Address (offset from image base)
// VA  = Virtual Address (actual memory address)

VA = ImageBase + RVA

// Example:
// ImageBase    = 0x00400000  (loaded PE base)
// Function RVA = 0x00001234  (from .funcmeta entry)
// Function VA  = 0x00401234  (actual address in memory)

7. The modifyEP.py Post-Processor

After compilation, the binary has the standard CRT entry point (e.g., mainCRTStartup). FunctionPeekaboo needs to intercept execution before the CRT runs, so it uses a Python script to modify the PE:

Python# Simplified modifyEP.py logic
import pefile

def modify_entry_point(pe_path):
    pe = pefile.PE(pe_path)

    # Save original entry point
    original_ep = pe.OPTIONAL_HEADER.AddressOfEntryPoint

    # Find .stub section
    stub_section = None
    for section in pe.sections:
        if section.Name.rstrip(b'\x00') == b'.stub':
            stub_section = section
            break

    # Write original EP into .stub's reserved field
    stub_va = stub_section.VirtualAddress
    # The .stub code has a placeholder for the original EP
    pe.set_dword_at_rva(stub_va + ORIGINAL_EP_OFFSET, original_ep)

    # Set new entry point to .stub
    pe.OPTIONAL_HEADER.AddressOfEntryPoint = stub_va

    pe.write(pe_path)
    pe.close()

8. Inspecting Custom Sections

You can verify FunctionPeekaboo’s sections using standard PE analysis tools:

Bash# Using dumpbin (Visual Studio)
dumpbin /headers implant.exe

# Look for:
# SECTION HEADER #5
#    .funcmeta name
#    ...
#    40000040 flags
#            Initialized Data
#            Read Write
#
# SECTION HEADER #6
#    .stub name
#    ...
#    60000020 flags
#            Code
#            Execute Read

# Using Python pefile
python3 -c "
import pefile
pe = pefile.PE('implant.exe')
for s in pe.sections:
    print(f'{s.Name.decode().rstrip(chr(0)):10} VA=0x{s.VirtualAddress:08x} Size=0x{s.Misc_VirtualSize:08x} Chars=0x{s.Characteristics:08x}')
print(f'Entry Point: 0x{pe.OPTIONAL_HEADER.AddressOfEntryPoint:08x}')
"

9. Section Security Implications