RunningMoniker逆向结果

最新推荐文章于 2024-04-23 14:02:11 发布

王cb

最新推荐文章于 2024-04-23 14:02:11 发布

阅读量309

点赞数

始于C#，精于C&C++，醉心于Windows内核与Com组件安全研究

本文链接：https://blog.csdn.net/oshuangyue12/article/details/79345070

版权

int __stdcall RunningMoniker(IBindCtx *pbc, wchar_t *pszFullPath, unsigned int ccFullPath, unsigned int *pcchEaten, IMoniker **ppmk)
{
  wchar_t *v5; // esi
  wchar_t v6; // ax
  wchar_t v7; // di
  HRESULT v8; // eax
  HRESULT v9; // eax
  IMonikerVtbl *v10; // ecx
  int retVal; // [esp+8h] [ebp-Ch]
  IRunningObjectTable *pRot; // [esp+Ch] [ebp-8h]
  CFileMoniker *pCFM; // [esp+10h] [ebp-4h]

  *pcchEaten = 0;
  pCFM = 0;
  pRot = 0;
  retVal = 0;
  v5 = &pszFullPath[ccFullPath];
  if ( !pbc->IUnknownVtbl->GetRunningObjectTable(pbc, &pRot) && v5 > pszFullPath )
  {
    do
    {
      v6 = *v5;
      if ( *v5 == 92 || v6 == 47 || v6 == 58 || v6 == 33 || v6 == 91 || v6 == 35 || !v6 )
      {
        v7 = *v5;
        *v5 = 0;
        v8 = CreateFileMoniker(pszFullPath, (LPMONIKER *)&pCFM);
        *v5 = v7;
        if ( v8 >= 0 )
        {
          v9 = pRot->ISelfUnknownVtbl->IsRunning(pRot, (IMoniker *)pCFM);
          if ( !v9 )
          {
            *ppmk = (IMoniker *)&pCFM->ISelfUnknownVtbl;
            *pcchEaten = v5 - pszFullPath;
            retVal = 1;
            break;
          }
          v10 = pCFM->ISelfUnknownVtbl;
          if ( v9 == -2147024882 )
          {
            v10->Release((IMoniker *)&pCFM->ISelfUnknownVtbl);
            pCFM = 0;
            break;
          }
          v10->Release((IMoniker *)&pCFM->ISelfUnknownVtbl);
          pCFM = 0;
        }
      }
      --v5;
    }
    while ( v5 > pszFullPath );
  }
  if ( pRot )
    pRot->ISelfUnknownVtbl->Release(pRot);
  return retVal;
}