This repository was archived by the owner on Jan 21, 2021. It is now read-only.
File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -193,7 +193,7 @@ Warning: This script has no way to validate that your shellcode is 32 vs. 64-bit
193193
194194 $IsWow64 = $false
195195
196- if ($64bitCPU ) # Only perform theses checks if CPU is 64-bit
196+ if ($64bitOS ) # Only perform theses checks if CPU is 64-bit
197197 {
198198 # Determine if the process specified is 32 or 64 bit
199199 $IsWow64Process.Invoke ($hProcess , [Ref ] $IsWow64 ) | Out-Null
@@ -376,16 +376,29 @@ Warning: This script has no way to validate that your shellcode is 32 vs. 64-bit
376376 # A valid pointer to IsWow64Process will be returned if CPU is 64-bit
377377 $IsWow64ProcessAddr = Get-ProcAddress kernel32.dll IsWow64Process
378378
379- if ( $IsWow64ProcessAddr )
380- {
381- $IsWow64ProcessDelegate = Get-DelegateType @ ([ IntPtr ] , [ Bool ].MakeByRefType()) ([ Bool ])
382- $IsWow64Process = [ System.Runtime.InteropServices.Marshal ]::GetDelegateForFunctionPointer( $IsWow64ProcessAddr , $IsWow64ProcessDelegate )
383-
384- $64bitCPU = $true
379+ $AddressWidth = $null
380+
381+ try {
382+ $AddressWidth = @ ( Get-WmiObject - Query ' SELECT AddressWidth FROM Win32_Processor ' )[ 0 ] | Select-Object - ExpandProperty AddressWidth
383+ } catch {
384+ throw ' Unable to determine OS processor address width. '
385385 }
386- else
387- {
388- $64bitCPU = $false
386+
387+ switch ($AddressWidth ) {
388+ ' 32' {
389+ $64bitOS = $False
390+ }
391+
392+ ' 64' {
393+ $64bitOS = $True
394+
395+ $IsWow64ProcessDelegate = Get-DelegateType @ ([IntPtr ], [Bool ].MakeByRefType()) ([Bool ])
396+ $IsWow64Process = [System.Runtime.InteropServices.Marshal ]::GetDelegateForFunctionPointer($IsWow64ProcessAddr , $IsWow64ProcessDelegate )
397+ }
398+
399+ default {
400+ throw ' Invalid OS address width detected.'
401+ }
389402 }
390403
391404 if ([IntPtr ]::Size -eq 4 )
You can’t perform that action at this time.
0 commit comments