loadlib.ps1

function Invoke-LoadLibrary {
<#
.SYNOPSIS

Loads a DLL into the current PowerShell process.

Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None

.DESCRIPTION

Invoke-LoadLibrary is a simple wrapper for kernel32!LoadLibrary
designed primarily for malware analysis the output of which can be
consumed by New-DllExportFunction.

.PARAMETER FileName

Specifies the name of the module to load. If the string specifies a
relative path or a module name without a path, the function uses a
standard search strategy to find the module. See the MSDN
documentation on LoadLibrary for more information on DLL search
paths.

.EXAMPLE

Invoke-LoadLibrary -FileName C:\temp\evil.dll

.EXAMPLE

'kernel32', 'ntdll' | Invoke-LoadLibrary

.INPUTS

System.String

Invoke-LoadLibrary accepts one or more module names to load over the
pipeline.

.OUTPUTS

System.Diagnostics.ProcessModule
#>

    [OutputType([Diagnostics.ProcessModule])]
    [CmdletBinding()]
    Param (
        [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $FileName
    )

    BEGIN {
        $SafeNativeMethods = $null
        $LoadLibrary = $null

        # System.Uri and Microsoft.Win32.SafeNativeMethods are both
        # contained within System.dll. [Uri] is public though.
        # Microsoft.Win32.SafeNativeMethods is a NonPublic class.
        $UnmanagedClass = 'Microsoft.Win32.SafeNativeMethods'
        $SafeNativeMethods = [Uri].Assembly.GetType($UnmanagedClass)

        # Perform additional error handling since we're borrowing LoadLibrary
        # from a NonPublic class. Technically, Microsoft could change this
        # interface at any time.
        if ($SafeNativeMethods -eq $null) {
            throw 'Unable to get a reference to the ' +
                  'Microsoft.Win32.SafeNativeMethods within System.dll.'
        }

        $LoadLibrary = $SafeNativeMethods.GetMethod('LoadLibrary')

        if ($LoadLibrary -eq $null) {
            throw 'Unable to get a reference to LoadLibrary within' +
                  'Microsoft.Win32.SafeNativeMethods.'
        }
    }

    PROCESS {
        $LoadedModuleInfo = $null

        $LibAddress = $LoadLibrary.Invoke($null, @($FileName))
        $Exception = [Runtime.InteropServices.Marshal]::GetLastWin32Error()

        if ($LibAddress -eq [IntPtr]::Zero) {
            $Exception = New-Object ComponentModel.Win32Exception($Exception)
            throw $Exception.Message
        }

        $IntPtrPrintWidth = "X$([IntPtr]::Size * 2)"

        Write-Verbose "$FileName loaded at 0x$(($LibAddress).ToString($IntPtrPrintWidth))"

        $CurrentProcess = Get-Process -Id $PID

        $LoadedModuleInfo = $CurrentProcess.Modules |
            Where-Object { $_.BaseAddress -eq $LibAddress }

        if ($LoadedModuleInfo -eq $null) {
            throw 'Unable to obtain loaded module information for ' +
                "$FileName. The module was likely already unloaded."
        }

        return $LoadedModuleInfo
    }
}

function New-DllExportFunction {
<#
.SYNOPSIS

Creates an executable wrapper delegate around an unmanaged, exported
function.

Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: Invoke-LoadLibrary

.DESCRIPTION

New-DllExportFunction accepts a module, exported procedure name, a
return type, and parameter types, and creates a managed delegate that
can be used to execute the unmanaged function.

.PARAMETER Module

Specifies the module that contains the desired exported procedure.
The Module parameter accepts a System.Diagnostics.ProcessModule
object which can be obtained by calling Get-Process and filtering out
the 'Modules' property or by calling Invoke-LoadLibrary.

.PARAMETER ProcedureName

Specifies the exported procedure name. Note, for functions that
accept wide or ascii strings, you must specify which variant you want
to call - e.g. CreateFileA vs. CreateFileW.

.PARAMETER Parameters

Specifies the managed parameter types of the function. pinvoke.net is
a good reference for mapping managed to unmanaged types. This
argument may be left empty if the function doesn't accept any
arguments.

.PARAMETER ReturnType

Specifies the managed return type of the function. pinvoke.net is
a good reference for mapping managed to unmanaged types. This
argument may be left empty if the function doesn't has a void return
type.

.EXAMPLE

C:\PS>$Kernel32 = Invoke-LoadLibrary -FileName kernel32
C:\PS>$MulDiv = New-DllExportFunction -Module $Kernel32 -ProcedureName MulDiv -Parameters ([Int], [Int], [Int]) -ReturnType ([Int])
C:\PS>$MulDiv.Invoke(2, 3, 1)

.EXAMPLE

C:\PS>$Kernel32 = Invoke-LoadLibrary -FileName kernel32
C:\PS>$IsWow64Process = New-DllExportFunction -Module $Kernel32 -ProcedureName IsWow64Process -Parameters ([IntPtr], [Bool].MakeByRefType()) -ReturnType ([Bool])
C:\PS>$bIsWow64Process = $False
C:\PS>$IsWow64Process.Invoke((Get-Process -Id $PID).Handle, [Ref] $bIsWow64Process)

.EXAMPLE

C:\PS>$Ntdll = Get-Process -Id $PID | Select-Object -ExpandProperty Modules | Where-Object { $_.ModuleName -eq 'ntdll.dll' }
C:\PS>$RtlGetCurrentPeb = New-DllExportFunction -Module $Ntdll -ProcedureName RtlGetCurrentPeb -ReturnType ([IntPtr])
C:\PS>$RtlGetCurrentPeb.Invoke()

.OUTPUTS

System.Delegate
#>

    [OutputType([Delegate])]
    Param (
        [Parameter(Mandatory = $True)]
        [Diagnostics.ProcessModule]
        [ValidateNotNull()]
        $Module,

        [Parameter(Mandatory = $True)]
        [String]
        [ValidateNotNullOrEmpty()]
        $ProcedureName,

        [Type[]]
        $Parameters = (New-Object Type[](0)),

        [Type]
        $ReturnType = [Void]
    )

    function Local:Get-DelegateType
    {
        [OutputType([Type])]
        Param (    
            [Parameter( Position = 0)]
            [Type[]]
            $Parameters = (New-Object Type[](0)),
            
            [Parameter( Position = 1 )]
            [Type]
            $ReturnType = [Void]
        )

        $Domain = [AppDomain]::CurrentDomain
        $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')
        $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
        $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $False)
        $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
        $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
        $ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
        $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
        $MethodBuilder.SetImplementationFlags('Runtime, Managed')
        
        return $TypeBuilder.CreateType()
    }

    function Local:Get-ProcAddress
    {
        [OutputType([IntPtr])]
        Param (
            [Parameter( Position = 0, Mandatory = $True )]
            [Diagnostics.ProcessModule]
            $Module,
            
            [Parameter( Position = 1, Mandatory = $True )]
            [String]
            $ProcedureName
        )

        $UnsafeNativeMethods = $null
        $GetProcAddress = $null

        # System.Uri and Microsoft.Win32.UnsafeNativeMethods are both
        # contained within System.dll. [Uri] is public though.
        # Microsoft.Win32.UnsafeNativeMethods is a NonPublic class.
        $UnmanagedClass = 'Microsoft.Win32.UnsafeNativeMethods'
        $UnsafeNativeMethods = [Uri].Assembly.GetType($UnmanagedClass)

        # Perform additional error handling since we're borrowing GetProcAddress
        # from a NonPublic class. Technically, Microsoft could change this
        # interface at any time.
        if ($UnsafeNativeMethods -eq $null) {
            throw 'Unable to get a reference to the ' +
                  'Microsoft.Win32.UnsafeNativeMethods within System.dll.'
        }

        $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')

        if ($GetProcAddress -eq $null) {
            throw 'Unable to get a reference to GetProcAddress within' +
                  'Microsoft.Win32.UnsafeNativeMethods.'
        }

        $TempPtr = New-Object IntPtr
        $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($TempPtr, $Module.BaseAddress)
        
        $ProcAddr = $GetProcAddress.Invoke($null, @([Runtime.InteropServices.HandleRef] $HandleRef, $ProcedureName))

        if ($ProcAddr -eq [IntPtr]::Zero) {
            Write-Error "Unable to obtain the address of $($Module.ModuleName)!$ProcedureName. $ProcedureName is likely not exported."

            return [IntPtr]::Zero
        }

        return $ProcAddr
    }

    $ProcAddress = Get-ProcAddress -Module $Module -ProcedureName $ProcedureName

    if ($ProcAddress -ne [IntPtr]::Zero) {
        $IntPtrPrintWidth = "X$([IntPtr]::Size * 2)"

        Write-Verbose "$($Module.ModuleName)!$ProcedureName address: 0x$(($ProcAddress).ToString($IntPtrPrintWidth))"
    
        $DelegateType = Get-DelegateType -Parameters $Parameters -ReturnType $ReturnType
        $ProcedureDelegate = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ProcAddress, $DelegateType)

        return $ProcedureDelegate
    }
}