From 6d5625087a8d5a1df5d90e3e7f56cef2bc943f34 Mon Sep 17 00:00:00 2001 From: TogDu Date: Wed, 10 May 2017 19:17:57 +0200 Subject: [PATCH 1/5] support for 6.1.7601.19135 version --- RpcCore/RpcCore2_32bits/RpcInternals.h | 1 + RpcCore/RpcCore2_64bits/RpcInternals.h | 1 + 2 files changed, 2 insertions(+) diff --git a/RpcCore/RpcCore2_32bits/RpcInternals.h b/RpcCore/RpcCore2_32bits/RpcInternals.h index 495277d..5ca830d 100644 --- a/RpcCore/RpcCore2_32bits/RpcInternals.h +++ b/RpcCore/RpcCore2_32bits/RpcInternals.h @@ -13,6 +13,7 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB149E0LL, //6.1.7601.18912 0x600011DB149F5LL, //6.1.7601.18933 0x600011DB149FBLL, //6.1.7601.18939 + 0x600011DB14ABFLL, //6.1.7601.19135 0x600011DB15B7BLL //6.1.7601.23419 }; diff --git a/RpcCore/RpcCore2_64bits/RpcInternals.h b/RpcCore/RpcCore2_64bits/RpcInternals.h index bb818c4..7781751 100644 --- a/RpcCore/RpcCore2_64bits/RpcInternals.h +++ b/RpcCore/RpcCore2_64bits/RpcInternals.h @@ -12,6 +12,7 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB149E0LL, //6.1.7601.18912 0x600011DB149F5LL, //6.1.7601.18933 0x600011DB149FBLL, //6.1.7601.18939 + 0x600011DB14ABFLL, //6.1.7601.19135 0x600011DB15B7BLL //6.1.7601.23419 }; From 6b05426e63f11f71be4bbbe2d9d4c85452f24557 Mon Sep 17 00:00:00 2001 From: TogDu Date: Wed, 10 May 2017 19:20:05 +0200 Subject: [PATCH 2/5] CLEANING : break or return, one need to choose ;) --- RpcDecompiler/IdlFunction.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RpcDecompiler/IdlFunction.cpp b/RpcDecompiler/IdlFunction.cpp index bcc3cfe..9f70f11 100644 --- a/RpcDecompiler/IdlFunction.cpp +++ b/RpcDecompiler/IdlFunction.cpp @@ -235,6 +235,7 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) if(bResult == FALSE) { + RPC_ERROR_FN("can not read explicit bind handle"); return DS_ERR_UNABLE_TO_READ_MEMORY; } @@ -244,7 +245,6 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) default: RPC_ERROR_FN("invalid explicit handle type\n"); return DS_ERR_INVALID_DATA; - break; } } From 85ff861717ef1001ed9743c00794e290d1a2f8a4 Mon Sep 17 00:00:00 2001 From: TogDu Date: Wed, 10 May 2017 19:25:02 +0200 Subject: [PATCH 3/5] BUGFIX : -duplicate type OIF_HEADER_T / Oif_Header_t (more to come) -support for IDL without win32kExtension structure --- RpcDecompiler/IdlFunction.cpp | 62 ++++++++++++----------- RpcDecompiler/internalRpcDecompTypeDefs.h | 11 +--- 2 files changed, 34 insertions(+), 39 deletions(-) diff --git a/RpcDecompiler/IdlFunction.cpp b/RpcDecompiler/IdlFunction.cpp index 9f70f11..1bcd70c 100644 --- a/RpcDecompiler/IdlFunction.cpp +++ b/RpcDecompiler/IdlFunction.cpp @@ -30,7 +30,7 @@ IdlInterface* IdlFunction::getpIdlInterface() const size_t IdlFunction::getNbArguments() const { - return (size_t)m_ProcHeader.oifheader.bNumber_of_params; + return (size_t)m_ProcHeader.oifheader.number_of_param; } bool IdlFunction::hasRangeOnConformance() const @@ -259,6 +259,7 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) sizeof(this->m_ProcHeader.oifheader)); if (bResult == FALSE){ + RPC_ERROR_FN("can not read oif header\n"); return DS_ERR_UNABLE_TO_READ_MEMORY; ; } @@ -267,42 +268,45 @@ DECOMP_STATUS IdlFunction::decodeProcHeader(void* pCtx) //======================================================== // Read Win32Ext header part of header //======================================================== - - // TODO : check under which condition win32Kext header is present - bResult = RPC_GET_PROCESS_DATA2( - (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), - &(this->m_ProcHeader.win2KextHeader.extension_version), - sizeof(this->m_ProcHeader.win2KextHeader.extension_version)); - - if (bResult == FALSE){ - return DS_ERR_UNABLE_TO_READ_MEMORY; ; - } - - - switch (this->m_ProcHeader.win2KextHeader.extension_version) + if (this->m_ProcHeader.oifheader.interpreter_opt_flag.HasExtensions) { - case WIN2K_EXT_HEADER_32B_SIZE: bResult = RPC_GET_PROCESS_DATA2( (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), &(this->m_ProcHeader.win2KextHeader.extension_version), - WIN2K_EXT_HEADER_32B_SIZE - ); + sizeof(this->m_ProcHeader.win2KextHeader.extension_version)); - uOffsetInProcFmtString += WIN2K_EXT_HEADER_32B_SIZE; + if (bResult == FALSE){ + RPC_ERROR_FN("can not read win32ext header\n"); + return DS_ERR_UNABLE_TO_READ_MEMORY; + } - break; - case WIN2K_EXT_HEADER_64B_SIZE: - bResult = RPC_GET_PROCESS_DATA2( - (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), - &(this->m_ProcHeader.win2KextHeader.extension_version), - WIN2K_EXT_HEADER_64B_SIZE - ); - uOffsetInProcFmtString += WIN2K_EXT_HEADER_64B_SIZE; - break; + switch (this->m_ProcHeader.win2KextHeader.extension_version) + { + case WIN2K_EXT_HEADER_32B_SIZE: + bResult = RPC_GET_PROCESS_DATA2( + (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), + &(this->m_ProcHeader.win2KextHeader.extension_version), + WIN2K_EXT_HEADER_32B_SIZE + ); - default: - return DS_ERR_INVALID_DATA; + uOffsetInProcFmtString += WIN2K_EXT_HEADER_32B_SIZE; + + break; + case WIN2K_EXT_HEADER_64B_SIZE: + bResult = RPC_GET_PROCESS_DATA2( + (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + uOffsetInProcFmtString), + &(this->m_ProcHeader.win2KextHeader.extension_version), + WIN2K_EXT_HEADER_64B_SIZE + ); + + uOffsetInProcFmtString += WIN2K_EXT_HEADER_64B_SIZE; + break; + + default: + RPC_ERROR_FN("invalid win32k header len"); + return DS_ERR_INVALID_DATA; + } } m_uOffsetFirstArg = uOffsetInProcFmtString; diff --git a/RpcDecompiler/internalRpcDecompTypeDefs.h b/RpcDecompiler/internalRpcDecompTypeDefs.h index 8f0d58b..74e3bfe 100644 --- a/RpcDecompiler/internalRpcDecompTypeDefs.h +++ b/RpcDecompiler/internalRpcDecompTypeDefs.h @@ -242,7 +242,7 @@ typedef struct Oif_Header_t as the SERVER_MUST_SIZE flag triggers the sizing. */ INTERPRETER_OPT_FLAGS interpreter_opt_flag; // Voir interpreter_opt_flag values unsigned char number_of_param; // Nombre de paramètres décrits de la procédure, return compris -}Oif_Header_t; +}Oif_Header_t, OIF_HEADER_T; //------------------------------------------------------------------------------ // _MIDL_PROC_FORMAT_STRING types : @@ -324,15 +324,6 @@ typedef struct _OI_HEADER_T OI_HEADER_END_T end; }OI_HEADER_T; -// Oif fields -typedef struct _OIF_HEADER_T -{ - WORD wConstant_client_buffer_size; - WORD wConstant_server_buffer_size; - BYTE bINTERPRETER_OPT_FLAGS; - BYTE bNumber_of_params; -}OIF_HEADER_T; - // // Procedure header typedef struct _PROC_HEADER_T From cce523d93913753d12670fa595fbab81b6ec2b41 Mon Sep 17 00:00:00 2001 From: TogDu Date: Wed, 10 May 2017 19:27:41 +0200 Subject: [PATCH 4/5] remove pedentic warning (%x / unsigned char* conflict) --- RpcDecompiler/internalRpcDecompiler.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RpcDecompiler/internalRpcDecompiler.cpp b/RpcDecompiler/internalRpcDecompiler.cpp index de1189e..729444b 100644 --- a/RpcDecompiler/internalRpcDecompiler.cpp +++ b/RpcDecompiler/internalRpcDecompiler.cpp @@ -248,7 +248,7 @@ BOOL __fastcall RpcDecompilerDecodeAndPrintPrototypeReturnType( ); currentOffset += sizeof(Oi_Header_RpcFlags_t); - RPC_DEBUG_FN((UCHAR*)"\noiHeaderRpcFlagsToDecode->rpc_flags = 0x%x", oiHeaderRpcFlagsToDecode->rpc_flags); + //RPC_DEBUG_FN((UCHAR*)"\noiHeaderRpcFlagsToDecode->rpc_flags = 0x%x", oiHeaderRpcFlagsToDecode->rpc_flags); } From 3eb61e707613b6092e30b31c40aed1f09069aa96 Mon Sep 17 00:00:00 2001 From: TogDu Date: Mon, 30 Oct 2017 18:51:24 +0100 Subject: [PATCH 5/5] add support for 6.1.7601.23714 --- RpcCore/RpcCore2_32bits/RpcInternals.h | 3 ++- RpcCore/RpcCore2_64bits/RpcInternals.h | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/RpcCore/RpcCore2_32bits/RpcInternals.h b/RpcCore/RpcCore2_32bits/RpcInternals.h index 5ca830d..fe1ef7b 100644 --- a/RpcCore/RpcCore2_32bits/RpcInternals.h +++ b/RpcCore/RpcCore2_32bits/RpcInternals.h @@ -14,7 +14,8 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB149F5LL, //6.1.7601.18933 0x600011DB149FBLL, //6.1.7601.18939 0x600011DB14ABFLL, //6.1.7601.19135 - 0x600011DB15B7BLL //6.1.7601.23419 + 0x600011DB15B7BLL, //6.1.7601.23419 + 0x600011DB15CA2LL //6.1.7601.23714 }; #ifdef _WIN64 diff --git a/RpcCore/RpcCore2_64bits/RpcInternals.h b/RpcCore/RpcCore2_64bits/RpcInternals.h index 7781751..842e145 100644 --- a/RpcCore/RpcCore2_64bits/RpcInternals.h +++ b/RpcCore/RpcCore2_64bits/RpcInternals.h @@ -13,7 +13,8 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB149F5LL, //6.1.7601.18933 0x600011DB149FBLL, //6.1.7601.18939 0x600011DB14ABFLL, //6.1.7601.19135 - 0x600011DB15B7BLL //6.1.7601.23419 + 0x600011DB15B7BLL, //6.1.7601.23419 + 0x600011DB15CA2LL //6.1.7601.23714 }; #define RPC_CORE_DESCRIPTION "Windows 7 SP1 64bits runtime core"