From 679566ca8f0cf9c9d8f3654f88dfb5f686abb345 Mon Sep 17 00:00:00 2001
From: James Forshaw <tyranid@gmail.com>
Date: Mon, 12 Jun 2017 15:44:50 +0100
Subject: [PATCH] Added activation filter.

---
 OleViewDotNet/COMInterfaces.cs | 10 ++++++++++
 OleViewDotNet/COMUtilities.cs  |  3 +++
 OleViewDotNet/Program.cs       | 19 +++++++++++++++++--
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/OleViewDotNet/COMInterfaces.cs b/OleViewDotNet/COMInterfaces.cs
index b781fa54..e7fb7270 100644
--- a/OleViewDotNet/COMInterfaces.cs
+++ b/OleViewDotNet/COMInterfaces.cs
@@ -253,4 +253,14 @@ public interface IDispatch
         void Invoke(int dispIdMember, ref Guid riid, uint lcid, ushort wFlags, System.Runtime.InteropServices.ComTypes.DISPPARAMS[] pDispParams,
                     out VariantWrapper pVarResult, ref System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, out uint puArgErr);
     }
+
+    [Guid("00000017-0000-0000-C000-000000000046"), 
+        InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    public interface IActivationFilter
+    {
+        void HandleActivation(
+            uint dwActivationType,
+            ref Guid rclsid,
+            out Guid pReplacementClsId);
+    };
 }
diff --git a/OleViewDotNet/COMUtilities.cs b/OleViewDotNet/COMUtilities.cs
index 19429440..c1fb2645 100644
--- a/OleViewDotNet/COMUtilities.cs
+++ b/OleViewDotNet/COMUtilities.cs
@@ -385,6 +385,9 @@ public static extern object CoUnmarshalInterface(
             ref Guid riid
         );
 
+        [DllImport("ole32.dll", CallingConvention = CallingConvention.StdCall, CharSet = CharSet.Unicode)]
+        public static extern int CoRegisterActivationFilter(IActivationFilter pActivationFilter);
+
         private static Dictionary<Guid, Assembly> m_typelibs;
         private static Dictionary<string, Assembly> m_typelibsname;
         private static Dictionary<Guid, Type> m_iidtypes;
diff --git a/OleViewDotNet/Program.cs b/OleViewDotNet/Program.cs
index 0427d225..32efcb74 100644
--- a/OleViewDotNet/Program.cs
+++ b/OleViewDotNet/Program.cs
@@ -125,6 +125,15 @@ protected override void OnMainFormClosed(object sender, EventArgs e)
             }
         }
 
+        class ActivationFilter : IActivationFilter
+        {
+            public void HandleActivation(uint dwActivationType, ref Guid rclsid, out Guid pReplacementClsId)
+            {
+                pReplacementClsId = rclsid;
+                System.Diagnostics.Trace.WriteLine(String.Format("{0:X} {1}", dwActivationType, rclsid));
+            }
+        }
+
         static IEnumerable<COMServerType> ParseServerTypes(string servers)
         {
             string[] ss = servers.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries);
@@ -144,6 +153,7 @@ public static void Main(string[] args)
             bool query_interfaces = false;
             int concurrent_queries = Environment.ProcessorCount;
             bool refresh_interfaces = false;
+            bool enable_activation_filter = false;
             COMRegistryMode mode = COMRegistryMode.Merged;
             IEnumerable<COMServerType> server_types = new COMServerType[] { COMServerType.InProcHandler32, COMServerType.InProcServer32, COMServerType.LocalServer32 };
             
@@ -155,8 +165,9 @@ public static void Main(string[] args)
                 { "c|conn=", "Number of concurrent interface queries", v => concurrent_queries = int.Parse(v) },
                 { "s|server=", "Specify server types for query", v => server_types = ParseServerTypes(v) },
                 { "refresh", "Refresh interfaces in query", v => refresh_interfaces = v != null },
-                { "m",  "Loading mode is machine only.", v => mode = COMRegistryMode.MachineOnly },
-                { "u",  "Loading mode is user only.", v => mode = COMRegistryMode.UserOnly },
+                { "m", "Loading mode is machine only.", v => mode = COMRegistryMode.MachineOnly },
+                { "u", "Loading mode is user only.", v => mode = COMRegistryMode.UserOnly },
+                { "a", "Enable activation filter.", v => enable_activation_filter = v != null },
                 { "h|help",  "Show this message and exit.", v => show_help = v != null },
             };
 
@@ -219,6 +230,10 @@ public static void Main(string[] args)
                     }
 
                     _appContext = new MultiApplicationContext(new MainForm(registry));
+                    if (enable_activation_filter)
+                    {
+                        COMUtilities.CoRegisterActivationFilter(new ActivationFilter());
+                    }
                     Application.Run(_appContext);
                 }
                 catch (Exception ex)