So we have 4 approaches to get bitness of windows
1.Hasherezade dedected an approach from the malware kronos. Interestingly cs returns 5 bit value when OS is 32bit and 6bit when OS is 64bit. So by checking the 6th bit from right to left you can dedect the bitness of operating system.
;hasherezade's apprach from kronos malware:
invoke StdOut, chr$("[ 1 ] hasherezade's apprach from kronos malware:",13,10)
invoke is_system64_bit
.if Zero?
print chr$("[ + ] 32-bit",13,10)
.else
print chr$("[ + ] 64-bit",13,10)
.endif
invoke StdOut, chr$(13,10,)
is_system64_bit PROC
; _______________________________________________________________________________
; Is your OS 64bit or not procedure
; Author : hasherezade - https://gist.github.com/hasherezade/0994447e9d3dc184888fb2afd5a57301
; Receives :
; Returns : eax > 0 = 64-bit
; ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
LOCAL flag:DWORD
xor eax, eax
mov ax, cs
shr eax, 5
mov flag, eax
.IF flag > 0
mov eax, TRUE
.ELSE
mov eax, FALSE
.ENDIF
ret
is_system64_bit ENDP
2. Checking the existance of C:\Windows\SysWow64 we can dedect the bit level of windows.
; Check if there is C:\Windows\SysWow64 directory:
print chr$("[ 2 ] SysWow64 directory exists?",13,10)
.if fexist("C:\Windows\SysWow64")
print chr$("[ + ] 64-bit",13,10)
.else
print chr$("[ + ] 32-bit",13,10)
.endif
invoke StdOut, chr$(13,10)
3. IsWow64ProcessAPI return value if the OS is running WOW64 or not.
; IsWow64ProcessAPI checks our OS runs WOW64:
print cfm$("[ 3 ] Query bitness with IsWow64Process APIs:\n")
xchg ebx, rv(GetProcAddress, rv(GetModuleHandle, "kernel32") , "IsWow64Process")
.if ebx
print "[ + ] IsWow64Process found: retval="
push eax
invoke IsWow64Process, rv(GetCurrentProcess), esp
pop ecx
mov bayrakIsWow64,cl
print str$(ecx),13,10
.if bayrakIsWow64==1
print chr$("[ + ] 64-bit",13,10)
.else
print chr$("[ + ] 32-bit",13,10)
.endif
.else
print "[ + ] IsWow64Process not found", 13, 10, 10
.endif
invoke StdOut, chr$(13,10)
4. Using GetNativeSystemInfo API with SYSTEM_INFO structure we can dedect our "installed operating systems processor type"
;05 GetNativeSystemInfo returns info to SYSTEM_INFO structure:
print cfm$("[ 4 ] Query bitness of OS with GetNativeSystemInfo API:\n")
mov ebx, offset sysinf
invoke GetNativeSystemInfo,ebx
cmp [ebx.SYSTEM_INFO.wProcessorArchitecture], PROCESSOR_ARCHITECTURE_AMD64
.if Zero?
print chr$("[ + ] 64-bit",13,10)
.else
print chr$("[ + ] 32-bit",13,10)
.endif
I add my sources; tested positive on vm/rm win10 x64 and vm win7 x86
@jj2007
You had shared 2 macros, but i have used the functions inside the macros in my sources. How can we use these macros inside the code as macros? I got error :/
