Closed the-deniss closed 3 years ago
Thanks for another patch. It's good that you're willing to track this down and not just put up an issue, it's really appreciated. Interestingly Windows 10 finally has a field in the TEB which indicates the offset from the start of the TEB to the TEB32, but it's all a bit of a hack anyway so I don't think it's worth making it "correct".
The 64-bit powershell cannot properly parse COM classes registered in STA apartments in the x86 process. This is due to the fact that the field ReservedForOle is important for this parsing and it is retrieved from the thread's TEB64. But registering COM class in STA apartment initializes this field in the TEB32. Steps to reproduce:
(Get-ComProcess -Name OneDrive -ParseRegisteredClasses).Classes | Select ProcessId, ProcessName, Name, Clsid, Registered, Apartment | Format-Table