using System; using System.Collections.Generic; using System.Linq; using System.Runtime.InteropServices; using System.Text; using System.Threading.Tasks; namespace dotNetPELoader { unsafe internal class NativeDeclarations { /// /// Acknowledgement: https://github.com/S3cur3Th1sSh1t/Creds/blob/master/Csharp/PEloader.cs /// public static uint MEM_COMMIT = 0x1000; public static uint MEM_RESERVE = 0x2000; public static uint PAGE_EXECUTE_READWRITE = 0x40; public static uint PAGE_READWRITE = 0x04; [StructLayout(LayoutKind.Sequential)] public unsafe struct IMAGE_BASE_RELOCATION { public uint VirtualAddress; public uint SizeOfBlock; } [DllImport("kernel32")] public static extern IntPtr VirtualAlloc(IntPtr lpStartAddr, uint size, uint flAllocationType, uint flProtect); [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)] public static extern IntPtr LoadLibrary(string lpFileName); [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); [DllImport("kernel32.dll", SetLastError = true)] public static extern IntPtr GetProcAddress(IntPtr hModule, IntPtr ordinal); [DllImport("kernel32")] public static extern IntPtr CreateThread( IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr param, uint dwCreationFlags, IntPtr lpThreadId ); [DllImport("kernel32")] public static extern UInt32 WaitForSingleObject( IntPtr hHandle, UInt32 dwMilliseconds ); [StructLayout(LayoutKind.Sequential)] public unsafe struct IMAGE_IMPORT_DESCRIPTOR { public uint OriginalFirstThunk; public uint TimeDateStamp; public uint ForwarderChain; public uint Name; public uint FirstThunk; } } }