A low-level mutator for Windows PE files that obfuscates headers and metadata to break static analysis signatures without breaking execution.
Astral-PE is a low-level mutator for native Windows PE files that rewrites structural metadata like headers, timestamps, and import tables after compilation. It solves the problem of protected binaries remaining vulnerable to static analysis, YARA rules, and automated unpackers by obfuscating critical structures without breaking execution.
Security researchers, malware analysts, and developers creating protected binaries, crackmes, or custom loaders who need to disrupt reverse engineering and static analysis tools.
Developers choose Astral-PE for its surgical approach to metadata obfuscation that doesn't rely on packing or encryption, ensuring compatibility and execution safety while effectively breaking static signatures and analysis workflows.
Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Applies PE-compliant mutations that alter low-level fingerprints like timestamps and section names without breaking binary executability, as emphasized in the README's philosophy.
Clears timestamps, removes Rich Headers, and wipes section names to break YARA rules and automated unpacker logic, as shown in the before-and-after screenshots with Detect It Easy.
Designed as a post-processing step that can be chained into CI, cryptor, or loader pipelines, with example usage in the README for enhanced protection workflows.
Erases debug info (PDB paths), version info, and unused data directories to reduce analysis surfaces, specifically targeting tools that rely on these fingerprints.
Only obfuscates structural metadata, leaving the actual code vulnerable to decompilation or runtime analysis, as the README explicitly states it is not a code obfuscator.
Does not support .NET binaries, limiting its utility to native Windows applications and excluding a large segment of Windows software development.
When using the legacy Windows compatibility mode for older OS support, obfuscation is less effective, as admitted in the README with the -l flag description.
Modifications like stripping overlays only if signed and altering headers could interfere with digital signatures, requiring re-signing and complicating deployment for signed binaries.