


```plantuml
    skinparam defaultFontName Consolas
    autonumber
    participant "combase!CStdProxyBuffer_CF_AddRef" as combase
    participant "msctf!CCompartmentEventSink::OnChange" as msctf
    participant "kernel32!LoadLibraryA" as LoadLibraryA

    note left of combase
        RCX = [RCX - 0x38]
        RAX = [RCX]
        RAX = [RAX + 8]
        JMP RAX
    end note
    note right of msctf
        RAX = [RCX + 0x30]
        RCX = [RCX + 0x38]
        JMP RAX
    end note

    combase ->> msctf: Set RCX to our Object in PORT_MESSAGE
    msctf   ->> combase: Set RCX to FakeObject+0x38 in KERNEL32
    combase ->> msctf: Set RCX to RCX-0x38, i.e. FakeObject
    msctf   ->> LoadLibraryA: Set RAX to LoadLibrary, and RCX to FakeObject.PayloadString
```

```plantuml
skinparam defaultFontName Consolas

Class FakeObject <<K, white>> {
    0x00 PVOID ObjectAddress
    --
    0x08 PVOID MSCTF!CCompartmentEventSink::OnChange
    --
    0x10 PVOID Unused
    --
    0x18 PVOID Unused
    --
    0x20 PVOID Unused
    --
    0x28 PVOID Unused
    --
    0x30 PVOID Kernel32!LoadLibraryA
    --
    0x38 PVOID PayloadString
    --
    "..\\TEMP\\EXPLOIT"
}
FakeObject::ObjectAddress -right-> FakeObject
```

asd

```plantuml
    participant Gadget as "msvcrt!_init_time"
    participant Object as "FakeObject"

    loop Pointer
        Gadget->>Object: Object Address
    end
    loop Pointer
        Gadget->>Object: combase!CStdProxyBuffer_CF_AddRef
    end
    loop Pointer
        Gadget->>Object: msctf!CCompartmentEventSink::OnChange
    end
    loop Pointer
        Gadget->>Object: combase!CStdProxtBuffer_CF_Release
    end
    loop Pointer
        Gadget->>Object: msctf!CCompartmentEventSink::OnChange
    end
    loop Pointer
        Gadget->>Object: kernel32!LoadLibraryA
    end
    loop String
        Gadget->>Object: "..\TEMP\EXPLOIT"
    end
```


```plantuml
skinparam defaultTextAlignment center

namespace FakeObject {
    top to bottom direction 
    left to right direction 
    note left of field_00: 0x00
    object field_00 {
        00 00 00 00 00 00 00 00
    }
    
    note left of field_08: 0x08
    object field_08 {
        00 00 00 00 00 00 00 00
    }

    note left of field_10: 0x10
    object field_10 {
        00 00 00 00 00 00 00 00
    }

    note left of field_18: 0x18
    object field_18 {
        00 00 00 00 00 00 00 00
    }

    note left of field_20: 0x20
    object field_20 {
        00 00 00 00 00 00 00 00
    }
    note left of field_28: 0x28
    object field_28 {
        00 00 00 00 00 00 00 00
    }
    
    note left of field_30: 0x30
    object field_30 {
        00 00 00 00 00 00 00 00
    }
    
    note left of field_38: 0x38
    object field_38 {
        00 00 00 00 00 00 00 00
    }
    
    note left of field_40: 0x40
    object field_40 {
        00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00
    }
    field_00 --> field_00
    field_38 --left> field_40
}

```