using System; using System.Linq; using System.Text; using System.Threading.Tasks; using System.Runtime.InteropServices; namespace ProcessInjection.Native { public static class PE { public const uint DLL_PROCESS_DETACH = 0; public const uint DLL_PROCESS_ATTACH = 1; public const uint DLL_THREAD_ATTACH = 2; public const uint DLL_THREAD_DETACH = 3; [UnmanagedFunctionPointer(CallingConvention.StdCall)] public delegate bool DllMain(IntPtr hinstDll, uint fdwReason, IntPtr lpvReserved); [Flags] public enum DataSectionFlags : uint { TYPE_NO_PAD = 0x00000008, CNT_CODE = 0x00000020, CNT_INITIALIZED_DATA = 0x00000040, CNT_UNINITIALIZED_DATA = 0x00000080, LNK_INFO = 0x00000200, LNK_REMOVE = 0x00000800, LNK_COMDAT = 0x00001000, NO_DEFER_SPEC_EXC = 0x00004000, GPREL = 0x00008000, MEM_FARDATA = 0x00008000, MEM_PURGEABLE = 0x00020000, MEM_16BIT = 0x00020000, MEM_LOCKED = 0x00040000, MEM_PRELOAD = 0x00080000, ALIGN_1BYTES = 0x00100000, ALIGN_2BYTES = 0x00200000, ALIGN_4BYTES = 0x00300000, ALIGN_8BYTES = 0x00400000, ALIGN_16BYTES = 0x00500000, ALIGN_32BYTES = 0x00600000, ALIGN_64BYTES = 0x00700000, ALIGN_128BYTES = 0x00800000, ALIGN_256BYTES = 0x00900000, ALIGN_512BYTES = 0x00A00000, ALIGN_1024BYTES = 0x00B00000, ALIGN_2048BYTES = 0x00C00000, ALIGN_4096BYTES = 0x00D00000, ALIGN_8192BYTES = 0x00E00000, ALIGN_MASK = 0x00F00000, LNK_NRELOC_OVFL = 0x01000000, MEM_DISCARDABLE = 0x02000000, MEM_NOT_CACHED = 0x04000000, MEM_NOT_PAGED = 0x08000000, MEM_SHARED = 0x10000000, MEM_EXECUTE = 0x20000000, MEM_READ = 0x40000000, MEM_WRITE = 0x80000000 } [StructLayout(LayoutKind.Sequential)] public struct IMAGE_DATA_DIRECTORY { public uint VirtualAddress; public uint Size; } [StructLayout(LayoutKind.Sequential, Pack = 1)] public struct IMAGE_OPTIONAL_HEADER32 { public ushort Magic; public byte MajorLinkerVersion; public byte MinorLinkerVersion; public uint SizeOfCode; public uint SizeOfInitializedData; public uint SizeOfUninitializedData; public uint AddressOfEntryPoint; public uint BaseOfCode; public uint BaseOfData; public uint ImageBase; public uint SectionAlignment; public uint FileAlignment; public ushort MajorOperatingSystemVersion; public ushort MinorOperatingSystemVersion; public ushort MajorImageVersion; public ushort MinorImageVersion; public ushort MajorSubsystemVersion; public ushort MinorSubsystemVersion; public uint Win32VersionValue; public uint SizeOfImage; public uint SizeOfHeaders; public uint CheckSum; public ushort Subsystem; public ushort DllCharacteristics; public uint SizeOfStackReserve; public uint SizeOfStackCommit; public uint SizeOfHeapReserve; public uint SizeOfHeapCommit; public uint LoaderFlags; public uint NumberOfRvaAndSizes; public IMAGE_DATA_DIRECTORY ExportTable; public IMAGE_DATA_DIRECTORY ImportTable; public IMAGE_DATA_DIRECTORY ResourceTable; public IMAGE_DATA_DIRECTORY ExceptionTable; public IMAGE_DATA_DIRECTORY CertificateTable; public IMAGE_DATA_DIRECTORY BaseRelocationTable; public IMAGE_DATA_DIRECTORY Debug; public IMAGE_DATA_DIRECTORY Architecture; public IMAGE_DATA_DIRECTORY GlobalPtr; public IMAGE_DATA_DIRECTORY TLSTable; public IMAGE_DATA_DIRECTORY LoadConfigTable; public IMAGE_DATA_DIRECTORY BoundImport; public IMAGE_DATA_DIRECTORY IAT; public IMAGE_DATA_DIRECTORY DelayImportDescriptor; public IMAGE_DATA_DIRECTORY CLRRuntimeHeader; public IMAGE_DATA_DIRECTORY Reserved; } [StructLayout(LayoutKind.Sequential, Pack = 1)] public struct IMAGE_OPTIONAL_HEADER64 { public ushort Magic; public byte MajorLinkerVersion; public byte MinorLinkerVersion; public uint SizeOfCode; public uint SizeOfInitializedData; public uint SizeOfUninitializedData; public uint AddressOfEntryPoint; public uint BaseOfCode; public ulong ImageBase; public uint SectionAlignment; public uint FileAlignment; public ushort MajorOperatingSystemVersion; public ushort MinorOperatingSystemVersion; public ushort MajorImageVersion; public ushort MinorImageVersion; public ushort MajorSubsystemVersion; public ushort MinorSubsystemVersion; public uint Win32VersionValue; public uint SizeOfImage; public uint SizeOfHeaders; public uint CheckSum; public ushort Subsystem; public ushort DllCharacteristics; public ulong SizeOfStackReserve; public ulong SizeOfStackCommit; public ulong SizeOfHeapReserve; public ulong SizeOfHeapCommit; public uint LoaderFlags; public uint NumberOfRvaAndSizes; public IMAGE_DATA_DIRECTORY ExportTable; public IMAGE_DATA_DIRECTORY ImportTable; public IMAGE_DATA_DIRECTORY ResourceTable; public IMAGE_DATA_DIRECTORY ExceptionTable; public IMAGE_DATA_DIRECTORY CertificateTable; public IMAGE_DATA_DIRECTORY BaseRelocationTable; public IMAGE_DATA_DIRECTORY Debug; public IMAGE_DATA_DIRECTORY Architecture; public IMAGE_DATA_DIRECTORY GlobalPtr; public IMAGE_DATA_DIRECTORY TLSTable; public IMAGE_DATA_DIRECTORY LoadConfigTable; public IMAGE_DATA_DIRECTORY BoundImport; public IMAGE_DATA_DIRECTORY IAT; public IMAGE_DATA_DIRECTORY DelayImportDescriptor; public IMAGE_DATA_DIRECTORY CLRRuntimeHeader; public IMAGE_DATA_DIRECTORY Reserved; } [StructLayout(LayoutKind.Sequential, Pack = 1)] public struct IMAGE_FILE_HEADER { public ushort Machine; public ushort NumberOfSections; public uint TimeDateStamp; public uint PointerToSymbolTable; public uint NumberOfSymbols; public ushort SizeOfOptionalHeader; public ushort Characteristics; } [StructLayout(LayoutKind.Explicit)] public struct IMAGE_SECTION_HEADER { [FieldOffset(0)] [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)] public char[] Name; [FieldOffset(8)] public uint VirtualSize; [FieldOffset(12)] public uint VirtualAddress; [FieldOffset(16)] public uint SizeOfRawData; [FieldOffset(20)] public uint PointerToRawData; [FieldOffset(24)] public uint PointerToRelocations; [FieldOffset(28)] public uint PointerToLinenumbers; [FieldOffset(32)] public ushort NumberOfRelocations; [FieldOffset(34)] public ushort NumberOfLinenumbers; [FieldOffset(36)] public DataSectionFlags Characteristics; public string Section { get { int i = Name.Length - 1; while (Name[i] == 0) { --i; } char[] NameCleaned = new char[i + 1]; Array.Copy(Name, NameCleaned, i + 1); return new string(NameCleaned); } } } [StructLayout(LayoutKind.Sequential)] public struct IMAGE_BASE_RELOCATION { public uint VirtualAdress; public uint SizeOfBlock; } [StructLayout(LayoutKind.Sequential)] public struct PE_META_DATA { public uint Pe; public bool Is32Bit; public IMAGE_FILE_HEADER ImageFileHeader; public IMAGE_OPTIONAL_HEADER32 OptHeader32; public IMAGE_OPTIONAL_HEADER64 OptHeader64; public IMAGE_SECTION_HEADER[] Sections; } [StructLayout(LayoutKind.Sequential)] public struct PE_MANUAL_MAP { public string DecoyModule; public IntPtr ModuleBase; public PE_META_DATA PEINFO; } [StructLayout(LayoutKind.Explicit)] public struct IMAGE_THUNK_DATA32 { [FieldOffset(0)] public uint ForwarderString; [FieldOffset(0)] public uint Function; [FieldOffset(0)] public uint Ordinal; [FieldOffset(0)] public uint AddressOfData; } [StructLayout(LayoutKind.Explicit)] public struct IMAGE_THUNK_DATA64 { [FieldOffset(0)] public ulong ForwarderString; [FieldOffset(0)] public ulong Function; [FieldOffset(0)] public ulong Ordinal; [FieldOffset(0)] public ulong AddressOfData; } [StructLayout(LayoutKind.Explicit)] public struct ApiSetNamespace { [FieldOffset(0x0C)] public int Count; [FieldOffset(0x10)] public int EntryOffset; } [StructLayout(LayoutKind.Explicit)] public struct ApiSetNamespaceEntry { [FieldOffset(0x04)] public int NameOffset; [FieldOffset(0x08)] public int NameLength; [FieldOffset(0x10)] public int ValueOffset; [FieldOffset(0x14)] public int ValueLength; } [StructLayout(LayoutKind.Explicit)] public struct ApiSetValueEntry { [FieldOffset(0x00)] public int Flags; [FieldOffset(0x04)] public int NameOffset; [FieldOffset(0x08)] public int NameCount; [FieldOffset(0x0C)] public int ValueOffset; [FieldOffset(0x10)] public int ValueCount; } [StructLayout(LayoutKind.Sequential)] public struct LDR_DATA_TABLE_ENTRY { public Structs.LIST_ENTRY InLoadOrderLinks; public Structs.LIST_ENTRY InMemoryOrderLinks; public Structs.LIST_ENTRY InInitializationOrderLinks; public IntPtr DllBase; public IntPtr EntryPoint; public uint SizeOfImage; public Structs.UNICODE_STRING FullDllName; public Structs.UNICODE_STRING BaseDllName; } } }