PE (portable executable) file has the characteristics of diversity, uncertainty of file size, complexity of file structure, and singleness of file format, which make it easy to be a carrier of information hiding, especially for that of large hiding capacity. This paper proposes an information-hiding algorithm based on PE file function migration, which utilizes disassembly engine to disassemble code section of PE file, processes function recognition, and shifts the whole codes of system or user-defined functions to the last section of PE file. Then it hides information in the original code space. The hidden information is combined with the main functions of the PE file, and the hidden information is coupled with the key codes of the program, which further enhances the concealment performance and anti-attack capability of the system.

PE（便携式可执行文件）文件具有多样性，文件大小不确定，文件结构复杂，文件格式单一等特点，易于成为信息隐藏的载体，特别是对于大的隐藏能力。本文提出了一种基于PE文件功能迁移的信息隐藏算法，该算法利用反汇编引擎对PE文件的代码段进行反汇编，进行功能识别，并将系统或用户自定义功能的全部代码移至PE文件的最后一段。 。然后，它将信息隐藏在原始代码空间中。隐藏信息与PE文件的主要功能相结合，并且隐藏信息与程序的关键代码相结合，进一步提高了系统的隐藏性能和抗攻击能力。