PE with spoofed sections

An undocumented trick to embed executable code within (what appears to be) a read-only PE section. The proof-of-concepts described above involve appending the payload to the end of the NT headers, but it is also possible to embed executable code within the headers.

Nice, x86matthew. Ping @siri_urz

https://secret.club/2023/06/05/spoof-pe-sections.html

• sample : https://secret.club/assets/pe_section_spoof/pe_section_spoof.zip