T3nb3w-ComDotNetExploit/Bypass_COM_PPL/dotnet_interop.cpp

// dotnet_interop.cpp
#include "dotnet_interop.h"

long GetSafeArrayLen(LPSAFEARRAY psa) {
    long ubound = 0;
    SafeArrayGetUBound(psa, 1, &ubound);
    return ubound + 1;
}

mscorlib::_MethodInfoPtr DotNetInterop::GetStaticMethod(mscorlib::_TypePtr type, LPCWSTR methodName, int pcount) {
 
	LPSAFEARRAY methods = type->GetMethods_2();
	mscorlib::_MethodInfoPtr ret;
	LONG methodCount = GetSafeArrayLen(methods);

	for (long i = 0; i < methodCount; ++i)
	{
		IUnknown* v = nullptr;

		if (SUCCEEDED(SafeArrayGetElement(methods, &i, &v)))
		{
			mscorlib::_MethodInfoPtr method = v;
			bstr_t name = method->Getname();
			LPSAFEARRAY params = method->GetParameters();
			long paramCount = GetSafeArrayLen(params);

			if (method->IsStatic && wcscmp(name.GetBSTR(), methodName) == 0 && paramCount == pcount)
			{
					ret = method;
					break;
			}
		}
	}

	SafeArrayDestroy(methods);

	return ret;
 }

mscorlib::_MethodInfoPtr DotNetInterop::GetStaticMethodLoad(mscorlib::_TypePtr type, LPCWSTR methodName, int pcount) {

	LPSAFEARRAY methods = type->GetMethods_2();
	mscorlib::_MethodInfoPtr ret;
	LONG methodCount = GetSafeArrayLen(methods);
	int choose = 0;
	for (long i = 0; i < methodCount; ++i)
	{
		IUnknown* v = nullptr;

		if (SUCCEEDED(SafeArrayGetElement(methods, &i, &v)))
		{
			mscorlib::_MethodInfoPtr method = v;
			bstr_t name = method->Getname();
			LPSAFEARRAY params = method->GetParameters();
			long paramCount = GetSafeArrayLen(params);

			if (method->IsStatic && wcscmp(name.GetBSTR(), methodName) == 0 && paramCount == pcount)
			{
				if (choose == 2)
				{
					ret = method;
					
					break;
				}
				choose += 1;

			}
			
		}
	}

	SafeArrayDestroy(methods);

	return ret;
}