PE Packer/Crypter Source

PE Packer/Crypter — AES-128-CTR with NASM Stub

Python 3 packer that encrypts .text/.data with AES-128-CTR and appends a self-decrypting NASM stub as a new .zion section. The stub expands the key, decrypts in memory and jumps to the original entry point.

• Encryption: AES-128-CTR, no padding, SizeOfRawData untouched, continuous keystream across sections.
• Stubs (x86 + x64): runtime key expansion, T-table AES core, getpc-based relocation, per-section table appended after the stub.
• PE surgery: file-alignment-aware header/section layout insertion — no pefile re-serialization corruption.
• Anti-debug in stub: PEB BeingDebugged + NtGlobalFlag checks; disabled with --no-antidebug (byte-patch verified).
• TLS callbacks: if callbacks live in an encrypted section, the TLS directory is neutralized and the stub re-runs the callbacks exactly once after decryption (verified end-to-end on x86 and x64).
• Key info: writes <output>.keyinfo with key, nonce and section map.
• Verification: 17/17 emulation tests; 5 packed binaries execute correctly under wine (x86/x64, pure asm and full CRT).