Merge branch 'dev'

DotNet/App.config

@@ -1,6 +1,6 @@
-<?xml version="1.0" encoding="utf-8" ?>
+<?xml version="1.0" encoding="utf-8"?>
 <configuration>
     <startup> 
-        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5.2" />
-    </startup>
-</configuration>
+        
+    <supportedRuntime version="v2.0.50727"/></startup>
+</configuration>

DotNet/DotNet.csproj

@@ -9,7 +9,7 @@
     <AppDesignerFolder>Properties</AppDesignerFolder>
     <RootNamespace>RDIShellcodeLoader</RootNamespace>
     <AssemblyName>RDIShellcodeLoader</AssemblyName>
-    <TargetFrameworkVersion>v4.5.2</TargetFrameworkVersion>
+    <TargetFrameworkVersion>v3.5</TargetFrameworkVersion>
     <FileAlignment>512</FileAlignment>
     <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
     <PublishUrl>publish\</PublishUrl>
@@ -27,6 +27,7 @@
     <IsWebBootstrapper>false</IsWebBootstrapper>
     <UseApplicationTrust>false</UseApplicationTrust>
     <BootstrapperEnabled>true</BootstrapperEnabled>
+    <TargetFrameworkProfile />
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x64'">
     <DebugSymbols>true</DebugSymbols>
@@ -37,6 +38,7 @@
     <PlatformTarget>x64</PlatformTarget>
     <ErrorReport>prompt</ErrorReport>
     <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
+    <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x64'">
     <OutputPath>bin\x64\Release\</OutputPath>
@@ -46,6 +48,7 @@
     <PlatformTarget>x64</PlatformTarget>
     <ErrorReport>prompt</ErrorReport>
     <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
+    <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x86'">
     <DebugSymbols>true</DebugSymbols>
@@ -56,6 +59,7 @@
     <PlatformTarget>x86</PlatformTarget>
     <ErrorReport>prompt</ErrorReport>
     <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
+    <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x86'">
     <OutputPath>bin\x86\Release\</OutputPath>
@@ -65,15 +69,14 @@
     <PlatformTarget>x86</PlatformTarget>
     <ErrorReport>prompt</ErrorReport>
     <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
+    <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <ItemGroup>
     <Reference Include="System" />
     <Reference Include="System.Core" />
     <Reference Include="System.Xml.Linq" />
     <Reference Include="System.Data.DataSetExtensions" />
-    <Reference Include="Microsoft.CSharp" />
     <Reference Include="System.Data" />
-    <Reference Include="System.Net.Http" />
     <Reference Include="System.Xml" />
   </ItemGroup>
   <ItemGroup>

FunctionTest/FunctionTest.cpp

@@ -14,78 +14,40 @@
 #define DEREF_16( name )*(WORD *)(name)
 #define DEREF_8( name )*(BYTE *)(name)
 
-FARPROC GetProcAddressR(UINT_PTR uiLibraryAddress, LPCSTR lpProcName)
-{
-	FARPROC fpResult = NULL;
+#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva)
 
-	if (uiLibraryAddress == NULL)
+FARPROC GetProcAddressR(HMODULE hModule, LPCSTR lpProcName)
+{
+	if (hModule == NULL || lpProcName == NULL)
 		return NULL;
 
-	UINT_PTR uiAddressArray = 0;
-	UINT_PTR uiNameArray = 0;
-	UINT_PTR uiNameOrdinals = 0;
-	PIMAGE_NT_HEADERS pNtHeaders = NULL;
-	PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
-	PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL;
+	PIMAGE_NT_HEADERS ntHeaders = RVA(PIMAGE_NT_HEADERS, hModule, ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
+	PIMAGE_DATA_DIRECTORY dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+	if (!dataDir->Size)
+		return NULL;
 
-	// get the VA of the modules NT Header
-	pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew);
+	PIMAGE_EXPORT_DIRECTORY exportDir = RVA(PIMAGE_EXPORT_DIRECTORY, hModule, dataDir->VirtualAddress);
+	if (!exportDir->NumberOfNames || !exportDir->NumberOfFunctions)
+		return NULL;
 
-	pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+	PDWORD expName = RVA(PDWORD, hModule, exportDir->AddressOfNames);
+	PWORD expOrdinal = RVA(PWORD, hModule, exportDir->AddressOfNameOrdinals);
+	LPCSTR expNameStr;
 
-	// get the VA of the export directory
-	pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(uiLibraryAddress + pDataDirectory->VirtualAddress);
+	for (DWORD i = 0; i < exportDir->NumberOfNames; i++, expName++, expOrdinal++) {
 
-	// get the VA for the array of addresses
-	uiAddressArray = (uiLibraryAddress + pExportDirectory->AddressOfFunctions);
+		expNameStr = RVA(LPCSTR, hModule, *expName);
 
-	// get the VA for the array of name pointers
-	uiNameArray = (uiLibraryAddress + pExportDirectory->AddressOfNames);
+		if (!expNameStr)
+			break;
 
-	// get the VA for the array of name ordinals
-	uiNameOrdinals = (uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals);
-
-	// test if we are importing by name or by ordinal...
-	if (((DWORD)lpProcName & 0xFFFF0000) == 0x00000000)
-	{
-		// import by ordinal...
-
-		// use the import ordinal (- export ordinal base) as an index into the array of addresses
-		uiAddressArray += ((IMAGE_ORDINAL((DWORD)lpProcName) - pExportDirectory->Base) * sizeof(DWORD));
-
-		// resolve the address for this imported function
-		fpResult = (FARPROC)(uiLibraryAddress + DEREF_32(uiAddressArray));
-	}
-	else
-	{
-		// import by name...
-		DWORD dwCounter = pExportDirectory->NumberOfNames;
-		while (dwCounter--)
-		{
-			char* cpExportedFunctionName = (char*)(uiLibraryAddress + DEREF_32(uiNameArray));
-
-			// test if we have a match...
-			if (strcmp(cpExportedFunctionName, lpProcName) == 0)
-			{
-				// use the functions name ordinal as an index into the array of name pointers
-				uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));
-
-				// calculate the virtual address for the function
-				fpResult = (FARPROC)(uiLibraryAddress + DEREF_32(uiAddressArray));
-
-				// finish...
-				break;
-			}
-
-			// get the next exported function name
-			uiNameArray += sizeof(DWORD);
-
-			// get the next exported function name ordinal
-			uiNameOrdinals += sizeof(WORD);
+		if (!_stricmp(lpProcName, expNameStr)) {
+			DWORD funcRva = *RVA(PDWORD, hModule, exportDir->AddressOfFunctions + (*expOrdinal * 4));
+			return RVA(FARPROC, hModule, funcRva);
 		}
 	}
 
-	return fpResult;
+	return NULL;
 }
 
 
@@ -146,9 +108,9 @@ int main()
 
 	LoadDLL(
 		(ULONG_PTR)buffer,
-		HashFunctionName("SayHello"),
+		HashFunctionName("SayGoodbye"),
 		NULL, 0, 
-		SRDI_CLEARHEADER | SRDI_CLEARMEMORY | SRDI_OBFUSCATEIMPORTS | (3 << 16)
+		SRDI_CLEARHEADER | SRDI_CLEARMEMORY // | SRDI_OBFUSCATEIMPORTS | (3 << 16)
 	);
 
     return 0;

FunctionTest/FunctionTest.vcxproj

@@ -23,32 +23,32 @@
     <ProjectGuid>{7E4557D4-F56B-408A-8C81-CBEE5EF25B11}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>FunctionTest</RootNamespace>
-    <WindowsTargetPlatformVersion>10.0.15063.0</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v141</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v141</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v141</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v141</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>

Native/Native.vcxproj

@@ -22,33 +22,33 @@
     <ProjectGuid>{68293519-3053-4AB6-921F-9690E2E1487F}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>RDIShellcodeCLoader</RootNamespace>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
     <ProjectName>Native</ProjectName>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
@@ -170,4 +170,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

README.md

@@ -55,7 +55,7 @@ The PE loader code uses `flags` argument to control the various options of loadi
 
 
 ## Building
-This project is built using Visual Studio 2015 (v140) and Windows SDK 8.1. The python script is written using Python 3.
+This project is built using Visual Studio 2019 (v142) and Windows SDK 10. The python script is written using Python 3.
 
 The Python and Powershell scripts are located at:
 - `Python\ConvertToShellcode.py`

ShellcodeRDI/ShellcodeRDI.c

@@ -34,6 +34,11 @@
 #define LOCALFREE_HASH					0xea61fcb1			
 #define VIRTUALFREE_HASH				0x300f2f0b
 #define SLEEP_HASH						0xe035f044
+#define RTLADDFUNCTIONTABLE_HASH		0x45b82eba
+
+#define LDRLOADDLL_HASH					0xbdbf9c13
+#define LDRGETPROCADDRESS_HASH			0x5ed941b5
+
 
 #define HASH_KEY						13
 
@@ -53,16 +58,17 @@ typedef HMODULE(WINAPI * LOADLIBRARYA)(LPCSTR);
 typedef ULONG_PTR(WINAPI * GETPROCADDRESS)(HMODULE, LPCSTR);
 typedef LPVOID(WINAPI * VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD);
 typedef VOID(WINAPI * EXITTHREAD)(DWORD);
-typedef DWORD(NTAPI  * NTFLUSHINSTRUCTIONCACHE)(HANDLE, PVOID, ULONG);
+typedef BOOL(NTAPI  * FLUSHINSTRUCTIONCACHE)(HANDLE, LPCVOID, SIZE_T);
 typedef VOID(WINAPI * GETNATIVESYSTEMINFO)(LPSYSTEM_INFO);
 typedef BOOL(WINAPI * VIRTUALPROTECT)(LPVOID, SIZE_T, DWORD, PDWORD);
 typedef int (WINAPI * MESSAGEBOXA)(HWND, LPSTR, LPSTR, UINT);
 typedef BOOL(WINAPI * VIRTUALFREE)(LPVOID, SIZE_T, DWORD);
 typedef BOOL(WINAPI * LOCALFREE)(LPVOID);
 typedef VOID(WINAPI* SLEEP)(DWORD);
+typedef BOOLEAN(WINAPI* RTLADDFUNCTIONTABLE)(PVOID, DWORD, DWORD64);
 
-
-#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva)
+typedef NTSTATUS(WINAPI *LDRLOADDLL)(PWCHAR, ULONG, PUNICODE_STRING, PHANDLE);
+typedef NTSTATUS(WINAPI *LDRGETPROCADDRESS)(HMODULE, PANSI_STRING, WORD, PVOID*);
 
 #pragma warning( push )
 #pragma warning( disable : 4214 ) // nonstandard extension
@@ -70,13 +76,43 @@ typedef struct
 {
 	WORD	offset : 12;
 	WORD	type : 4;
-} IMAGE_RELOC, *PIMAGE_RELOC;
+} IMAGE_RELOC, * PIMAGE_RELOC;
 #pragma warning(pop)
 
 static inline size_t
 AlignValueUp(size_t value, size_t alignment) {
 	return (value + alignment - 1) & ~(alignment - 1);
 }
+static inline size_t
+_strlen(char* s) {
+	size_t i;
+	for (i = 0; s[i] != '\0'; i++);
+	return i;
+}
+
+static inline size_t
+_wcslen(wchar_t* s) {
+	size_t i;
+	for (i = 0; s[i] != '\0'; i++);
+	return i;
+}
+
+#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva)
+
+#define FILL_STRING(string, buffer) \
+	string.Length = (USHORT)_strlen(buffer); \
+	string.MaximumLength = string.Length; \
+	string.Buffer = buffer
+
+#define FILL_UNI_STRING(string, buffer) \
+	string.Length = (USHORT)_wcslen(buffer); \
+	string.MaximumLength = string.Length; \
+	string.Buffer = buffer
+
+#define FILL_STRING_WITH_BUF(string, buffer) \
+	string.Length = sizeof(buffer); \
+	string.MaximumLength = string.Length; \
+	string.Buffer = (PCHAR)buffer
 
 ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD nUserdataLen, DWORD flags)
 {
@@ -84,16 +120,22 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 	#pragma warning( disable : 4055 ) // Ignore cast warnings
 
 	// Function pointers
+
+	LDRLOADDLL pLdrLoadDll = NULL;
+	LDRGETPROCADDRESS pLdrGetProcAddress = NULL;
+
 	LOADLIBRARYA pLoadLibraryA = NULL;
-	GETPROCADDRESS pGetProcAddress = NULL;
 	VIRTUALALLOC pVirtualAlloc = NULL;
-	NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL;
+	FLUSHINSTRUCTIONCACHE pFlushInstructionCache = NULL;
 	GETNATIVESYSTEMINFO pGetNativeSystemInfo = NULL;
 	VIRTUALPROTECT pVirtualProtect = NULL;
 	VIRTUALFREE pVirtualFree = NULL;
 	LOCALFREE pLocalFree = NULL;
 	SLEEP pSleep = NULL;
-	/// MESSAGEBOXA pMessageBoxA = NULL;
+	RTLADDFUNCTIONTABLE pRtlAddFunctionTable = NULL;
+
+	//CHAR msg[2] = { 'a','\0' };
+	//MESSAGEBOXA pMessageBoxA = NULL;
 
 	// PE data
 	PIMAGE_NT_HEADERS ntHeaders;
@@ -108,6 +150,7 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 	PIMAGE_BASE_RELOCATION relocation;
 	PIMAGE_RELOC relocList;
 	PIMAGE_EXPORT_DIRECTORY exportDir;
+	PIMAGE_RUNTIME_FUNCTION_ENTRY rfEntry;
 	PDWORD expName;
 	PWORD expOrdinal;
 	LPCSTR expNameStr;
@@ -131,9 +174,26 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 	SYSTEM_INFO sysInfo;
 
 	// General
-	PBYTE libraryAddress;
 	DWORD funcHash;
 	DWORD importCount;
+	HANDLE library;
+
+	// String
+	UNICODE_STRING uString = { 0 };
+	STRING aString = { 0 };
+	
+	WCHAR sKernel32[] = { 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l'};
+
+	// At a certain length (15ish), the compiler with screw with inline
+	// strings declared as CHAR. No idea why, use BYTE to get around it.
+
+	BYTE sSleep[] = { 'S', 'l', 'e', 'e', 'p' };
+	BYTE sLoadLibrary[] = { 'L', 'o', 'a', 'd', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 'A' };
+	BYTE sVirtualAlloc[] = { 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c' };
+	BYTE sVirtualProtect[] = { 'V', 'i', 'r', 't', 'u', 'a', 'l', 'P', 'r', 'o', 't', 'e', 'c', 't' };
+	BYTE sFlushInstructionCache[] = { 'F', 'l', 'u', 's', 'h', 'I', 'n', 's', 't', 'r', 'u', 'c', 't', 'i', 'o', 'n', 'C', 'a', 'c', 'h', 'e' };
+	BYTE sGetNativeSystemInfo[] = { 'G', 'e', 't', 'N', 'a', 't', 'i', 'v', 'e', 'S', 'y', 's', 't', 'e', 'm', 'I', 'n', 'f', 'o' };
+	BYTE sRtlAddFunctionTable[] = { 'R', 't', 'l', 'A', 'd', 'd', 'F', 'u', 'n', 'c', 't', 'i', 'o', 'n', 'T', 'a', 'b', 'l', 'e' };
 
 	// Import obfuscation
 	DWORD randSeed;
@@ -151,17 +211,43 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 	// STEP 1: locate all the required functions
 	///
 
-	pLoadLibraryA = (LOADLIBRARYA)GetProcAddressWithHash(LOADLIBRARYA_HASH);
-	pGetProcAddress = (GETPROCADDRESS)GetProcAddressWithHash(GETPROCADDRESS_HASH);
-	pVirtualAlloc = (VIRTUALALLOC)GetProcAddressWithHash(VIRTUALALLOC_HASH);
-	pVirtualProtect = (VIRTUALPROTECT)GetProcAddressWithHash(VIRTUALPROTECT_HASH);
-	pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)GetProcAddressWithHash(NTFLUSHINSTRUCTIONCACHE_HASH);
-	pGetNativeSystemInfo = (GETNATIVESYSTEMINFO)GetProcAddressWithHash(GETNATIVESYSTEMINFO_HASH);
-	pSleep = (SLEEP)GetProcAddressWithHash(SLEEP_HASH);
-	/// pMessageBoxA = (MESSAGEBOXA)GetProcAddressWithHash(MESSAGEBOXA_HASH);
+	pLdrLoadDll = (LDRLOADDLL)GetProcAddressWithHash(LDRLOADDLL_HASH);
+	pLdrGetProcAddress = (LDRGETPROCADDRESS)GetProcAddressWithHash(LDRGETPROCADDRESS_HASH);
 
-	if (!pLoadLibraryA || !pGetProcAddress || !pVirtualAlloc || !pVirtualProtect || 
-		!pNtFlushInstructionCache || !pGetNativeSystemInfo || !pSleep) {
+	uString.Buffer = sKernel32;
+	uString.MaximumLength = sizeof(sKernel32);
+	uString.Length = sizeof(sKernel32);
+
+	//pMessageBoxA = (MESSAGEBOXA)GetProcAddressWithHash(MESSAGEBOXA_HASH);
+
+	pLdrLoadDll(NULL, 0, &uString, &library);
+
+	FILL_STRING_WITH_BUF(aString, sVirtualAlloc);
+	pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pVirtualAlloc);
+
+	FILL_STRING_WITH_BUF(aString, sVirtualProtect);
+	pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pVirtualProtect);
+
+	FILL_STRING_WITH_BUF(aString, sFlushInstructionCache);
+	pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pFlushInstructionCache);
+
+	FILL_STRING_WITH_BUF(aString, sGetNativeSystemInfo);
+	pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pGetNativeSystemInfo);
+
+	FILL_STRING_WITH_BUF(aString, sSleep);
+	pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pSleep);
+
+	FILL_STRING_WITH_BUF(aString, sRtlAddFunctionTable);
+	pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pRtlAddFunctionTable);
+
+	FILL_STRING_WITH_BUF(aString, sLoadLibrary);
+	pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pLoadLibraryA);
+
+	//FILL_STRING_WITH_BUF(aString, sMessageBox);
+	//pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pMessageBoxA);
+
+	if (!pVirtualAlloc || !pVirtualProtect || !pSleep ||
+		!pFlushInstructionCache || !pGetNativeSystemInfo) {
 		return 0;
 	}
 	
@@ -287,7 +373,7 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 	///
 
 	dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
-	randSeed = (DWORD)dllData;
+	randSeed = (DWORD)((ULONGLONG)dllData);
 
 	if (dataDir->Size) {
 
@@ -315,19 +401,21 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 
 		importDesc = RVA(PIMAGE_IMPORT_DESCRIPTOR, baseAddress, dataDir->VirtualAddress);
 		for (; importDesc->Name; importDesc++) {
-			libraryAddress = (PBYTE)pLoadLibraryA((LPCSTR)(baseAddress + importDesc->Name));
+
+			library = pLoadLibraryA((LPSTR)(baseAddress + importDesc->Name));
+
 			firstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, importDesc->FirstThunk);
 			origFirstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, importDesc->OriginalFirstThunk);
 
-			// iterate through all imported functions, importing by ordinal if no name present
 			for (; origFirstThunk->u1.Function; firstThunk++, origFirstThunk++) {
 
 				if (IMAGE_SNAP_BY_ORDINAL(origFirstThunk->u1.Ordinal)) {
-					firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, (LPCSTR)IMAGE_ORDINAL(origFirstThunk->u1.Ordinal));
+					pLdrGetProcAddress(library, NULL, (WORD)origFirstThunk->u1.Ordinal, (PVOID *)&(firstThunk->u1.Function));
 				}
 				else {
 					importByName = RVA(PIMAGE_IMPORT_BY_NAME, baseAddress, origFirstThunk->u1.AddressOfData);
-					firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, importByName->Name);
+					FILL_STRING(aString, importByName->Name);
+					pLdrGetProcAddress(library, &aString, 0, (PVOID*)&(firstThunk->u1.Function));
 				}
 			}
 
@@ -348,18 +436,19 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 
 		for (; delayDesc->DllNameRVA; delayDesc++) {
 
-			libraryAddress = (PBYTE)pLoadLibraryA((LPCSTR)(baseAddress + delayDesc->DllNameRVA));
+			library = pLoadLibraryA((LPSTR)(baseAddress + delayDesc->DllNameRVA));
+
 			firstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, delayDesc->ImportAddressTableRVA);
 			origFirstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, delayDesc->ImportNameTableRVA);
 
-			// iterate through all imported functions, importing by ordinal if no name present
 			for (; firstThunk->u1.Function; firstThunk++, origFirstThunk++) {
 				if (IMAGE_SNAP_BY_ORDINAL(origFirstThunk->u1.Ordinal)) {
-					firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, (LPCSTR)IMAGE_ORDINAL(origFirstThunk->u1.Ordinal));
+					pLdrGetProcAddress(library, NULL, (WORD)origFirstThunk->u1.Ordinal, (PVOID *)&(firstThunk->u1.Function));
 				}
 				else {
 					importByName = RVA(PIMAGE_IMPORT_BY_NAME, baseAddress, origFirstThunk->u1.AddressOfData);
-					firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, importByName->Name);
+					FILL_STRING(aString, importByName->Name);
+					pLdrGetProcAddress(library, &aString, 0, (PVOID *)&(firstThunk->u1.Function));
 				}
 			}
 		}
@@ -413,10 +502,10 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 	}
 
 	// We must flush the instruction cache to avoid stale code being used
-	pNtFlushInstructionCache((HANDLE)-1, NULL, 0);
+	pFlushInstructionCache((HANDLE)-1, NULL, 0);
 
 	///
-	// STEP 8: execute TLS callbacks
+	// STEP 8: Execute TLS callbacks
 	///
 
 	dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS];
@@ -432,14 +521,28 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD
 	}
 
 	///
-	// STEP 9: call our images entry point
+	// STEP 9: Register exception handlers (x64 only)
+	///
+
+#ifdef _WIN64
+	dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION];
+
+	if (pRtlAddFunctionTable && dataDir->Size)
+	{
+		rfEntry = RVA(PIMAGE_RUNTIME_FUNCTION_ENTRY, baseAddress, dataDir->VirtualAddress);
+		pRtlAddFunctionTable(rfEntry, (dataDir->Size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)) - 1, baseAddress);
+	}
+#endif
+
+	///
+	// STEP 10: call our images entry point
 	///
 
 	dllMain = RVA(DLLMAIN, baseAddress, ntHeaders->OptionalHeader.AddressOfEntryPoint);
 	dllMain((HINSTANCE)baseAddress, DLL_PROCESS_ATTACH, (LPVOID)1);
 
 	///
-	// STEP 10: call our exported function
+	// STEP 11: call our exported function
 	///
 
 	if (dwFunctionHash) {

ShellcodeRDI/ShellcodeRDI.vcxproj

@@ -23,20 +23,20 @@
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>PIC_Bindshell</RootNamespace>
     <ProjectName>ShellcodeRDI</ProjectName>
-    <WindowsTargetPlatformVersion>10.0.15063.0</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
@@ -50,14 +50,14 @@
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>

TestDLL/TestDLL.vcxproj

@@ -22,32 +22,32 @@
     <ProjectGuid>{558D08E4-48B4-4E5F-94E5-5783CF0557C4}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>TestDLL</RootNamespace>
-    <WindowsTargetPlatformVersion>10.0.15063.0</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
@@ -89,6 +89,7 @@
       <Optimization>Disabled</Optimization>
       <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <ExceptionHandling>Async</ExceptionHandling>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -106,6 +107,7 @@
       <Optimization>Disabled</Optimization>
       <PreprocessorDefinitions>_DEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <ExceptionHandling>Async</ExceptionHandling>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -125,6 +127,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <ExceptionHandling>Async</ExceptionHandling>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -146,6 +149,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <PreprocessorDefinitions>NDEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <ExceptionHandling>Async</ExceptionHandling>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>

TestDLL/dllmain.cpp

@@ -24,7 +24,16 @@ BOOL APIENTRY DllMain( HMODULE hModule,
 //extern "C" to prevent C++ name mangling
 extern "C" __declspec(dllexport) BOOL SayGoodbye(LPVOID lpUserdata, DWORD nUserdataLen)
 {
+	try {
+		int i = 0, j = 1;
+		j /= i;   // This will throw a SE (divide by zero).
+	}
+	catch (...) {
+		MessageBoxA(NULL, "C++ Exception Thrown!", "Caught it", 0);
+	}
+
 	MessageBoxA(NULL, "I'm Leaving!", "Goodbye", 0);
+	
 	return TRUE;
 }