ObjectDataProvider
gadget
Reaching a .NET Framework 3.5 target needs --legacyfx, which rewrites the PresentationFramework identity to 3.0.0.0. Measured there on XmlSerializer and JavaScriptSerializer; DataContractSerializer binds every assembly and still fails to build the projected property on the 3.0 reader. The two MessagePack Typeless cells depend on the target's MessagePack version: MessagePack carries its own hardcoded deny list, and System.Windows.Data.ObjectDataProvider joined it in 2.5.205 and in 3.1.5. Below those (2.5.198 and 3.1.4 and older, which is every release the technique was published against) the list held only TempFileCollection and IWbemClassObjectFreeThreaded and the payload fires; on 2.5.205+ or 3.1.5+ the reader refuses it by name and nothing runs.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g ObjectDataProvider -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | Xaml, Json.NET, FastJson, JavaScriptSerializer, XmlSerializer, DataContractSerializer, YamlDotNet, FsPickler, SharpSerializerBinary, SharpSerializerXml, MessagePackTypeless, MessagePackTypelessLz4 | command | built-in, wpf, net-framework | net-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | Xaml, XmlSerializer, DataContractSerializer | command | built-in, wpf, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: plain ObjectDataProvider (default) (default)
- 2: ResourceDictionary wrapper (Xaml) / LosFormatter inner (XmlSerializer)
Options (1)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Payload variant number. The (N) formatter suffix counts these variants; bare formatters support only variant 1. Choices: 1, 2 based on formatter. NOTE: two variants left this gadget. Variant 3 was the ResourceDictionary XAML-url payload and is now the ResourceDictionary gadget, whose -c is the URI. Variant 4 was the WorkflowDesigner wrapper and is now the WorkflowDesigner gadget, which also reaches Json.NET, FastJson, JavaScriptSerializer, both SharpSerializer modes and both MessagePack Typeless flavours. Default value: "1". Suggested values: 1, 2. | 1 | false |
Credit: [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Alvaro Munoz, Soroush Dalili, Dane Evans]