Fixed architecture detection bug in Get-PEB

Matt Graeber · Matt Graeber · commit 6e5338c8a34a · 2013-05-31T18:56:57.000-04:00
I was checking processor architecture when I should have been checking
OS architecture.
diff --git a/ReverseEngineering/Get-PEB.ps1 b/ReverseEngineering/Get-PEB.ps1
@@ -174,7 +174,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx
             return
         }
 
-        $OSArchitecture = (Get-WmiObject Win32_Processor).DataWidth
+        $OSArchitecture = [Int](Get-WmiObject Win32_OperatingSystem).OSArchitecture.Split('-')[0]
 
         try { $NativeUtils = [NativeUtils] } catch [Management.Automation.RuntimeException] # Only build the assembly if it hasn't already been defined
         {

Original file line number	Diff line number	Diff line change
`@@ -174,7 +174,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx`
`174`	`174`	`return`
`175`	`175`	`}`
`176`	`176`
`177`		`- $OSArchitecture = (Get-WmiObject Win32_Processor).DataWidth`
	`177`	`+ $OSArchitecture = [Int](Get-WmiObject Win32_OperatingSystem).OSArchitecture.Split('-')[0]`
`178`	`178`
`179`	`179`	`try { $NativeUtils = [NativeUtils] } catch [Management.Automation.RuntimeException] # Only build the assembly if it hasn't already been defined`
`180`	`180`	`{`