sR6uWE

IPC: MESSAGE 0X0C1000• Windows Error-Reporting Request– Typical: AppA -> DWWIN.EXE (on AppA)– WINWORD: Sandbox ->[0x0C1000]-> Broker -> DWWIN.EXE (on Sandbox)• JOBOBJECT_BASIC_LIMIT_INFORMATION.ActiveProcessLimit = 1• Definition– hSandboxSharedMem: Memory that sandbox shares with broker– hBrokerSharedMem: Memory that broker shares with DWWINMessage Body for 0x0C1000 RequestSize Field CommentHANDLE hSandboxSharedMem -HANDLE hEventBrokerIsDoneBroker sets this event after DW20.EXE exits and before itterminates sandboxLPWSTR lpwAdditionalWerFileName Pointer to wzAdditionalWerFileName, or NullUINT16 ui16AdditionalWerFileNameSize -WCHAR[] wzAdditionalWerFileNameAn additional file to be submitted to WER server, to becreated by Protected-View sandboxLabs.mwrinfosecurity.com | © MWR Labs 33