Convert a string into a stream correctly - vb.net

Question

Imports System
Imports System.Runtime.InteropServices
Imports Microsoft.Win32
Imports System.IO
Imports System.IO.Compression
Imports System.Text
Namespace WindowScriptingObject
<Guid("7448E08D-ED0F-4E23-B528-91937BB41756"), _
InterfaceType(ComInterfaceType.InterfaceIsIDispatch)> _
Public Interface _WindowScriptingObject
<DispId(1)> Function Decompress(ByVal value as String) As String
End Interface
<Guid("B146BF9E-78FC-4DB0-ABFE-9FF026B43E4D"), _
ClassInterface(ClassInterfaceType.None), _
ProgId("WindowScriptingObject")> Public Class WindowScriptingObject
Implements _WindowScriptingObject
Public WindowScriptingObject()
Public Function Decompress(ByVal value as string) As String Implements _WindowScriptingObject.Decompress
Dim x As String
' on error resume next
Dim xstream As New MemoryStream(Encoding.Unicode.GetBytes(value))
Dim mem2 As New IO.MemoryStream()
'Dim streamMe As New StreamWriter(mem2,Encoding.UTF8)
'streamMe.Write(value)
'StreamMe.Close()
'mem2.Position=0
Dim gz As New System.IO.Compression.GZipStream(xstream, IO.Compression.CompressionMode.Decompress)
Dim sr As New IO.StreamReader(gz)
x = sr.ReadLine
sr.Close()
'End Using
Decompress = x
End Function
End Class
End Namespace
I verified the string I sent over contains the correct values from my VBScript. However, its says the header is bad.
The above code has to be compiled for testing
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /target:library /out:"%userprofile%\desktop\t.dll" "%userprofile%\desktop\t.txt" /verbose
Then registered
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm" /codebase "%userprofile%\desktop\t.dll" /tlb:"%userprofile%\desktop\t.tlb" /v
Then invoked
c:\windows\SysWOW64\cscript.exe old.vbs
I put code in to read the contents from a file, even though that is not the end goal. When I did that the file decompressed correctly.
Dim xstream As New MemoryStream(Encoding.Unicode.GetBytes(value))
This line hear seems to be incorrectly converting my string to a stream.
The goal is to send a compressed string and return a uncompressed string.
The code above is invoked with this code
Const adTypeBinary = 1
Set wso = CreateObject("WindowScriptingObject")
Dim objStream
Set objStream = CreateObject("ADODB.Stream")
objStream.Type = adTypeBinary
objStream.Open
objStream.LoadFromFile "e:\download\result.gz"
'objStream.Charset = "Windows-1252"
x = objStream.Read(900)
objStream.Close
For i=1 To Len(x)
t = t & Chr(AscW(Mid(x, i, 1)) And 255)
t = t & Chr((AscW(Mid(x, i, 1)) And 65280)/256)
Next
MsgBox wso.Decompress(t), , "vbs"
I tried this, and even converted the string to base64 to get it work.
Dim gzBuffer As Byte() = Convert.FromBase64String(value)
Using ms As New MemoryStream()
Dim msgLength As Integer = BitConverter.ToInt32(gzBuffer, 0)
ms.Write(gzBuffer, 4, gzBuffer.Length - 4)
Dim buffer As Byte() = New Byte(msgLength - 1) {}
ms.Position = 0
Using zipStream As New System.IO.Compression.GZipStream(ms, System.IO.Compression.CompressionMode.Decompress)
zipStream.Read(buffer, 0, buffer.Length)
End Using
Decompress=System.Text.Encoding.Unicode.GetString(buffer, 0, buffer.Length)
End Using
The data did not get converted correctly as I still have magic number in GZip header is not correct.
Dumped base64 encoded value into online decoder, and the string I passed in matches to decoded value.
Version 2
Forces me to base64 encode it, but then it works.
How do I remove this annoyance.
Imports System
Imports System.Runtime.InteropServices
Imports Microsoft.Win32
Imports System.IO
Imports System.IO.Compression
Imports System.Text
Namespace WindowScriptingObject
<Guid("7448E08D-ED0F-4E23-B528-91937BB41756"), _
InterfaceType(ComInterfaceType.InterfaceIsIDispatch)> _
Public Interface _WindowScriptingObject
<DispId(1)> Function Decompress(ByVal value as String) As String
End Interface
<Guid("B146BF9E-78FC-4DB0-ABFE-9FF026B43E4D"), _
ClassInterface(ClassInterfaceType.None), _
ProgId("WindowScriptingObject")> Public Class WindowScriptingObject
Implements _WindowScriptingObject
Public WindowScriptingObject()
Public Function Decompress(ByVal value as string) As String Implements _WindowScriptingObject.Decompress
Dim x As String
' on error resume next
Dim gzBuffer As Byte() = Convert.FromBase64String(value)
Using ms As New MemoryStream()
Dim msgLength As Integer = BitConverter.ToInt32(gzBuffer, 0)
ms.Write(gzBuffer, 0, gzBuffer.Length)
Dim buffer As Byte() = New Byte(msgLength - 1) {}
ms.Position = 0
Using zipStream As New System.IO.Compression.GZipStream(ms, System.IO.Compression.CompressionMode.Decompress)
zipStream.Read(buffer, 0, buffer.Length)
End Using
Decompress=System.Text.Encoding.ASCII.GetString(buffer, 0, buffer.Length)
End Using
' Dim xstream As New MemoryStream(value.ToArray())
Dim mem2 As New IO.MemoryStream()
'Dim streamMe As New StreamWriter(mem2,Encoding.UTF8)
'streamMe.Write(value)
'StreamMe.Close()
'mem2.Position=0
'Dim gz As New System.IO.Compression.GZipStream(xstream, IO.Compression.CompressionMode.Decompress)
'Dim sr As New IO.StreamReader(gz)
' x = sr.ReadLine
'sr.Close()
'End Using
'Decompress = x
End Function
End Class
End Namespace
Update this code works except the output size is 500K, and there's only 3100 bytes of text.
Imports System
Imports System.Runtime.InteropServices
Imports Microsoft.Win32
Imports System.IO
Imports System.IO.Compression
Imports System.Text
Namespace WindowScriptingObject
<Guid("7448E08D-ED0F-4E23-B528-91937BB41756"), _
InterfaceType(ComInterfaceType.InterfaceIsIDispatch)> _
Public Interface _WindowScriptingObject
<DispId(1)> Function Decompress(ByVal value as string) As String
End Interface
<Guid("B146BF9E-78FC-4DB0-ABFE-9FF026B43E4D"), _
ClassInterface(ClassInterfaceType.None), _
ProgId("WindowScriptingObject")> Public Class WindowScriptingObject
Implements _WindowScriptingObject
Public WindowScriptingObject()
Public Function Decompress(ByVal value as string) As String Implements _WindowScriptingObject.Decompress
' on error resume next
Dim gzBuffer() As Byte = System.Text.Encoding.Default.Getbytes(value)
Using ms As New MemoryStream()
Dim msgLength As Integer = BitConverter.ToInt32(gzBuffer, 0)
ms.Write(gzBuffer, 0, gzBuffer.Length)
msgbox(msgLength)
Dim buffer As Byte() = New Byte(msgLength - 1) {}
ms.Position = 0
Using zipStream As New System.IO.Compression.GZipStream(ms, System.IO.Compression.CompressionMode.Decompress)
zipStream.Read(buffer, 0, buffer.Length)
End Using
Decompress=System.Text.Encoding.Default.GetString(buffer, 0, buffer.Length)
End Using
End Function
End Class
End Namespace
For some reason msgLength is 559,903 in size, and the decompressed text is roughly 3100 bytes. This means BitConverter.toint32 is malfunctioning as gzBuffer is 865 bytes. The final output size is only know to the GZIPStream function as the text is compressed an the input size has no correlation to the output size.
The other question(s)
can this be coded more efficiently?
What can I do to prevent malicious code injection?
Limit output to the correct size?
If I add new functions do I need more Guid's?
How do I generate a new Guid?
In code block #3 I convert X to a string t and transfer value without conversion.
The output size seems to be based on bad information.
intOutputLength=zipStream.Read(buffer, 0, buffer.Length)
End Using
Decompress=System.Text.Encoding.Default.GetString(buffer, 0, intOutputLength)
At least this reduces the amount of data return to the main program.
Dim msgLength As Integer = BitConverter.ToInt32(gzBuffer, 0)
If I read this correctly the msgLength is determined by the first 4 characters of the input stream? Since the GZip header is always 1f 8b 08 00 this seems to be a horrible idea. If the output is every greater than 559k seems like a buffer overflow just waiting to happen.
I think this solves the terrible buffer size issue.
Imports System
Imports System.Runtime.InteropServices
Imports Microsoft.Win32
Imports System.IO
Imports System.IO.Compression
Imports System.Text
Namespace WindowScriptingObject
<Guid("7448E08D-ED0F-4E23-B528-91937BB41756"), _
InterfaceType(ComInterfaceType.InterfaceIsIDispatch)> _
Public Interface _WindowScriptingObject
<DispId(1)> Function Decompress(ByVal value as string) As String
End Interface
<Guid("B146BF9E-78FC-4DB0-ABFE-9FF026B43E4D"), _
ClassInterface(ClassInterfaceType.None), _
ProgId("WindowScriptingObject")> Public Class WindowScriptingObject
Implements _WindowScriptingObject
Public WindowScriptingObject()
Public Function Decompress(ByVal value as string) As String Implements _WindowScriptingObject.Decompress
' on error resume next
Dim gzBuffer() As Byte = System.Text.Encoding.Default.Getbytes(value)
dim intOutputLength as integer
Dim intBlock as integer
Decompress=""
Using ms As New MemoryStream()
Dim msgLength As Integer = 4096
ms.Write(gzBuffer, 0, gzBuffer.Length)
Dim buffer As Byte() = New Byte(4096) {}
ms.Position = 0
Using zipStream As New System.IO.Compression.GZipStream(ms, System.IO.Compression.CompressionMode.Decompress)
intOutputLength=0
intBlock=4096
while intBlock=4096
intBlock=zipStream.Read(buffer, 0, buffer.Length)
Decompress+=System.Text.Encoding.Default.GetString(buffer, 0, intBlock)
intOutputLength+=intBlock
end while
End Using
End Using
End Function
End Class
End Namespace

Answer 1

I was able to get your code working by changing the VB.NET function and interface to look like this (mainly changing the parameter type):
<Guid("7448E08E-ED0F-4E23-B528-91937BB41756"),
InterfaceType(ComInterfaceType.InterfaceIsIDispatch)>
Public Interface _WindowScriptingObject
<DispId(1)> Function Decompress(ByVal value As Byte()) As String
End Interface
Public Function Decompress(ByVal value As Byte()) As String Implements _WindowScriptingObject.Decompress
Using xstream As New MemoryStream(value)
Using gz As New System.IO.Compression.GZipStream(xstream, IO.Compression.CompressionMode.Decompress)
Using sr As New IO.StreamReader(gz)
Return sr.ReadLine()
End Using
End Using
End Using
End Function
My test VBS looks like this
Const adTypeBinary = 1
Dim wso
Set wso = CreateObject("WindowScriptingObject")
Dim objStream, x
Set objStream = CreateObject("ADODB.Stream")
objStream.Type = adTypeBinary
objStream.Open
objStream.LoadFromFile "c:\users\bluem\desktop\Notes.txt.gz"
x = objStream.Read(342737)
objStream.Close
WScript.StdOut.WriteLine wso.Decompress((x))
I'm not entirely sure why I needed to enclose the x parameter in two sets of parentheses, but I think it has something to do with forcing the parameter to be passed by value instead of by reference and helps it convert to a byte array. I was getting an error before I added the extra pair of parentheses.
Edit:
To answer some of your other questions:
I don't think you need to create a new GUID for a new function, only for a new interface or class.
To create a new GUID you can just copy an existing one and change part of it (to digits between 0 and F inclusive) to be unique, or you can go to https://www.guidgenerator.com/ or you can select "Create GUID" from Visual Studio's Tools menu.
If you can clarify your data length problem based on the new code (if a problem still exists), I might be able to answer.

Answer 2

It's been too long since I've written vbscript, so I don't know enough anymore to give fixes. However, I can point out some serious flaws in the vbscript part of this code.
It starts by reading up to 900 bytes from a .gz file, regardless of the actual length of file. Anything longer than a mere 900 bytes will be not read.
It performs this read in binary mode. Binary mode ignores any character set or encoding info, and just reads raw bytes, which is appropriate for a .gz file. However, the next thing that happens with this data is using the Len() function, which is for strings, not binary data; Len() is not the appropriate function here. Additionally, the data is next used in the For loop via the Mid() function. Mid() is likewise intended only for strings, and the x variant is not a string. vbscript string objects are more than just the raw characters; they include meta data for things like encoding, length, and character buffers, and those string functions rely on the objects being constructed properly with all metadata.
There's no way this vbscript produces correct results. Until that is resolved, there's no point in even looking at the vb.net code. Again, I'm too far gone to suggest a real solution, but I recommend trying to pass an unaltered byte array to the .Net side, rather than a string.