Created
September 18, 2024 03:12
-
-
Save hfiref0x/62295f9c05f4a48dd1f782a2a8108b3c to your computer and use it in GitHub Desktop.
GetSystemWow64Directory
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
__int64 __fastcall GetSystemWow64Directory2W(LPWSTR lpBuffer, ULONG Size, WORD ImageFileMachineType) | |
{ | |
const UNICODE_STRING *usSystemDirectory; // rbx | |
UINT sysDirLength; // ecx | |
__int64 result; // rax | |
unsigned int maxLength; // edx | |
_UNICODE_STRING usQueryBuffer; // [rsp+20h] [rbp-18h] BYREF | |
usQueryBuffer = 0i64; | |
if ( Size > 0xFFFF ) | |
LOWORD(Size) = 0xFFFF; | |
usQueryBuffer.Buffer = lpBuffer; | |
usQueryBuffer.MaximumLength = 2 * Size; | |
switch ( ImageFileMachineType ) | |
{ | |
case 1u: | |
usSystemDirectory = &hostDir; // "\\system32" | |
break; | |
case 0x14Cu: | |
usSystemDirectory = &x86Dir; // "\\SysWOW64" | |
break; | |
case 0x1C4u: | |
usSystemDirectory = &armDir; // "\\SysArm32" | |
break; | |
case 0x8664u: | |
usSystemDirectory = &amd64Dir; // "\\SysX8664" | |
break; | |
case 0xAA64u: | |
usSystemDirectory = &arm64Dir; // "\\SysArm64" | |
break; | |
default: | |
RtlSetLastWin32Error(0xA0u); | |
return 0i64; | |
} | |
sysDirLength = GetSystemWindowsDirectoryW(0i64, 0); | |
if ( !sysDirLength ) | |
return 0i64; | |
result = sysDirLength + (usSystemDirectory->Length >> 1); | |
maxLength = usQueryBuffer.MaximumLength >> 1; | |
if ( maxLength < result ) | |
return result; | |
usQueryBuffer.Length = 2 * GetSystemWindowsDirectoryW(usQueryBuffer.Buffer, maxLength); | |
if ( !usQueryBuffer.Length || RtlAppendUnicodeStringToString(&usQueryBuffer, usSystemDirectory) < 0 ) | |
return 0i64; | |
usQueryBuffer.Buffer[usQueryBuffer.Length >> 1] = 0; | |
return usQueryBuffer.Length >> 1; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment