rapid7/meterpreter — pull request #1 by sempervictus (2012-12-14 16:37:43+00:00)
Title: This commit adds in-memory substitution for x64

Wrapper checks to see if the image supplied is avalid 64bit PE,
then calls a 64bit injection function. wow64 not yet
implemented.

64bit execution is a bit tricky since we can't get the entrypoint
of the existing thread from ThreadContext.Eax and we need to make
sure that our images are properly aligned. The 64 bit mapper is
based on MemExec64 source code by Steve10120 [at] icode.org.

TODO:
Write wow64 based injector. Write conditional to check that
source and destination images are the same architecture and call
the arch appropriate injection method.
Write "Heaven's Gate" based injector for running x86 process in
x64 space.