复杂的moniker被解析的CCompositeMoniker::BindToObject结果正确逆向

最新推荐文章于 2019-06-15 14:49:00 发布

王cb

最新推荐文章于 2019-06-15 14:49:00 发布

阅读量856

点赞数 1

始于C#，精于C&C++，醉心于Windows内核与Com组件安全研究

本文链接：https://blog.csdn.net/oshuangyue12/article/details/79366484

版权

和reactos里面的伪代码出入比较大,这是最新版ole32里面逆向结果

HRESULT __userpurge CCompositeMoniker::BindToObject@<eax>(int a1@<edi>, CCompositeMoniker *this, IBindCtx *pbc, IMoniker *pmkToLeft, _GUID *riidResult, void **ppvResult)
{
  int v6; // esi
  HRESULT v7; // esi
  IMoniker *_lastMoniker; // ebx
  IMoniker *v9; // edi
  IUnknown *_pmkNewRef; // eax
  int v12; // eax
  int v13; // [esp-4h] [ebp-18h]
  IUnknown *pUnk; // [esp+8h] [ebp-Ch]
  IRunningObjectTable *prot; // [esp+Ch] [ebp-8h]
  IMoniker *pmkNewLeft; // [esp+10h] [ebp-4h]

  if ( !IsValidPtrOut(ppvResult, 4u) )
    return -2147024809;
  v13 = a1;
  *ppvResult = 0;
  if ( IsValidInterface(pbc) && (!pmkToLeft || IsValidInterface(pmkToLeft)) )
  {
    *ppvResult = 0;
    pmkNewLeft = 0;
    if ( !pmkToLeft )
    {
      v6 = pbc->IUnknownVtbl->GetRunningObjectTable(pbc, &prot);
      if ( v6 )
        return v6;
      v7 = prot->ISelfUnknownVtbl->GetObjectW(prot, (IMoniker *)this, &pUnk);
      prot->ISelfUnknownVtbl->Release(prot);
      if ( !v7 && pUnk )
      {
        v6 = ((int (__stdcall *)(IUnknown *, _GUID *, void **))pUnk->vfptr->QueryInterface)(pUnk, riidResult, ppvResult);
        _pmkNewRef = pUnk;
        goto LABEL_14;
      }
    }
    _lastMoniker = CCompositeMoniker::AllButLast(this);
    if ( !_lastMoniker )
      return -2147024882;
    v9 = CCompositeMoniker::Last(this);
    if ( !v9 )
    {
      v6 = -2147024882;
errRet1:
      _lastMoniker->ISelfUnknownVtbl->Release(_lastMoniker);
      _pmkNewRef = (IUnknown *)pmkNewLeft;
      if ( pmkNewLeft )
LABEL_14:
        ((void (__stdcall *)(IUnknown *))_pmkNewRef->vfptr->Release)(_pmkNewRef);
      return v6;
    }
    if ( pmkToLeft )
    {
      v12 = ((int (__stdcall *)(IMoniker *, IMoniker *, _DWORD, IMoniker **, int))pmkToLeft->ISelfUnknownVtbl->ComposeWith)(
              pmkToLeft,
              _lastMoniker,
              0,
              &pmkNewLeft,
              v13);
      v6 = v12;
      if ( v12 < 0 )
        goto errRet2;
    }
    else
    {
      pmkNewLeft = _lastMoniker;
      ((void (__stdcall *)(IMoniker *, int))_lastMoniker->ISelfUnknownVtbl->AddRef)(_lastMoniker, v13);
    }
    v6 = v9->ISelfUnknownVtbl->BindToObject(v9, pbc, pmkNewLeft, riidResult, ppvResult);
errRet2:
    ((void (*)(void))v9->ISelfUnknownVtbl->Release)();
    goto errRet1;
  }
  return -2147024809;
}