ExeShield

A Win32 PE executable packer/protector written in Delphi 6 (2006).

ExeShield compresses and encrypts PE executable sections, then injects a position-independent loader stub that decompresses and decrypts the original code at runtime after password verification.

Features

• Section-by-section compression using UCL (NRV2E algorithm)
• RC4 encryption of compressed sections with user-defined password
• Position-independent loader injected as a new PE section (.eXS)
• Runtime password dialog — the protected executable prompts for a password before unpacking
• Backup option — optionally creates a .bak copy before wrapping
• Adjustable compression level (1–10)
• Preserves resource and import sections untouched
• Anti-double-wrap detection (signature-based)

How It Works

1. The packer validates the target PE and reads its structure
2. Each section (except resources and imports) is compressed with UCL and encrypted with RC4
3. A new section .eXS is appended containing:
   • Packed section metadata (VA, original size, packed size)
   • NRV2E decompressor (x86 assembly)
   • Unpacking caller stub
   • Encrypted data block (API names, RC4 state, OEP)
   • Main loader with PEB-based kernel32 resolution, API hashing, and a dialog box procedure
4. The entry point is redirected to the main loader
5. At runtime, the loader:
   • Finds kernel32.dll via the PEB
   • Resolves LoadLibraryA/GetProcAddress by export name hashing
   • Bootstraps all needed Win32 APIs (user32, gdi32, comctl32)
   • Displays a password dialog
   • On correct password: decrypts sections with RC4, decompresses with NRV2E, jumps to the original entry point

Project Structure

ExeShield/
  PExeShield.dpr   - Delphi project file
  Main.pas          - GUI (TeThemeEngine-based) and wrapping orchestration
  PeLib.pas         - PE format structures (DOS, NT, sections, imports, exports, resources)
  MiscsFuncs.pas    - PE utilities (validation, RVA conversion, section addition, signatures)
  PackStuff.pas     - UCL compression engine, section packing logic
  RC4.pas           - RC4 cipher implementation (x86 inline assembly)
  Loader.pas        - Position-independent loader/stub (x86 inline assembly)
  PExeShield.res    - Compiled resources
DatasVA.txt         - Debug reference for TData structure field offsets

Building

Requires Borland Delphi 6 (or compatible) with:

• UCL compression library (DIUclApi unit)
• TeThemeEngine components (KSDev ThemeEngine for Delphi 6)

Historical Context

This project was created in 2006 as a learning exercise in PE format manipulation, x86 assembly, and software protection techniques. It targets 32-bit Windows executables only.

Disclaimer

This project is published for educational and historical purposes only. It demonstrates PE format internals, x86 shellcode techniques, and compression/encryption integration. Do not use it for malicious purposes.

License

MIT