mirror of
https://github.com/nbaertsch/COMegon
synced 2026-08-09 12:57:42 +00:00
nbaertschandCopilot
c7788028c1
Better reflects the COM message pump mechanism. The public API is now init(), queue(), pump(), invoke(), deinit(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
73 lines
2.8 KiB
Plaintext
73 lines
2.8 KiB
Plaintext
[*] Async COM Sleep Chain PoC
|
|
[*] Zero user code on ANY callstack during sleep
|
|
|
|
[+] CStdStubBuffer_Invoke: 0x7FF9DED9DC20
|
|
[+] NdrStubCall2: 0x7FF9E01871B0
|
|
[+] CoRegisterPSClsid (main): 0x0
|
|
[+] CoRegisterClassObject (main): 0x0
|
|
[+] NtProtect: 0x7FF9E0CC0A60
|
|
[+] SF032: 0x7FF9DD3DAA30
|
|
[+] NtDelay: 0x7FF9E0CC06E0
|
|
[+] MIDL structures built
|
|
[+] NtDelayExecution: 0x7FF9E0CC06E0
|
|
[+] STA thread: TID=124076
|
|
[STA] Thread started
|
|
[PSF] CreateStub called!
|
|
[PSF] fake_stub hex:
|
|
+0x00: 50 C6 20 0E F7 7F 00 00
|
|
+0x08: 28 C5 20 0E F7 7F 00 00
|
|
+0x10: 01 00 00 00 00 00 00 00
|
|
+0x18: 50 C6 20 0E F7 7F 00 00
|
|
+0x20: 00 00 00 00 00 00 00 00
|
|
+0x28: 00 00 00 00 00 00 00 00
|
|
+0x30: 00 00 00 00 00 00 00 00
|
|
+0x38: 00 00 00 00 00 00 00 00
|
|
+0x40: 08 C5 20 0E F7 7F 00 00
|
|
[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0
|
|
[STA] Waiting for unmarshal...
|
|
[+] STA ready
|
|
[+] Unmarshalling proxy...
|
|
[+] Calling CoGetInterfaceAndReleaseStream...
|
|
[PSF] CreateProxy called!
|
|
[RPB] Connect called! pChannel=0x1B457321EF0
|
|
[+] Unmarshal returned: 0x0
|
|
[+] Proxy channel: 0x1B457321EF0
|
|
[STA] Setting up BlockFn fiber pump...
|
|
[STA] CCliModalLoop constructed (fCoWaitCalled=0)
|
|
[STA] Main fiber: 0x1B457321FB0
|
|
[STA] Pump fiber: 0x1B4573224F0 (proc=combase!BlockFn @ 0x7FF9DEDA7F98)
|
|
[STA] Waiting for pump signal...
|
|
[+] STA fiber ready
|
|
[+] MTA worker: TID=88896
|
|
[MTA] SOleTlsData+0x14 = 0x41 (before GetBuffer)
|
|
[MTA] Call object at 0x1B4573237A0, vtable at 0x7FF9DEF84508
|
|
[MTA] vtable[11] (Send) = 0x7FF9DEE979B0 (RVA 0x1879B0)
|
|
[MTA] vtable[0] (QI) = 0x7FF9DEE33030 (RVA 0x123030)
|
|
[MTA] CSyncClientCall+0x40 (OXIDEntry) = 0x1B45730D770
|
|
[MTA] CSyncClientCall+0xC0 (transport) = 0x1B4573238D0
|
|
[MTA] CSyncClientCall+0xC8 (ServerCall) = 0x1B457323BB0
|
|
[MTA] OXIDEntry: dwFlags=0x4000001 hServerSTA=0x1400C28
|
|
[MTA] OXIDEntry+0xE8 (CComApartment) = 0x1B4572F2CA0
|
|
[MTA] PostCall OK B1 (method 9)
|
|
[MTA] PostCall OK B2 (method 13)
|
|
[MTA] All 2 messages posted via PostCall. Thread exiting.
|
|
[+] MTA worker done posting messages
|
|
[+] MTA worker thread exited
|
|
[+] Signaling STA to pump...
|
|
[*] Waiting for chain completion (2s NtDelay)...
|
|
[STA] SOleTlsData = 0x1B4572F2A50
|
|
[STA] CAptCallCtrl = 0x1B45730AB00
|
|
[STA] _pTopCML = 0x9E07FFF718 (should point to cml_buf @ 0x9E07FFF718)
|
|
[STA] fake_client_call @ 0x9E07FFF5F8, inner_obj @ 0x9E07FFF3E8
|
|
[STA] fake_client_call+0xC0 = 0x9E07FFF3E8
|
|
[STA] fake_client_call+0x108 = 0x244
|
|
[STA] DEBUG: Attempting direct ModalLoop call to isolate crash...
|
|
[STA] CFG target = 0x7FF9DEDA9180 (NoOpReturn0 @ 0x7FF9DEDA9180)
|
|
[STA] Switching to pump fiber (ModalLoop wrapper in combase.dll)...
|
|
[STA] Returned from pump! Chain complete.
|
|
[STA] Switching back to pump fiber to let ModalLoop exit cleanly...
|
|
[+] STA thread completed
|
|
[+] DONE — NtDelay dispatched through COM pump successfully!
|
|
|
|
[*] Done.
|