tyranid / oleviewdotnet

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container
GNU General Public License v3.0
1.1k stars 182 forks source link

Fix error parsing LocalServer32 cmdline in registry #30

Closed the-deniss closed 3 years ago

the-deniss commented 3 years ago

Code contains logical bug: if exists registry value \Software\Classes\Clsid\CLSID\LocalServer32\ServerExecutable, then value for command line is retrieved from it. But it's incorrect. Registry value \Software\Classes\Clsid\CLSID\LocalServer32\ServerExecutable contains the path to the server executable. And \Software\Classes\Clsid\CLSID\LocalServer32(Default) contains the command line to invoke an out-of-proc COM server

Steps to reproduce:

$c = Get-ComClass -Clsid 00f2b433-44e4-4d88-b2b0-2698a0a91dba
$c.Servers["LocalServer32"]
Server         : C:\Windows\System32\rundll32.exe
CommandLine    : C:\Windows\System32\rundll32.exe
ServerType     : LocalServer32
ThreadingModel : Both
DotNet         :
HasDotNet      : False
RawServer      : "%SystemRoot%\System32\rundll32.exe" "%ProgramFiles%\Windows Photo
                 Viewer\PhotoAcq.dll",AutoplayComServerW {00f2b433-44e4-4d88-b2b0-2698a0a91dba}

COM-object hosted in rundll32 without any command line looks weird.. With the proposed fix the output looks like:

Server         : C:\Windows\System32\rundll32.exe
CommandLine    : "C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoAcq.dll",AutoplayComServerW {00f2b433-44e4-4d88-b2b0-2698a0a91dba}
ServerType     : LocalServer32
ThreadingModel : Both
DotNet         :
HasDotNet      : False
RawServer      : "%SystemRoot%\System32\rundll32.exe" "%ProgramFiles%\Windows Photo Viewer\PhotoAcq.dll",AutoplayComServerW {00f2b433-44e4-4d88-b2b0-2698a0a91dba}
tyranid commented 3 years ago

Thanks for the patch.