Astral-PE: A low-level mutator (headers obfuscator) for native Windows PE files
Astral-PE is a low-level mutator (headers obfuscator and patcher) for Windows PE files (.exe, .dll) that rewrites structural metadata after compilation (or postbuild protection) — without breaking execution.
It does not pack, encrypt or inject. Instead, it mutates low-hanging but critical structures like timestamps, headers, section flags, debug info, import/export names, and more.
In what cases is it useful?
You’ve protected a binary — but public unpackers or YARA rules still target its unchanged structure.
??? Use Astral-PE as a post-processing step to:
- Prevent automated unpacking
- Break static unpacker logic
- Invalidate reverse-engineering signatures
- Disrupt clustering in sandboxes
- Strip metadata, overlays (only if file is signed), debug traces…
? Perfect for:
- For packed/protected builds (e.g. legacy Enigma)
- To create your own protector on this base
- Hardened loaders that remain structurally default
- To create interesting crackme quests
- For educational purposes
What it modifies
Astral-PE applies precise, compliant, and execution-safe mutations:
| Target | Description |
|---|---|
| ? Timestamp | Clears TimeDateStamp in file headers |
| ? Rich Header | Fully removed — breaks toolchain fingerprinting |
| ? Section Names | Wiped (.text, .rsrc, etc. → null) |
| ? Checksum | Reset to zero |
| ? Overlay | Stripped if file was signed |
| ? TLS Directory | Removed if unused |
| ⚙ Load Config | Deleted (if CFG not present) |
| ? Relocations | Removed if not used in the file |
| ? Large Address Aware | Enables 4 GB memory range for 32-bit processes |
| ? Header Flags | Stripped: DEBUG_STRIPPED, LOCAL_SYMS_STRIPPED, LINE_NUMS_STRIPPED |
| ? Subsystem Version | Minimum OS and Subsystem versions set to zero |
| ? Stack & Heap Reserve | Increased to safe defaults (32/64 MB) if too low |
| ? Version Info | Erased from optional header |
| ? Original Filename | Located and zeroed in binary tail |
| ? Debug Info | PDB paths wiped, Debug Directory erased |
| ? Entry Point Patch | Replaces or shuffles PUSH/PROLOGUE bytes (e.g. UPX) |
| ? Import Table | DLL names mutated: case, prefix, randomized formatting |
| ? Export Table | Faked if absent (baits certain scanners) |
| ? Data Directory | All unused entries cleaned |
| ? Permissions | R/W/X + code flags applied to all sections |
| ? DOS Stub | Reset to clean “MZ”, patched e_lfanew |
