diff --git a/RpcCore/RpcCore2_32bits/RpcInternals.h b/RpcCore/RpcCore2_32bits/RpcInternals.h index 495277d..fe1ef7b 100644 --- a/RpcCore/RpcCore2_32bits/RpcInternals.h +++ b/RpcCore/RpcCore2_32bits/RpcInternals.h @@ -13,7 +13,9 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB149E0LL, //6.1.7601.18912 0x600011DB149F5LL, //6.1.7601.18933 0x600011DB149FBLL, //6.1.7601.18939 - 0x600011DB15B7BLL //6.1.7601.23419 + 0x600011DB14ABFLL, //6.1.7601.19135 + 0x600011DB15B7BLL, //6.1.7601.23419 + 0x600011DB15CA2LL //6.1.7601.23714 }; #ifdef _WIN64 diff --git a/RpcCore/RpcCore2_64bits/RpcInternals.h b/RpcCore/RpcCore2_64bits/RpcInternals.h index bb818c4..842e145 100644 --- a/RpcCore/RpcCore2_64bits/RpcInternals.h +++ b/RpcCore/RpcCore2_64bits/RpcInternals.h @@ -12,7 +12,9 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB149E0LL, //6.1.7601.18912 0x600011DB149F5LL, //6.1.7601.18933 0x600011DB149FBLL, //6.1.7601.18939 - 0x600011DB15B7BLL //6.1.7601.23419 + 0x600011DB14ABFLL, //6.1.7601.19135 + 0x600011DB15B7BLL, //6.1.7601.23419 + 0x600011DB15CA2LL //6.1.7601.23714 }; #define RPC_CORE_DESCRIPTION "Windows 7 SP1 64bits runtime core" diff --git a/RpcDecompiler/IdlFunction.cpp b/RpcDecompiler/IdlFunction.cpp index bcc3cfe..1bcd70c 100644 --- a/RpcDecompiler/IdlFunction.cpp +++ b/RpcDecompiler/IdlFunction.cpp @@ -30,7 +30,7 @@ IdlInterface* IdlFunction::getpIdlInterface() const size_t IdlFunction::getNbArguments() const { - return (size_t)m_ProcHeader.oifheader.bNumber_of_params; + return (size_t)m_ProcHeader.oifheader.number_of_param; } bool IdlFunction::hasRangeOnConformance() const @@ -235,6 +235,7 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) if(bResult == FALSE) { + RPC_ERROR_FN("can not read explicit bind handle"); return DS_ERR_UNABLE_TO_READ_MEMORY; } @@ -244,7 +245,6 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) default: RPC_ERROR_FN("invalid explicit handle type\n"); return DS_ERR_INVALID_DATA; - break; } } @@ -259,6 +259,7 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) sizeof(this->m_ProcHeader.oifheader)); if (bResult == FALSE){ + RPC_ERROR_FN("can not read oif header\n"); return DS_ERR_UNABLE_TO_READ_MEMORY; ; } @@ -267,42 +268,45 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) //======================================================== // Read Win32Ext header part of header //======================================================== - - // TODO : check under which condition win32Kext header is present - bResult = RPC_GET_PROCESS_DATA2( - (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), - &(this->m_ProcHeader.win2KextHeader.extension_version), - sizeof(this->m_ProcHeader.win2KextHeader.extension_version)); - - if (bResult == FALSE){ - return DS_ERR_UNABLE_TO_READ_MEMORY; ; - } - - - switch (this->m_ProcHeader.win2KextHeader.extension_version) + if (this->m_ProcHeader.oifheader.interpreter_opt_flag.HasExtensions) { - case WIN2K_EXT_HEADER_32B_SIZE: bResult = RPC_GET_PROCESS_DATA2( (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), &(this->m_ProcHeader.win2KextHeader.extension_version), - WIN2K_EXT_HEADER_32B_SIZE - ); + sizeof(this->m_ProcHeader.win2KextHeader.extension_version)); - uOffsetInProcFmtString += WIN2K_EXT_HEADER_32B_SIZE; + if (bResult == FALSE){ + RPC_ERROR_FN("can not read win32ext header\n"); + return DS_ERR_UNABLE_TO_READ_MEMORY; + } - break; - case WIN2K_EXT_HEADER_64B_SIZE: - bResult = RPC_GET_PROCESS_DATA2( - (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), - &(this->m_ProcHeader.win2KextHeader.extension_version), - WIN2K_EXT_HEADER_64B_SIZE - ); - uOffsetInProcFmtString += WIN2K_EXT_HEADER_64B_SIZE; - break; + switch (this->m_ProcHeader.win2KextHeader.extension_version) + { + case WIN2K_EXT_HEADER_32B_SIZE: + bResult = RPC_GET_PROCESS_DATA2( + (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), + &(this->m_ProcHeader.win2KextHeader.extension_version), + WIN2K_EXT_HEADER_32B_SIZE + ); - default: - return DS_ERR_INVALID_DATA; + uOffsetInProcFmtString += WIN2K_EXT_HEADER_32B_SIZE; + + break; + case WIN2K_EXT_HEADER_64B_SIZE: + bResult = RPC_GET_PROCESS_DATA2( + (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), + &(this->m_ProcHeader.win2KextHeader.extension_version), + WIN2K_EXT_HEADER_64B_SIZE + ); + + uOffsetInProcFmtString += WIN2K_EXT_HEADER_64B_SIZE; + break; + + default: + RPC_ERROR_FN("invalid win32k header len"); + return DS_ERR_INVALID_DATA; + } } m_uOffsetFirstArg = uOffsetInProcFmtString; diff --git a/RpcDecompiler/internalRpcDecompTypeDefs.h b/RpcDecompiler/internalRpcDecompTypeDefs.h index 8f0d58b..74e3bfe 100644 --- a/RpcDecompiler/internalRpcDecompTypeDefs.h +++ b/RpcDecompiler/internalRpcDecompTypeDefs.h @@ -242,7 +242,7 @@ typedef struct Oif_Header_t as the SERVER_MUST_SIZE flag triggers the sizing. */ INTERPRETER_OPT_FLAGS interpreter_opt_flag; // Voir interpreter_opt_flag values unsigned char number_of_param; // Nombre de paramètres décrits de la procédure, return compris -}Oif_Header_t; +}Oif_Header_t, OIF_HEADER_T; //------------------------------------------------------------------------------ // _MIDL_PROC_FORMAT_STRING types : @@ -324,15 +324,6 @@ typedef struct _OI_HEADER_T OI_HEADER_END_T end; }OI_HEADER_T; -// Oif fields -typedef struct _OIF_HEADER_T -{ - WORD wConstant_client_buffer_size; - WORD wConstant_server_buffer_size; - BYTE bINTERPRETER_OPT_FLAGS; - BYTE bNumber_of_params; -}OIF_HEADER_T; - // // Procedure header typedef struct _PROC_HEADER_T diff --git a/RpcDecompiler/internalRpcDecompiler.cpp b/RpcDecompiler/internalRpcDecompiler.cpp index de1189e..729444b 100644 --- a/RpcDecompiler/internalRpcDecompiler.cpp +++ b/RpcDecompiler/internalRpcDecompiler.cpp @@ -248,7 +248,7 @@ BOOL __fastcall RpcDecompilerDecodeAndPrintPrototypeReturnType( ); currentOffset += sizeof(Oi_Header_RpcFlags_t); - RPC_DEBUG_FN((UCHAR*)"\noiHeaderRpcFlagsToDecode->rpc_flags = 0x%x", oiHeaderRpcFlagsToDecode->rpc_flags); + //RPC_DEBUG_FN((UCHAR*)"\noiHeaderRpcFlagsToDecode->rpc_flags = 0x%x", oiHeaderRpcFlagsToDecode->rpc_flags); }