2

When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.

How can I see this ActiveX code(where does the code located) and debug this code with Ida?

2

ActiveX controls (.ocx) are actually simple DLLs conforming to the COM standard. In practice, it means that it exports standard COM entry points such as:

 DllRegisterServer
 DllUnregisterServer
 DllCanUnloadNow
 DllGetClassObject

The most important for us is DllGetClassObject as this is the one called by the host process to create the ActiveX control(s).

To see where the code is located, you need to find the file implementing it. in IE, it can be done from "Manage Add-Ons" dialog.


For example, here are the details for the Flash control:

Name:                   Shockwave Flash Object
Publisher:              Microsoft Windows Third Party Application Component
Type:                   ActiveX Control
Architecture:           32-bit and 64-bit
Version:                32.0.0.387
File date:              ‎3 ‎June, ‎2020, ‏‎03:53
Date last accessed:     ‎16 ‎June, ‎2020, ‏‎21:19
Class ID:               {D27CDB6E-AE6D-11CF-96B8-444553540000}
Use count:              52850
Block count:            18
File:                   Flash.ocx
Folder:                 C:\Windows\System32\Macromed\Flash

So, we need to analyze Flash.ocx (in C:\Windows\System32\Macromed\Flash for 64-bit or C:\Windows\SysWow64\Macromed\Flash for 32-bit IE).

To debug, set the full path to the file in Debugger-Process Options-Input File, set breakpoint on DllGetClassObject then attach to the IE process. Once a page with a Flash control is loaded the breakpoint should trigger.

| improve this answer | |
  • I looking at IE Manage Add-Ons and found my activeX path, tgere in no ocx file there, only few dll, but when I open the dll and put breakpoint in place that I know it called and attach to IE process, after few seconds Ida detach from process without break in this place – yfr24493AzzrggAcom Jun 19 at 5:37
  • @yfr24493AzzrggAcom check if you see the dll load event in the output window. Maybe the path is wrong. – Igor Skochinsky Jun 19 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.