Astral-PE
A low-level mutator for Windows PE files that obfuscates headers and metadata to break static analysis signatures without breaking execution.
What is Astral-PE?
Astral-PE is a low-level mutator for native Windows PE files that rewrites structural metadata like headers, timestamps, and import tables after compilation. It solves the problem of protected binaries remaining vulnerable to static analysis, YARA rules, and automated unpackers by obfuscating critical structures without breaking execution.
Security researchers, malware analysts, and developers creating protected binaries, crackmes, or custom loaders who need to disrupt reverse engineering and static analysis tools.
Developers choose Astral-PE for its surgical approach to metadata obfuscation that doesn't rely on packing or encryption, ensuring compatibility and execution safety while effectively breaking static signatures and analysis workflows.
Overview
Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)
Use Cases
Best For
- Disrupting YARA rules and static unpacker logic on protected binaries
- Creating custom protectors or loaders with obfuscated structural metadata
- Designing crackme challenges with altered PE fingerprints
- Stripping debug info and toolchain fingerprints from release builds
- Hardening binaries against sandbox clustering and automated analysis
- Post-processing packed executables to break heuristic detection
Not Ideal For
- Projects requiring code-level obfuscation or encryption for intellectual property protection
- Software that needs preserved debug symbols for crash reporting or development troubleshooting
- Applications where binary integrity must remain unchanged for digital signatures or compliance checks
- .NET or managed framework binaries, as it only supports native Windows PE files
Pros & Cons
Pros
Applies PE-compliant mutations that alter low-level fingerprints like timestamps and section names without breaking binary executability, as emphasized in the README's philosophy.
Clears timestamps, removes Rich Headers, and wipes section names to break YARA rules and automated unpacker logic, as shown in the before-and-after screenshots with Detect It Easy.
Designed as a post-processing step that can be chained into CI, cryptor, or loader pipelines, with example usage in the README for enhanced protection workflows.
Erases debug info (PDB paths), version info, and unused data directories to reduce analysis surfaces, specifically targeting tools that rely on these fingerprints.
Cons
Only obfuscates structural metadata, leaving the actual code vulnerable to decompilation or runtime analysis, as the README explicitly states it is not a code obfuscator.
Does not support .NET binaries, limiting its utility to native Windows applications and excluding a large segment of Windows software development.
When using the legacy Windows compatibility mode for older OS support, obfuscation is less effective, as admitted in the README with the -l flag description.
Modifications like stripping overlays only if signed and altering headers could interfere with digital signatures, requiring re-signing and complicating deployment for signed binaries.
Frequently Asked Questions
Related Projects
ConfuserExAn open-source, free protector for .NET applications
PEzorOpen-Source Shellcode & PE Packer
AmberReflective PE packer.
CrinklerCrinkler is an executable file compressor (or rather, a compressing linker) for compressing small 32-bit Windows demoscene executables. As of 2026, it is the most widely used tool for compressing 1k/4k/8k intros.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.