title: Runtime decryption (PE file packer)
body: <p>I've been writing my own PE file packer and I'm stuck at decrypting the code section. So far I've managed to add a new section, crypt the code section, change the entry point so that it runs first my decryption routine, and of course written the decryption routine. The decryption routine is similar to this one <a href="http://www.codereversing.com/blog/?p=94" rel="nofollow">Writing a File Infector/Encrypter: Writing the Compiled Stub (3/4)</a>, but it's got only a simple xor 7 decryption (most of it is the same I've just changed the decryption routine). As far as I can see in my debugger, the .text (code) section get's decrypted ok but SOMETIMES it stucks in: </p>
  
  <pre><code>call    probni-o.__security_init_cookie 
  </code></pre>
  
  <p>(olly dbg say EIP = 0 ), when I say sometimes I mean it, because sometimes it goes ok and my program runs fine, but sometimes not (it goes ok only in a debugger, when I start it normally it won't)</p>
  
  <p>There's also another problem that I've ignored, but don't know if these two problems are linked (probably not); when I add my own section, I've aligned the <code>SizeOfRawData</code> with the section alignment as I've read in a few places, but then my PE file isn't a valid Win32 application, but when I write it without aligning it, it runs ok, so I've ignored it...</p>
  
  <p>Thanks in advance!</p>