BH_US_12_Tsai_Pan_Exploiting_Windows8_WP

From the architecture view, there are three attack vectors: APLC, COM, and WinRT. Plus the
logic design flaw, we are going to discuss four attack vectors in following chapters:
Debug of ALPC
Attack COM Server
Attack WinRT
Discover Design Logic Flaw
2.4 DLLs and Writing Shellcode
Since there is no win32 COM API we can use directly, we need to write shellcode to use COM
APIs. There are something should be noted:
Originally COM API is in the ole32.dll, however, COM API has been moved to
combase.dll in Windows 8.
When you writing shellcode, InInitOrder.blink is the base address of kernelbase.dll, not
kernel32.dll.
There are still some WinRT COM APIs we can leverage, such as Ro* APIs.
10