Skip to content

Instantly share code, notes, and snippets.

@hfiref0x
Created September 18, 2024 03:12
Show Gist options
  • Save hfiref0x/62295f9c05f4a48dd1f782a2a8108b3c to your computer and use it in GitHub Desktop.
Save hfiref0x/62295f9c05f4a48dd1f782a2a8108b3c to your computer and use it in GitHub Desktop.
GetSystemWow64Directory
__int64 __fastcall GetSystemWow64Directory2W(LPWSTR lpBuffer, ULONG Size, WORD ImageFileMachineType)
{
const UNICODE_STRING *usSystemDirectory; // rbx
UINT sysDirLength; // ecx
__int64 result; // rax
unsigned int maxLength; // edx
_UNICODE_STRING usQueryBuffer; // [rsp+20h] [rbp-18h] BYREF
usQueryBuffer = 0i64;
if ( Size > 0xFFFF )
LOWORD(Size) = 0xFFFF;
usQueryBuffer.Buffer = lpBuffer;
usQueryBuffer.MaximumLength = 2 * Size;
switch ( ImageFileMachineType )
{
case 1u:
usSystemDirectory = &hostDir; // "\\system32"
break;
case 0x14Cu:
usSystemDirectory = &x86Dir; // "\\SysWOW64"
break;
case 0x1C4u:
usSystemDirectory = &armDir; // "\\SysArm32"
break;
case 0x8664u:
usSystemDirectory = &amd64Dir; // "\\SysX8664"
break;
case 0xAA64u:
usSystemDirectory = &arm64Dir; // "\\SysArm64"
break;
default:
RtlSetLastWin32Error(0xA0u);
return 0i64;
}
sysDirLength = GetSystemWindowsDirectoryW(0i64, 0);
if ( !sysDirLength )
return 0i64;
result = sysDirLength + (usSystemDirectory->Length >> 1);
maxLength = usQueryBuffer.MaximumLength >> 1;
if ( maxLength < result )
return result;
usQueryBuffer.Length = 2 * GetSystemWindowsDirectoryW(usQueryBuffer.Buffer, maxLength);
if ( !usQueryBuffer.Length || RtlAppendUnicodeStringToString(&usQueryBuffer, usSystemDirectory) < 0 )
return 0i64;
usQueryBuffer.Buffer[usQueryBuffer.Length >> 1] = 0;
return usQueryBuffer.Length >> 1;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment