CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-08 15:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Select 64-bit size comparison on Windows PowerShell 5.1

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-21 17:45:17 +09:00
1 parent d1d40b4a25
commit e88d8ec85d
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
scripts/EventLogRecovery.ps1
+1 -1
View File
@@ -59,7 +59,7 @@ function Get-WelaEventRecoveryDefinition {
foreach($state in @($initial.Before,$fresh.Before,$row.After)){Assert-WelaEventRecoveryState $state $Log}
if((Get-WelaRecoveryKey $fresh.Before) -cne (Get-WelaRecoveryKey $row.BeforeWrite)){throw 'Immediate prewrite and final BeforeWrite evidence differ.'}
if($row.After.IsEnabled -ne $fresh.Before.IsEnabled){throw 'Channel enable state changed during original operation.'}
$bytes=if($initial.Desired.SizeMode -ceq 'Exact'){$initial.Desired.MaximumSizeInBytes}else{[math]::Max($fresh.Before.MaximumSizeInBytes,$initial.Desired.MaximumSizeInBytes)}
$bytes=if($initial.Desired.SizeMode -ceq 'Exact'){$initial.Desired.MaximumSizeInBytes}else{[math]::Max([long]$fresh.Before.MaximumSizeInBytes,[long]$initial.Desired.MaximumSizeInBytes)}
$mode=if($null -ne $initial.Desired.LogMode){$initial.Desired.LogMode}else{$fresh.Before.LogMode}
if($row.After.MaximumSizeInBytes -ne $bytes -or $row.After.LogMode -cne $mode){throw 'Final state includes unexplained drift beyond the original size/mode write.'}
$expected=Get-WelaEventRecoveryPair $row.After;$recover=Get-WelaEventRecoveryPair $fresh.Before