Abstract: Adopting incremental link aims to boost compile speed and make debug convenient.By analyzing PE file chararcteristics after utilizing incremental link, this algorithm was designed. Concretely,it hides information into padding bytes between adjacent function codes,which integrates hidden information into program instruction codes to guarantee concealment and attack tolerance. The experiment results show that the algorithm has a large hiding capacity, and PE file size does not increase after hidden,and there is not any impact on program performance.

Key words: PE file,Information hiding,Incremental link,Padding byte