Skip to content

Commit f5d9b25

Browse files
author
Matt Graeber
committed
Invoke-DllInjection detects OS arch on all OSes
This fix addresses issue PowerShellMafia#99. While I'm not the biggest fan of performing tests based on environment variables, I felt that making additional Win32 API calls would have been overkill.
1 parent ef37a13 commit f5d9b25

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

CodeExecution/Invoke-DllInjection.ps1

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -224,12 +224,10 @@ http://www.exploit-monday.com
224224
$PowerShell32bit = $False
225225
}
226226

227-
$OSArchitecture = (Get-WmiObject Win32_OperatingSystem).OSArchitecture
228-
229-
switch ($OSArchitecture)
230-
{
231-
'32-bit' { $64bitOS = $False }
232-
'64-bit' { $64bitOS = $True }
227+
if (${Env:ProgramFiles(x86)}) {
228+
$64bitOS = $True
229+
} else {
230+
$64bitOS = $False
233231
}
234232

235233
# The address for IsWow64Process will be returned if and only if running on a 64-bit CPU. Otherwise, Get-ProcAddress will return $null.

0 commit comments

Comments
 (0)