From 7c6eb8173dd86efc9b30f9f9d53ea25f6f273519 Mon Sep 17 00:00:00 2001 From: John Lambert Date: Wed, 8 Dec 2021 08:26:18 -0800 Subject: [PATCH] Update CredGuard.c --- EDRSandblast/LSASSProtectionBypass/CredGuard.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/EDRSandblast/LSASSProtectionBypass/CredGuard.c b/EDRSandblast/LSASSProtectionBypass/CredGuard.c index e20d91c..277c764 100644 --- a/EDRSandblast/LSASSProtectionBypass/CredGuard.c +++ b/EDRSandblast/LSASSProtectionBypass/CredGuard.c @@ -54,7 +54,7 @@ DWORD WINAPI disableCredGuardByPatchingLSASS(void) { BOOL returnStatus = FALSE; TCHAR szModulename[MAX_PATH]; for (DWORD i = 0; i < (lpcbNeeded / sizeof(HMODULE)); i++) { - if (hModulesArray[i] && !GetModuleFileNameEx(hLsass, hModulesArray[i], szModulename, MAX_PATH)) { + if (hModulesArray[i] && !GetModuleFileNameEx(hLsass, hModulesArray[i], szModulename, _countof(szModulename))) { _tprintf(TEXT("[!] Cred Guard bypass non fatal error: couldn't get module name for module at index 0x%lx (GetModuleFileNameEx, error code 0x%lx)\n"), i, GetLastError()); continue; }