From 7e73a4285b3fed444239bf73a4872340c147e379 Mon Sep 17 00:00:00 2001 From: Nick Landers Date: Wed, 31 Jul 2019 12:57:42 -0600 Subject: [PATCH] Fix small offset error in is64BitDll --- DotNet/Program.cs | 2 +- PowerShell/ConvertTo-Shellcode.ps1 | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/DotNet/Program.cs b/DotNet/Program.cs index bff8e41..2692119 100644 --- a/DotNet/Program.cs +++ b/DotNet/Program.cs @@ -467,7 +467,7 @@ namespace RDIShellcodeLoader IntPtr scPointer = scHandle.AddrOfPinnedObject(); Int32 headerOffset = Marshal.ReadInt32(scPointer, 60); - UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, 60 + headerOffset); + UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, headerOffset + 4); if (magic == (UInt16)512 || magic == (UInt16)34404) is64Bit = true; diff --git a/PowerShell/ConvertTo-Shellcode.ps1 b/PowerShell/ConvertTo-Shellcode.ps1 index 2614c20..faca343 100644 --- a/PowerShell/ConvertTo-Shellcode.ps1 +++ b/PowerShell/ConvertTo-Shellcode.ps1 @@ -41,7 +41,7 @@ public class sRDI IntPtr scPointer = scHandle.AddrOfPinnedObject(); Int32 headerOffset = Marshal.ReadInt32(scPointer, 60); - UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, 60 + headerOffset); + UInt16 magic = (UInt16)Marshal.ReadInt16(scPointer, headerOffset + 4); if (magic == (UInt16)512 || magic == (UInt16)34404) is64Bit = true; @@ -51,7 +51,6 @@ public class sRDI return is64Bit; } - public static byte[] ConvertToShellcode(byte[] dllBytes, uint functionHash, byte[] userData, uint flags) { //MARKER:S