1

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected Mode).

This is an ASM snippet of a virtual function from ieframe.dll ( Part of class CShellUIHelper) which responsible for a COM operation (I've MS public symbol.)

CShellUIHelper::XX_XX{

..
..
    mov     eax, [ebp+var_2BC]
    lea     edx, [ebp+Filename]
    mov     edi, esp
    push    edx
    push    [ebp+var_2AC]
    mov     esi, [eax]
    push    ecx             ; _DWORD
    push    eax             ; _DWORD
    mov     esi, [esi+25Ch]
    mov     ecx, esi        ; _DWORD
    call    ds:___guard_check_icall_fptr
    call    esi             ; call {combase!ObjectStublessClient30+0x5c0

}

Here its calling a COM interface method at last line using call esi instruction which is actually call [esi+025Ch]. Runtime i've found its actually calling combase!ObjectStublessClient30(x,x)

Here I want to find the interface method name its calling using combase!ObjectStublessClient30().

To find the method name I'm follwing this RE.SE Answer, which looks pretty similar.

But the problem is, in this answer the interface name was known which is IShellWindows, but in my case the I dont know the interface name.

I'm stuck at this point. So my questions is what path I should follow to find out the interface name and method name.?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.