Initiative

Ahhhhh, fuck. Google推出了Chrome Frame

其实就是一个特殊版本的Chrome，里面包含了一个npchrome_tab.dll

注册了一个CF:这样的Asynchronous Pluggable Protocols到IE，然后嵌入一个ActiveX的Chrome引擎代替IE来layout和javascript。目前还没有去测试cookie啊XSS啊XSRF特性，不过：

cf:javascript:alert(/fuck chrome/)

这个似乎没用。

注意看上面的截图，地址栏里显示的是cf:http://g.cn。说明什么？说明我们很方便地址栏钓鱼了。因为301/302跳转显示没变。

目前还发现一个问题就是cf:https://gmail.com 似乎没用。但是测试了下其他https网站似乎可用。

Google官方给出了一个CFInstall.js来探测Chrome Frame是否可用。

大概就是var obj = new ActiveXObject('ChromeTab.ChromeFrame'); 这一句了。

npchrome_tab.dll定义了几个导出函数：

CfLaunchChrome
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
RegisterNPAPIPlugin
UnregisterNPAPIPlugin

测试了下 rundll32 npchrome_tab.dll, CfLaunchChrome 可以启动 Chrome。不过把NPAPI引入IE会导致n多安全问题吧？

下面贴一个npchrome_tab.dll里的typelib：

ChromeTabLib; // ChromeTab 1.0 Type Library

Dispatch DIChromeFrameEvents;
GUID={A96B8A02-DD11-4936-8C0F-B2520289FABB};
function onload;
function onloaderror;
function onmessage(event:IDispatch);
function onreadystatechanged;
function onprivatemessage(event:IDispatch; target:BSTR);

Class HtmlFilter;
GUID={BB1176EE-20DD-41DC-9D1E-AC1335C7BBB0};
function QueryInterface(riid:^GUID; out ppvObj:^^void): HResult;
function AddRef: UI4;
function Release: UI4;

Class ChromeProtocol;
GUID={9875BFAF-B04D-445E-8A69-BE36838CDE3E};
function QueryInterface(riid:^GUID; out ppvObj:^^void): HResult;
function AddRef: UI4;
function Release: UI4;

Class ChromeActiveDocument;
GUID={3E1D0E7F-F5E3-44CC-AA6A-C0A637619AB8};
function QueryInterface(riid:^GUID; out ppvObj:^^void);
function AddRef: UI4;
function Release: UI4;
function GetTypeInfoCount(out pctinfo:^UINT);
function GetTypeInfo(itinfo:UINT; lcid:UI4; out pptinfo:^^void);
function GetIDsOfNames(riid:^GUID; rgszNames:^^I1; cNames:UINT; lcid:UI4; out rgdispid:^I4);
function Invoke(dispidMember:I4; riid:^GUID; lcid:UI4; wFlags:UI2; pdispparams:^DISPPARAMS; out pvarResult:^variant; out pexcepinfo:^EXCEPINFO; out puArgErr:^UINT);
property-get src: BSTR;
property-put src(BSTR);
function postMessage(message:BSTR; [target:variant]);
property-get onload: variant;
property-put onload(variant);
property-get onloaderror: variant;
property-put onloaderror(variant);
property-get onmessage: variant;
property-put onmessage(variant);
property-get readyState: I4;
function addEventListener(event_type:BSTR; listener:IDispatch; [use_capture:variant]);
function removeEventListener(event_type:BSTR; listener:IDispatch; [use_capture:variant]);
property-get version: BSTR;
function postPrivateMessage(message:BSTR; origin:BSTR; target:BSTR);
property-get useChromeNetwork: bool;
property-put useChromeNetwork(bool);

Dispatch IChromeFrame; // IChromeFrame Interface
GUID={B9F5EA20-C450-4F46-B70F-BFD3CA9A20C5};
function QueryInterface(riid:^GUID; out ppvObj:^^void);
function AddRef: UI4;
function Release: UI4;
function GetTypeInfoCount(out pctinfo:^UINT);
function GetTypeInfo(itinfo:UINT; lcid:UI4; out pptinfo:^^void);
function GetIDsOfNames(riid:^GUID; rgszNames:^^I1; cNames:UINT; lcid:UI4; out rgdispid:^I4);
function Invoke(dispidMember:I4; riid:^GUID; lcid:UI4; wFlags:UI2; pdispparams:^DISPPARAMS; out pvarResult:^variant; out pexcepinfo:^EXCEPINFO; out puArgErr:^UINT);
property-get src: BSTR;
property-put src(BSTR);
function postMessage(message:BSTR; [target:variant]);
property-get onload: variant;
property-put onload(variant);
property-get onloaderror: variant;
property-put onloaderror(variant);
property-get onmessage: variant;
property-put onmessage(variant);
property-get readyState: I4;
function addEventListener(event_type:BSTR; listener:IDispatch; [use_capture:variant]);
function removeEventListener(event_type:BSTR; listener:IDispatch; [use_capture:variant]);
property-get version: BSTR;
function postPrivateMessage(message:BSTR; origin:BSTR; target:BSTR);
property-get useChromeNetwork: bool;
property-put useChromeNetwork(bool);

Class ChromeFrame;
GUID={E0A900DF-9611-4446-86BD-4B1D47E7DB2A};
function QueryInterface(riid:^GUID; out ppvObj:^^void);
function AddRef: UI4;
function Release: UI4;
function GetTypeInfoCount(out pctinfo:^UINT);
function GetTypeInfo(itinfo:UINT; lcid:UI4; out pptinfo:^^void);
function GetIDsOfNames(riid:^GUID; rgszNames:^^I1; cNames:UINT; lcid:UI4; out rgdispid:^I4);
function Invoke(dispidMember:I4; riid:^GUID; lcid:UI4; wFlags:UI2; pdispparams:^DISPPARAMS; out pvarResult:^variant; out pexcepinfo:^EXCEPINFO; out puArgErr:^UINT);
property-get src: BSTR;
property-put src(BSTR);
function postMessage(message:BSTR; [target:variant]);
property-get onload: variant;
property-put onload(variant);
property-get onloaderror: variant;
property-put onloaderror(variant);
property-get onmessage: variant;
property-put onmessage(variant);
property-get readyState: I4;
function addEventListener(event_type:BSTR; listener:IDispatch; [use_capture:variant]);
function removeEventListener(event_type:BSTR; listener:IDispatch; [use_capture:variant]);
property-get version: BSTR;
function postPrivateMessage(message:BSTR; origin:BSTR; target:BSTR);
property-get useChromeNetwork: bool;
property-put useChromeNetwork(bool);
function onload;
function onloaderror;
function onmessage(event:IDispatch);
function onreadystatechanged;
function onprivatemessage(event:IDispatch; target:BSTR);

Class ChromeFrameBHO;
GUID={ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7};
function QueryInterface(riid:^GUID; out ppvObj:^^void): HResult;
function AddRef: UI4;
function Release: UI4;

问了下#chromium里的人，他们说源码还没公开。看得出来CF只是为了借Wave推广Chrome的一个小聪明。总体感觉Chrome Frame，想做到很安全，难。还是regsvr32 /u npchrome_tab.dll，早点卸了吧。