Information Hiding Scheme of PE File Format Based on Code Moving

Based on the characteristic of subroutine in code section of PE file format, this paper proposes a new information hiding scheme, in which the subroutine is moved in code section and then the information is hidden in the location of original subroutine. This scheme hides the information in the code, and makes the hidden information closely combined with the original data of PE file. The hidden information is scattered in various locations of PE file, and thus is hard to be detected. As compared with other schemes, this scheme could enhance the dispersion and security of hidden information by encrypting and scattering the information.