From 109f4982f2b9bea4c13f5eb290d17c99cd03426d Mon Sep 17 00:00:00 2001
From: Winslow <33692631+senzee1984@users.noreply.github.com>
Date: Mon, 22 Jan 2024 23:44:55 -0500
Subject: [PATCH] Create approach.md

---
 approach.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 approach.md

diff --git a/approach.md b/approach.md
new file mode 100644
index 0000000..5a67ed1
--- /dev/null
+++ b/approach.md
@@ -0,0 +1,51 @@
+## Native PE
+### Exception Handle: Easy
+```c
+if (ExcepDir.Size!=0)
+{
+      PIMAGE_RUNTIME_FUNCTION_ENTRY pImgRuntimeFuncEntry = (PIMAGE_RUNTIME_FUNCTION_ENTRY)(pPeBaseAddress + pPeHdrs->pEntryExceptionDataDir->VirtualAddress);
+      if (!RtlAddFunctionTable(pImgRuntimeFuncEntry, (pPeHdrs->pEntryExceptionDataDir->Size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)), pPeBaseAddress)) {
+            PRINT_WINAPI_ERR("RtlAddFunctionTable");
+      }
+}
+```
+### TLS Callback: Easy
+```c
+if (TLSDir.SizeSize!=)
+{
+      PIMAGE_TLS_DIRECTORY    pImgTlsDirectory        = (PIMAGE_TLS_DIRECTORY)(pPeBaseAddress + pPeHdrs->pEntryTLSDataDir->VirtualAddress);
+      PIMAGE_TLS_CALLBACK*    pImgTlsCallback         = (PIMAGE_TLS_CALLBACK*)(pImgTlsDirectory->AddressOfCallBacks);
+      for (int i = 0; pImgTlsCallback[i] != NULL; i++){
+            pImgTlsCallback[i]((LPVOID)pPeBaseAddress, DLL_PROCESS_ATTACH, NULL);
+      }
+}
+```
+
+### Command Line Support: Hard
+
+### DLL Support: Easy (check file type)
+
+### Export Function Support: Medium
+
+### (Optional)x86 support: Medium
+
+### (Optional)Delay Import: Hard
+
+### (Optional)Function Patch: Medium
+
+
+## Managed PE
+Needed module: `mscoree`
+
+Needed functions: `CLRCreateInstane/CorBindToRuntime`, `GetRuntime`, `GetInterface`, `IsLoadable`, `Start`, `ExecuteInDefaultAppDomain` 
+
+Optional functions: `GetDefaultDomain`, `CreateDomain`, `UnloadDomain`, `Stop`, `Release`, etc.
+
+
+
+
+## (Optional)Script
+Needed interfaces: IActiveScriptSite, IActiveScriptSiteWindowVtbl, IHostVtbl, IActiveScriptParse
+
+Needed functions: CoInitializeEx, CoCreateInstance, QueryInterface,  InitNew, SetScriptSite, AddNamedItem, ParseScriptText, SetScriptState
+- VBA, JS, Powershell