1

I've find a CoCreateInstance() in IDA disassembly (after CoInitializeEx()). Here are the assembly:

loc_18000499D:          ; pUnkOuter
xor     edx, edx
mov     [rsp+68h+ppv], rbx ; ppv
lea     r9, riid        ; riid
lea     rcx, rclsid     ; rclsid
lea     r8d, [rdx+4]    ; dwClsContext
call    cs:CoCreateInstance
mov     ebx, eax
mov     eax, 8007019Eh
cmp     ebx, 80040154h
cmovz   ebx, eax
test    ebx, ebx
jns     short loc_1800049D7

And the pseudocode is:

CoCreateInstance(&rclsid, 0i64, 4u, &riid, v4 + 1);

When I click the rclsid it is redirected to read-only data segment. Here is the .rdata section:

.rdata:0000000180007930 ; IID rclsid
.rdata:0000000180007930 rclsid          dd 4F476546h            ; Data1
.rdata:0000000180007930                                         ; DATA XREF: f_CoInitialize+A7↑o
.rdata:0000000180007930                 dw 0B412h               ; Data2
.rdata:0000000180007930                 dw 4579h                ; Data3
.rdata:0000000180007930                 db 0B6h, 4Ch, 12h, 3Dh, 0F3h, 31h, 0E3h, 0D6h; Data4
.rdata:0000000180007940 ; IID riid
.rdata:0000000180007940 riid            dd 536A6BCFh            ; Data1
.rdata:0000000180007940                                         ; DATA XREF: f_CoInitialize+A0↑o
.rdata:0000000180007940                 dw 0FE04h               ; Data2
.rdata:0000000180007940                 dw 41D9h                ; Data3
.rdata:0000000180007940                 db 0B9h, 78h, 0DCh, 0ACh, 2 dup(0A9h), 0B5h, 0B9h; Data4

So, How can I find the CLSID? I tried to change the data type with D key but can't understand it.

1
  • clsid is guid which is a structure either create the struct and apply it or create a 16 bytel long array with numpad * button
    – blabb
    Mar 14 '18 at 8:43
5

CLSID is a GUID and although a GUID can be represented as a string, it's really a struct that looks like this:

typedef struct _GUID {
  DWORD Data1;
  WORD  Data2;
  WORD  Data3;
  BYTE  Data4[8];
} GUID;

Although there is no way to display the GUID as a string in Ida you can convert it to a struct like this:

Select the 16 bytes that represent your CLSID, right click and select Structure from the Popup Menu. Then from the Sub menu select _GUID: Structure Menu

This is the result showing the Data1, Data2, Data3 and Data4 members Bytes converted to GUID struct

If you want to convert it to string you would need to create an idc script that does something like this: sprintf(szGuid, "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}", guid.Data1, guid.Data2, guid.Data3, guid.Data4[0], guid.Data4[1], guid.Data4[2], guid.Data4[3], guid.Data4[4], guid.Data4[5], guid.Data4[6], guid.Data4[7]);

1
  • An IID is a globally unique identifier (GUID) value, so they are the same.
    – Remko
    Mar 15 '18 at 12:09
2

From @Remko's idea, I made a IDC script to convert the GUID data to a sting. Here is the script:

#include <idc.idc>

static MakeGuid(ea)
{
    auto string = sprintf("{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}\n", 
        Dword(ea), Word(ea+4), Word(ea+6), Byte(ea+8), Byte(ea+9),
        Byte(ea+10), Byte(ea+11), Byte(ea+12), Byte(ea+13), Byte(ea+14), Byte(ea+15)
    Message(string);
    return 0;
}

Instructions:

Make a text file in any text editor. Add .IDC extension. Paste the above code. Load the IDC script file in IDA with Alt+F7 (or File > Load Script menu). Open the output window with Alt+0 (zero). Type MakeGuid(variable_name); below of that window and the GUID will be shown as string. For example, as in my question, type MakeGuid(rclsid);. Always put a semicolon after the function.

Sources:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.