rapid7/metasploit-framework — pull request #778 by sempervictus (2012-09-10 05:26:44+00:00)
Title: Add PE injection to WIN64

Initial commit of in-mem-exe.c modifications for Windows x64.
Initial boolean wrapper checks to see if the image supplied is a
valid 64bit PE and calls a 64bit injection function. wow64 not yet
implemented.

64bit execution is a bit tricky since we can't get the entrypoint
of the existing thread from ThreadContext.Eax and we need to make
sure that our images are properly aligned. The 64 bit mapper is
based on MemExec64 source code by Steve10120 [at] icode.org.

TODO: Write wow64 based injector. Write conditional to check that
source and destination images are the same architecture and call
the arch appropriate injection method. Test, lots.