# Minimal PWA NUL-Byte PoC

This is a portable Windows repro package for the Chromium PWA launcher argument parsing issue.

The manifest-controlled app name contains a JSON-escaped NUL character followed by the argument-injection payload:

```text
Null Byte PWA\u0000 --single-argument --headless --utility-cmd-prefix=calc.exe inert
```

`calc.exe` is intentionally used without an absolute path so the package has no tester-specific paths.
On Windows, Chromium's app-specific launcher filename sanitization replaces the NUL with a filename-safe character, while preserving the switch text that follows it in the generated launcher name.

## Requirements

- Windows
- Google Chrome installed
- Python available as `python` or `py`

## Run

From this folder:

```powershell
powershell -ExecutionPolicy Bypass -File .\start.ps1
```

The script:

1. Detects Chrome automatically.
2. Starts a local HTTP server from `.\site`.
3. Creates `.\Open web+nullbytepwa trigger.url`.
4. Opens the local PWA page in Chrome.

Then:

1. Install the opened page as a PWA in Chrome.
2. Keep Chrome running.

The installed PWA window detects `display-mode: standalone` and automatically opens:

```text
web+nullbytepwa://auto-open
```

Expected vulnerable result: Calculator opens after the OS-dispatched protocol handler launches the installed PWA.

If Chrome suppresses the automatic protocol launch on a given build, open `Open web+nullbytepwa trigger.url` as the manual fallback. If this PWA was already installed from an older copy of the PoC, uninstall `NullByte` first and repeat the run.

Optional registry check after install:

```powershell
powershell -ExecutionPolicy Bypass -File .\check.ps1
```

## Evidence Pointers

- `site\manifest.webmanifest` contains the `\u0000` payload.
- `run\state.txt` records the local URL and trigger file for the current run.
- `run\http-server.out.txt` and `run\http-server.err.txt` contain local server output.

## Stop Server

```powershell
powershell -ExecutionPolicy Bypass -File .\stop.ps1
```

## Notes

- No public network target is contacted; the PWA is served from `127.0.0.1`.
- The package does not require any absolute path from the reporter's machine.
- To test another Chrome binary, set `CHROME_PATH` for the current shell before running `start.ps1`.