Fixed FreeLibrary function signature #146

The parameter type and return types were accidentally transposed. Thanks @rojaster for pointing this out.
PowerShellMafia · May 29, 2016 · 6b0ada9 · 6b0ada9
1 parent 83305c5
commit 6b0ada9
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/CodeExecution/Invoke-ReflectivePEInjection.ps1 b/CodeExecution/Invoke-ReflectivePEInjection.ps1
@@ -648,7 +648,7 @@ $RemoteScriptBlock = {
 		$Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle
 
 		$FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary
-		$FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr])
+		$FreeLibraryDelegate = Get-DelegateType @([IntPtr]) ([Bool])
 		$FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)
 		$Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary
 

diff --git a/Exfiltration/Invoke-CredentialInjection.ps1 b/Exfiltration/Invoke-CredentialInjection.ps1
@@ -771,7 +771,7 @@ function Invoke-CredentialInjection
 		    $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle
 
 		    $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary
-		    $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr])
+		    $FreeLibraryDelegate = Get-DelegateType @([IntPtr]) ([Bool])
 		    $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)
 		    $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary
 

diff --git a/Exfiltration/Invoke-Mimikatz.ps1 b/Exfiltration/Invoke-Mimikatz.ps1
@@ -540,7 +540,7 @@ $RemoteScriptBlock = {
 		$Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle
 
 		$FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary
-		$FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr])
+		$FreeLibraryDelegate = Get-DelegateType @([IntPtr]) ([Bool])
 		$FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)
 		$Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary
 

diff --git a/Exfiltration/Invoke-NinjaCopy.ps1 b/Exfiltration/Invoke-NinjaCopy.ps1
@@ -572,7 +572,7 @@ $RemoteScriptBlock = {
 		$Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle
 
 		$FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary
-		$FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr])
+		$FreeLibraryDelegate = Get-DelegateType @([IntPtr]) ([Bool])
 		$FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)
 		$Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary