Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 7f6d3a4

Browse files
committed
Fix Invoke-Shellcode OS architecture detection
Fixes issue #70
1 parent 93a71b0 commit 7f6d3a4

1 file changed

Lines changed: 23 additions & 10 deletions

File tree

CodeExecution/Invoke-Shellcode.ps1

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ Warning: This script has no way to validate that your shellcode is 32 vs. 64-bit
193193

194194
$IsWow64 = $false
195195

196-
if ($64bitCPU) # Only perform theses checks if CPU is 64-bit
196+
if ($64bitOS) # Only perform theses checks if CPU is 64-bit
197197
{
198198
# Determine if the process specified is 32 or 64 bit
199199
$IsWow64Process.Invoke($hProcess, [Ref] $IsWow64) | Out-Null
@@ -376,16 +376,29 @@ Warning: This script has no way to validate that your shellcode is 32 vs. 64-bit
376376
# A valid pointer to IsWow64Process will be returned if CPU is 64-bit
377377
$IsWow64ProcessAddr = Get-ProcAddress kernel32.dll IsWow64Process
378378

379-
if ($IsWow64ProcessAddr)
380-
{
381-
$IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
382-
$IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate)
383-
384-
$64bitCPU = $true
379+
$AddressWidth = $null
380+
381+
try {
382+
$AddressWidth = @(Get-WmiObject -Query 'SELECT AddressWidth FROM Win32_Processor')[0] | Select-Object -ExpandProperty AddressWidth
383+
} catch {
384+
throw 'Unable to determine OS processor address width.'
385385
}
386-
else
387-
{
388-
$64bitCPU = $false
386+
387+
switch ($AddressWidth) {
388+
'32' {
389+
$64bitOS = $False
390+
}
391+
392+
'64' {
393+
$64bitOS = $True
394+
395+
$IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
396+
$IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate)
397+
}
398+
399+
default {
400+
throw 'Invalid OS address width detected.'
401+
}
389402
}
390403

391404
if ([IntPtr]::Size -eq 4)

0 commit comments

Comments
 (0)