WOW64FS Redirection Bypass

DarrenWhite99 · DarrenWhite99 · commit ef02abbed53d · 2019-02-26T20:20:54.000-08:00
diff --git a/LabTech.psm1 b/LabTech.psm1
@@ -68,7 +68,7 @@ public static extern bool Wow64DisableWow64FsRedirection(ref IntPtr ptr);
 [DllImport("kernel32.dll", SetLastError=true)]
 public static extern bool Wow64RevertWow64FsRedirection(ref IntPtr ptr);
 "@
-        $Kernel32Default = Add-Type -MemberDefinition $MethodSignature -Namespace "Kernel32" -Passthru -Name Wow64RevertWow64FsRedirection
+        $Kernel32Default = Add-Type -MemberDefinition $MethodSignature -Namespace "Kernel32" -Passthru -Name RevertWow64Redirection
         [ref]$defaultptr = New-Object System.IntPtr
         $Result = $Kernel32Default::Wow64RevertWow64FsRedirection($defaultptr)
     }

Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ public static extern bool Wow64DisableWow64FsRedirection(ref IntPtr ptr);`
`68`	`68`	`[DllImport("kernel32.dll", SetLastError=true)]`
`69`	`69`	`public static extern bool Wow64RevertWow64FsRedirection(ref IntPtr ptr);`
`70`	`70`	`"@`
`71`		`- $Kernel32Default = Add-Type -MemberDefinition $MethodSignature -Namespace "Kernel32" -Passthru -Name Wow64RevertWow64FsRedirection`
	`71`	`+ $Kernel32Default = Add-Type -MemberDefinition $MethodSignature -Namespace "Kernel32" -Passthru -Name RevertWow64Redirection`
`72`	`72`	`[ref]$defaultptr = New-Object System.IntPtr`
`73`	`73`	`$Result = $Kernel32Default::Wow64RevertWow64FsRedirection($defaultptr)`
`74`	`74`	`}`