Post #4167056

Seems that the trick I used in https://projectzero.google/2025/01/windows-bug-class-accessing-trapped-com.html by calling ITypeInfo::CreateInstance cross process has been blocked. Sort of. They've "fixed" it in a bizarre way, there's now a new AppCompat key, which doesn't exist by default. It's HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ITypeInfoCreateInstanceSettings and in that you need a AllowedOutOfProcIIDList REG_MULTI_SZ value which provides the allow list for the CreateInstance call which is checked in the stub function. However it's not allow listing CLSIDs, it's allow listing the IID you request. I guess the idea is you put a very specific IID in there which only a specific class can satisfy, as if someone puts in IID_IUnknown it all falls apart. TBH this only really fixes a risk of EoP. It doesn't block the PPL attack vector, at least from admin as they can just modify this key. And I think I have a way of getting it work even without admin ;)