0

I try to do COM without touching the registry. I started with a very simple C++ "client", trying to CoCreateInstance with ramdom arbitrary UUID.

#include <stdio.h>
#include <Windows.h>

int main() {

    HRESULT hr = CoInitializeEx(nullptr, COINIT_MULTITHREADED | COINIT_DISABLE_OLE1DDE);
    if (FAILED(hr)) {
        return 0;
    } // endif
    const IID SomeClass = { 42, 65535, 42, { 'H', 'e', 'l', 'l', 'o', ' ', 'S', 'O'} };
    const IID SomeInterface;
    memset((void*)&SomeInterface, (char)rand(), sizeof(SomeInterface));
    void * pInterface;
    hr = CoCreateInstance(SomeClass, nullptr, CLSCTX_INPROC_SERVER, SomeInterface, &pInterface );
    if (FAILED(hr)) {
        printf("'CoCreateInstance' failed with error 0x%X", hr);
    } // endif
    CoUninitialize();
    return 0;
}

As you could imagine, the output of the program is:

'CoCreateInstance' failed with error 0x80040154

(0x80040154 being the notorious 'Class Not Found')

I was told that in such a case Windows would search the image directory for one or more "manifest" files.

So far I have failed miserably to create such files, so as a last resort I drew procmon.exe.

I managed to get a CSV text file corresponding to the execution of the above program, using a filter that excludes any event not related to the process name.

Then I used Notepad++, and found some events related to RegOpenKey for my dummy "class", all ending with "NAME NOT FOUND"

I then searched for CreateFile Event with some "manifest" file extension and found none!

Question: why is there no access to some manifest files?

manuell
  • 7,528
  • 5
  • 31
  • 58
  • 2
    The OS first looks in the embedded resources of the .exe file for a manifest. You have one, no need to go looking for a file. It is missing the entries needed to find the COM server. Use File > Open > File and select the .exe to see the embedded manifest. – Hans Passant Oct 02 '21 at 14:16
  • @HansPassant VS2019 has indeed embed a manifest in my EXE, with data I don't care about (requestedExecutionLevel). I will delete this manifest and try again. Thank you! – manuell Oct 02 '21 at 18:00
  • @HansPassant I deleted the manifest in the exe. `mt.exe` confirms this. Still NO trace of Windows trying to access a "manifest" file. I thought it was possible to do "RegFree COM" by adding a manifest file next to the exe file. Where is my mistake here? – manuell Oct 02 '21 at 19:16
  • 1
    My experience is that Windows 10 is pretty aggressive about caching its knowledge of manifests. I'd suggest you need to do a complete rebuild, strip the manifest, and then try running again. You should see it trying to find a manifest. – Joseph Willcoxson Oct 03 '21 at 16:34
  • @JosephWillcoxson FYI see my answer... – manuell Oct 04 '21 at 07:12

1 Answers1

0

It's normal. I thought that after failing to found the class in the registry, my process will try to read some manifest from disk. Windows indeed try that, as I finally found out with Process Monitor, but not in my process!

The various CreateFile and friends calls concerning a "manifest" in the image directory take place in csrss.exe...

Mystery solved.

manuell
  • 7,528
  • 5
  • 31
  • 58