Timeline for What are guidelines to find COM functions definition through a proxy DLL?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 25, 2018 at 8:26 | vote | accept | Biswapriyo | ||
| May 24, 2018 at 14:31 | comment | added | Anton Kukoba | Yep, these ppv items are pointers, so in 32bit code the offsets will be a multiple of 4, in x64 - multiple of 8. Ex 0, 4, 8 vs 0, 8, 0x10 etc. | |
| May 24, 2018 at 12:22 | comment | added | Biswapriyo | Ia asked if the offsets are different in 32bit and 64bit. | |
| May 24, 2018 at 10:29 | comment | added | Anton Kukoba | It depends on the class hierarchy. Yes the first 3 methods in ppv are always QueryInterface, AddRef and Release due to all COM classes are derived from IUnknown. If the class is derived from IDispatch (which is derived from IUnknown), then there's going to be GetTypeInfoCount, GetTypeInfo, GetIDsOfNames and Invoke. And after those, there will be own methods of the COM class. | |
| Apr 23, 2018 at 7:33 | comment | added | Anton Kukoba | each pointer in vtable points to the function code, which you need to disasseble. One by one. | |
| Apr 19, 2018 at 8:29 | comment | added | Anton Kukoba | the only way is through disassembling. IDA may recognize the arguments count automatically, but the types of the arguments are up to you to reverse engineer. Also pay attention to the fact that COM methods pass the pointer to this as stack argument, not via ECX. I.e. first argument in COM methods is always this. | |
| Apr 19, 2018 at 7:59 | history | answered | Anton Kukoba | CC BY-SA 3.0 |