admin/nbaertsch-COMegon
1
0
Fork 0
mirror of https://github.com/nbaertsch/COMegon synced 2026-08-09 12:57:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: add .gitignore, remove build artifacts

Browse Source 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
nbaertsch
2026-06-04 20:05:02 -04:00
co-authored by Copilot
parent c7788028c1
commit ce247b4c7f
19 changed files with 6 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+6
View File
@@ -0,0 +1,6 @@
*.exe
*.pdb
*.obj
*.o
out.txt
err.txt
err.txt
-37
View File
@@ -1,37 +0,0 @@
[*] Omegon Framework Test
[+] CoInitializeEx (main): 0x0
[+] CoRegisterPSClsid (main): 0x0
[+] CoRegisterClassObject (main): 0x0
[PSF] CreateStub: fake_stub=0x2EA2B46F9D0, returning vtbl_ptr at 0x2EA2B46F9D8
[PSF] fake_stub hex:
+0x00: 30 0E 47 2B EA 02 00 00
+0x08: 10 3E 47 2B EA 02 00 00
+0x10: 01 00 00 00 00 00 00 00
+0x18: 30 0E 47 2B EA 02 00 00
+0x20: 00 00 00 00 00 00 00 00
+0x28: 00 00 00 00 00 00 00 00
+0x30: 00 00 00 00 00 00 00 00
+0x38: 00 00 00 00 00 00 00 00
+0x40: F0 3D 47 2B EA 02 00 00
[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0
[+] STA ready, stream=0x2EA2B491110
[+] Calling CoGetInterfaceAndReleaseStream...
[PSF] CreateProxy called!
[RPB] Connect called! pChannel=0x2EA2B4A36F0
[+] Unmarshal returned: 0x0
[+] Omegon initialized
[+] State: ready
[*] Testing sleep mode: queue(NtDelay 2s) + execute()...
[MTA-sleep] Worker started, posting 3 calls
[MTA-sleep] GetBuffer OK method=7
[MTA-sleep] PostCall OK method=7 hr=0x0
[MTA-sleep] GetBuffer OK method=8
[MTA-sleep] PostCall OK method=8 hr=0x0
[MTA-sleep] GetBuffer OK method=9
[MTA-sleep] PostCall OK method=9 hr=0x0
[MTA-sleep] All done
[STA] Switching to pump fiber...
[STA] Returned from pump!
[STA] Pump cycle complete.
[+] Sleep mode complete! (total elapsed=4032ms)
[+] Omegon test complete
initial-pocs/err.txt
-72
View File
@@ -1,72 +0,0 @@
[*] Async COM Sleep Chain PoC
[*] Zero user code on ANY callstack during sleep
[+] CStdStubBuffer_Invoke: 0x7FF9DED9DC20
[+] NdrStubCall2: 0x7FF9E01871B0
[+] CoRegisterPSClsid (main): 0x0
[+] CoRegisterClassObject (main): 0x0
[+] NtProtect: 0x7FF9E0CC0A60
[+] SF032: 0x7FF9DD3DAA30
[+] NtDelay: 0x7FF9E0CC06E0
[+] MIDL structures built
[+] NtDelayExecution: 0x7FF9E0CC06E0
[+] STA thread: TID=127976
[STA] Thread started
[PSF] CreateStub called!
[PSF] fake_stub hex:
+0x00: 50 C6 4C BD F6 7F 00 00
+0x08: 28 C5 4C BD F6 7F 00 00
+0x10: 01 00 00 00 00 00 00 00
+0x18: 50 C6 4C BD F6 7F 00 00
+0x20: 00 00 00 00 00 00 00 00
+0x28: 00 00 00 00 00 00 00 00
+0x30: 00 00 00 00 00 00 00 00
+0x38: 00 00 00 00 00 00 00 00
+0x40: 08 C5 4C BD F6 7F 00 00
[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0
[STA] Waiting for unmarshal...
[+] STA ready
[+] Unmarshalling proxy...
[+] Calling CoGetInterfaceAndReleaseStream...
[PSF] CreateProxy called!
[RPB] Connect called! pChannel=0x1DE70FB0190
[+] Unmarshal returned: 0x0
[+] Proxy channel: 0x1DE70FB0190
[STA] Setting up BlockFn fiber pump...
[STA] CCliModalLoop constructed (fCoWaitCalled=0)
[STA] Main fiber: 0x1DE70FB0250
[STA] Pump fiber: 0x1DE70FB0790 (proc=combase!BlockFn @ 0x7FF9DEDA7F98)
[STA] Waiting for pump signal...
[+] STA fiber ready
[+] MTA worker: TID=127960
[MTA] SOleTlsData+0x14 = 0x41 (before GetBuffer)
[MTA] Call object at 0x1DE70FB18E0, vtable at 0x7FF9DEF84508
[MTA] vtable[11] (Send) = 0x7FF9DEE979B0 (RVA 0x1879B0)
[MTA] vtable[0] (QI) = 0x7FF9DEE33030 (RVA 0x123030)
[MTA] CSyncClientCall+0x40 (OXIDEntry) = 0x1DE70F9C6E0
[MTA] CSyncClientCall+0xC0 (transport) = 0x1DE70FB1A10
[MTA] CSyncClientCall+0xC8 (ServerCall) = 0x1DE70FB1CF0
[MTA] OXIDEntry: dwFlags=0x4000001 hServerSTA=0x27D1352
[MTA] OXIDEntry+0xE8 (CComApartment) = 0x1DE70F82C90
[MTA] PostCall OK B1 (method 9)
[MTA] PostCall OK B2 (method 13)
[MTA] All 2 messages posted via PostCall. Thread exiting.
[+] MTA worker done posting messages
[+] MTA worker thread exited
[+] Signaling STA to pump...
[*] Waiting for chain completion (2s NtDelay)...
[STA] SOleTlsData = 0x1DE70F82A40
[STA] CAptCallCtrl = 0x1DE70F9AF50
[STA] _pTopCML = 0x51541FFB48 (should point to cml_buf @ 0x51541FFB48)
[STA] fake_client_call @ 0x51541FFA28, inner_obj @ 0x51541FF818
[STA] fake_client_call+0xC0 = 0x51541FF818
[STA] fake_client_call+0x108 = 0x244
[STA] DEBUG: Attempting direct ModalLoop call to isolate crash...
[STA] CFG target = 0x7FF9DEDA9180 (NoOpReturn0 @ 0x7FF9DEDA9180)
[STA] Switching to pump fiber (ModalLoop wrapper in combase.dll)...
[STA] Returned from pump! Chain complete.
[STA] Switching back to pump fiber to let ModalLoop exit cleanly...
[+] STA thread completed
[+] DONE — NtDelay dispatched through COM pump successfully!
[*] Done.
initial-pocs/o1err.txt
-72
View File
@@ -1,72 +0,0 @@
[*] Async COM Sleep Chain PoC
[*] Zero user code on ANY callstack during sleep
[+] CStdStubBuffer_Invoke: 0x7FF9DED9DC20
[+] NdrStubCall2: 0x7FF9E01871B0
[+] CoRegisterPSClsid (main): 0x0
[+] CoRegisterClassObject (main): 0x0
[+] NtProtect: 0x7FF9E0CC0A60
[+] SF032: 0x7FF9DD3DAA30
[+] NtDelay: 0x7FF9E0CC06E0
[+] MIDL structures built
[+] NtDelayExecution: 0x7FF9E0CC06E0
[+] STA thread: TID=124076
[STA] Thread started
[PSF] CreateStub called!
[PSF] fake_stub hex:
+0x00: 50 C6 20 0E F7 7F 00 00
+0x08: 28 C5 20 0E F7 7F 00 00
+0x10: 01 00 00 00 00 00 00 00
+0x18: 50 C6 20 0E F7 7F 00 00
+0x20: 00 00 00 00 00 00 00 00
+0x28: 00 00 00 00 00 00 00 00
+0x30: 00 00 00 00 00 00 00 00
+0x38: 00 00 00 00 00 00 00 00
+0x40: 08 C5 20 0E F7 7F 00 00
[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0
[STA] Waiting for unmarshal...
[+] STA ready
[+] Unmarshalling proxy...
[+] Calling CoGetInterfaceAndReleaseStream...
[PSF] CreateProxy called!
[RPB] Connect called! pChannel=0x1B457321EF0
[+] Unmarshal returned: 0x0
[+] Proxy channel: 0x1B457321EF0
[STA] Setting up BlockFn fiber pump...
[STA] CCliModalLoop constructed (fCoWaitCalled=0)
[STA] Main fiber: 0x1B457321FB0
[STA] Pump fiber: 0x1B4573224F0 (proc=combase!BlockFn @ 0x7FF9DEDA7F98)
[STA] Waiting for pump signal...
[+] STA fiber ready
[+] MTA worker: TID=88896
[MTA] SOleTlsData+0x14 = 0x41 (before GetBuffer)
[MTA] Call object at 0x1B4573237A0, vtable at 0x7FF9DEF84508
[MTA] vtable[11] (Send) = 0x7FF9DEE979B0 (RVA 0x1879B0)
[MTA] vtable[0] (QI) = 0x7FF9DEE33030 (RVA 0x123030)
[MTA] CSyncClientCall+0x40 (OXIDEntry) = 0x1B45730D770
[MTA] CSyncClientCall+0xC0 (transport) = 0x1B4573238D0
[MTA] CSyncClientCall+0xC8 (ServerCall) = 0x1B457323BB0
[MTA] OXIDEntry: dwFlags=0x4000001 hServerSTA=0x1400C28
[MTA] OXIDEntry+0xE8 (CComApartment) = 0x1B4572F2CA0
[MTA] PostCall OK B1 (method 9)
[MTA] PostCall OK B2 (method 13)
[MTA] All 2 messages posted via PostCall. Thread exiting.
[+] MTA worker done posting messages
[+] MTA worker thread exited
[+] Signaling STA to pump...
[*] Waiting for chain completion (2s NtDelay)...
[STA] SOleTlsData = 0x1B4572F2A50
[STA] CAptCallCtrl = 0x1B45730AB00
[STA] _pTopCML = 0x9E07FFF718 (should point to cml_buf @ 0x9E07FFF718)
[STA] fake_client_call @ 0x9E07FFF5F8, inner_obj @ 0x9E07FFF3E8
[STA] fake_client_call+0xC0 = 0x9E07FFF3E8
[STA] fake_client_call+0x108 = 0x244
[STA] DEBUG: Attempting direct ModalLoop call to isolate crash...
[STA] CFG target = 0x7FF9DEDA9180 (NoOpReturn0 @ 0x7FF9DEDA9180)
[STA] Switching to pump fiber (ModalLoop wrapper in combase.dll)...
[STA] Returned from pump! Chain complete.
[STA] Switching back to pump fiber to let ModalLoop exit cleanly...
[+] STA thread completed
[+] DONE — NtDelay dispatched through COM pump successfully!
[*] Done.
initial-pocs/o1out.txt
View File
initial-pocs/omega1_cmp.exe
BIN
View File
Binary file not shown.
initial-pocs/omega1_cmp.pdb
BIN
View File
Binary file not shown.
initial-pocs/omega1_err.txt
-67
View File
@@ -1,67 +0,0 @@
[*] Async COM Sleep Chain PoC
[*] Zero user code on ANY callstack during sleep
[+] CStdStubBuffer_Invoke: 0x7FF9DED9DC20
[+] NdrStubCall2: 0x7FF9E01871B0
[+] CoRegisterPSClsid (main): 0x0
[+] CoRegisterClassObject (main): 0x0
[+] NtProtect: 0x7FF9E0CC0A60
[+] SF032: 0x7FF9DD3DAA30
[+] NtDelay: 0x7FF9E0CC06E0
[+] MIDL structures built
[+] MessageBoxA: 0x7FF9DEBCEBC0
[+] STA thread: TID=125204
[STA] Thread started
[PSF] CreateStub called!
[PSF] fake_stub hex:
+0x00: 50 F6 05 74 F7 7F 00 00
+0x08: 28 F5 05 74 F7 7F 00 00
+0x10: 01 00 00 00 00 00 00 00
+0x18: 50 F6 05 74 F7 7F 00 00
+0x20: 00 00 00 00 00 00 00 00
+0x28: 00 00 00 00 00 00 00 00
+0x30: 00 00 00 00 00 00 00 00
+0x38: 00 00 00 00 00 00 00 00
+0x40: 08 F5 05 74 F7 7F 00 00
[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0
[STA] Waiting for unmarshal...
[+] STA ready
[+] Unmarshalling proxy...
[+] Calling CoGetInterfaceAndReleaseStream...
[PSF] CreateProxy called!
[RPB] Connect called! pChannel=0x24EB08EEC90
[+] Unmarshal returned: 0x0
[+] Proxy channel: 0x24EB08EEC90
[STA] Setting up BlockFn fiber pump...
[STA] CCliModalLoop constructed (fCoWaitCalled=0)
[STA] Main fiber: 0x24EB08EED50
[STA] Pump fiber: 0x24EB08EF290 (proc=combase!BlockFn @ 0x7FF9DEDA7F98)
[STA] Waiting for pump signal...
[+] STA fiber ready
[+] .text at 0x7FF773F61000, size 0xB4516
[+] .text first 16 bytes (before): 55 48 81 EC 20 02 00 00 48 8D AC 24 80 00 00 00
[+] MTA worker: TID=42344
[MTA] SOleTlsData+0x14 = 0x41 (before GetBuffer)
[MTA] Call object at 0x24EB08F2550, vtable at 0x7FF9DEF84508
[MTA] vtable[11] (Send) = 0x7FF9DEE979B0 (RVA 0x1879B0)
[MTA] vtable[0] (QI) = 0x7FF9DEE33030 (RVA 0x123030)
[MTA] CSyncClientCall+0x40 (OXIDEntry) = 0x24EB08DC4B0
[MTA] CSyncClientCall+0xC0 (transport) = 0x24EB08F2680
[MTA] CSyncClientCall+0xC8 (ServerCall) = 0x24EB08F2960
[MTA] OXIDEntry: dwFlags=0x4000001 hServerSTA=0x22141C
[MTA] OXIDEntry+0xE8 (CComApartment) = 0x24EB08E9490
[MTA] PostCall OK B1 (method 12)
[MTA] All 1 messages posted via PostCall. Thread exiting.
[+] MTA worker done posting messages
[+] MTA worker thread exited — ZERO .text frames on any stack
[+] Signaling STA to pump...
[*] Waiting for chain completion (3s NtDelay while .text encrypted)...
[STA] SOleTlsData = 0x24EB08C26A0
[STA] CAptCallCtrl = 0x24EB08DA030
[STA] _pTopCML = 0x54501FF568 (should point to cml_buf @ 0x54501FF568)
[STA] fake_client_call @ 0x54501FF448, inner_obj @ 0x54501FF238
[STA] fake_client_call+0xC0 = 0x54501FF238
[STA] fake_client_call+0x108 = 0x24C
[STA] DEBUG: Attempting direct ModalLoop call to isolate crash...
[STA] CFG target = 0x7FF9DEDA9180 (NoOpReturn0 @ 0x7FF9DEDA9180)
[STA] Switching to pump fiber (ModalLoop wrapper in combase.dll)...
initial-pocs/omega1_ntd.exe
BIN
View File
Binary file not shown.
initial-pocs/omega1_ntd.pdb
BIN
View File
Binary file not shown.
initial-pocs/omega1_out.txt
View File
initial-pocs/omega1_test.exe
BIN
View File
Binary file not shown.
initial-pocs/omega1_test.pdb
BIN
View File
Binary file not shown.
initial-pocs/out.txt
View File
omega1_test.exe
BIN
View File
Binary file not shown.
omega1_test.pdb
BIN
View File
Binary file not shown.
omegon_test.exe
BIN
View File
Binary file not shown.
omegon_test.pdb
BIN
View File
Binary file not shown.
out.txt
View File