diff --git a/DotNet/Program.cs b/DotNet/Program.cs index bff8e41..2692119 100644 --- a/DotNet/Program.cs +++ b/DotNet/Program.cs @@ -467,7 +467,7 @@ namespace RDIShellcodeLoader IntPtr scPointer = scHandle.AddrOfPinnedObject(); Int32 headerOffset = Marshal.ReadInt32(scPointer, 60); - UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, 60 + headerOffset); + UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, headerOffset + 4); if (magic == (UInt16)512 || magic == (UInt16)34404) is64Bit = true; diff --git a/PowerShell/ConvertTo-Shellcode.ps1 b/PowerShell/ConvertTo-Shellcode.ps1 index 2614c20..faca343 100644 --- a/PowerShell/ConvertTo-Shellcode.ps1 +++ b/PowerShell/ConvertTo-Shellcode.ps1 @@ -41,7 +41,7 @@ public class sRDI IntPtr scPointer = scHandle.AddrOfPinnedObject(); Int32 headerOffset = Marshal.ReadInt32(scPointer, 60); - UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, 60 + headerOffset); + UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, headerOffset + 4); if (magic == (UInt16)512 || magic == (UInt16)34404) is64Bit = true; @@ -51,7 +51,6 @@ public class sRDI return is64Bit; } - public static byte[] ConvertToShellcode(byte[] dllBytes, uint functionHash, byte[] userData, uint flags) { //MARKER:S