When doing RE on some Microsoft binaries I run across COM object references all the time. Is there a good central place to translate some of the GUID's that I find to some sort of object type without having to follow it back to some known parent (if I am lucky?). Would there be interest in establishing such a repository?
Add a comment
|
2 Answers
There is such a list here:
http://mikolajapp.appspot.com/uuid/uuidmap
If you use IDA, consider enabling the COM Helper plugin. When you create an instance of a GUID structure, it checks the list loaded from cfg/clsid.cfg and, if a match found, renames the location automatically and tries to import "<Classname>Vtbl" structure from the loaded type libraries, so you can start using that structure to identify called methods.
Here's a short demo:
answered Mar 19, 2013 at 20:57
-
Thanks for the reply Igor. Do you know if there are any type libraries out there for some of the COM objects not typically public in the Microsoft Symbols (such as IE and some of the more specialized Win32k and Office objects). I have RE'd a lot of them the hard way and it would be nice if there was somewhere that I could give back so that other people wouldn't have to go through the same pain.– ModocMar 20, 2013 at 2:05
-
-
Unfortunately, mikolajapp.appspot.com seems to have broken at some point: it still responds to HTTP requests, but seems to give 404 no matter what you ask for. (It gives me the distinct impression that it got wiped and never re-deployed.) There's a slight possibility that some archive service managed to snag a copy of the downloadable version, but I did not manage to discover one.– SamBSep 30, 2016 at 19:30
I don't know of any repository but the Ole/COM Object Viewer (oleview.exe) does a lot of the dereferencing in a reasonably convenient way. I think it comes with most Visual Studios and is in various Windows resource kits.
-
Um, could you be more specific? Where do I a paste the GUID for which to search?– SamBSep 30, 2016 at 19:32