From e40b9fb2ffaf91c11e167f6691738cc523eb9717 Mon Sep 17 00:00:00 2001
From: hakril <project@hakril.net>
Date: Thu, 8 Mar 2018 22:45:26 +0100
Subject: [PATCH] Add quick POC of ICallInterceptor to COM samples

---
 samples/com/icallinterceptor.py | 58 +++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 samples/com/icallinterceptor.py

diff --git a/samples/com/icallinterceptor.py b/samples/com/icallinterceptor.py
new file mode 100644
index 0000000..c773e03
--- /dev/null
+++ b/samples/com/icallinterceptor.py
@@ -0,0 +1,58 @@
+import windows
+import windows.generated_def as gdef
+from windows import winproxy
+
+# POC of ICallInterceptor
+# Based on works by Pavel Yosifovich
+# http://blogs.microsoft.co.il/pavely/2018/02/28/intercepting-com-objects-with-cogetinterceptor/
+
+# TODO: clean / comment
+
+windows.com.init()
+
+target = gdef.INetFwPolicy2
+
+fakefirewall = gdef.INetFwPolicy2()
+
+interceptor = gdef.ICallInterceptor()
+
+winproxy.CoGetInterceptor(target.IID, None, interceptor.IID, interceptor)
+
+real_firewall = windows.system.network.firewall
+
+class MySink(windows.com.COMImplementation):
+    IMPLEMENT = gdef.ICallFrameEvents
+
+    def OnCall(self, this, frame):
+        this = gdef.ICallFrameEvents(this) # TODO: auto-translate this ?
+        frame = gdef.ICallFrame(frame)
+        print(this)
+        print(frame)
+        name = gdef.PWSTR()
+        name2 = gdef.PWSTR()
+        frame.GetNames(name, name2)
+        stack = frame.GetStackLocation()
+        print(name)
+        print(name2)
+        x = gdef.CALLFRAMEPARAMINFO()
+        ci = gdef.CALLFRAMEINFO()
+        y = windows.com.ImprovedVariant()
+        frame.GetParamInfo(1, x)
+        frame.GetParam(1, y)
+        frame.GetInfo(ci)
+        windows.utils.sprint(x)
+        # vbool = windows.current_process.read_dword(stack + 8)
+        # You can use this to call the real function :)
+        frame.Invoke(real_firewall)
+        frame.SetReturnValue(1234)
+        print("COM COM MON PYTHON :D")
+        return 0
+
+xsink = MySink()
+interceptor.RegisterSink(xsink)
+interceptor.QueryInterface(fakefirewall.IID, fakefirewall)
+
+enabled = gdef.VARIANT_BOOL()
+res = fakefirewall.get_FirewallEnabled(2, enabled)
+print("return value = {0}".format(res))
+print("enabled = {0}".format(enabled))
\ No newline at end of file