When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.

How can I see this ActiveX code(where does the code located) and debug this code with Ida?


ActiveX controls (.ocx) are actually simple DLLs conforming to the COM standard. In practice, it means that it exports standard COM entry points such as:


The most important for us is DllGetClassObject as this is the one called by the host process to create the ActiveX control(s).

To see where the code is located, you need to find the file implementing it. in IE, it can be done from "Manage Add-Ons" dialog.

For example, here are the details for the Flash control:

Name:                   Shockwave Flash Object
Publisher:              Microsoft Windows Third Party Application Component
Type:                   ActiveX Control
Architecture:           32-bit and 64-bit
File date:              ‎3 ‎June, ‎2020, ‏‎03:53
Date last accessed:     ‎16 ‎June, ‎2020, ‏‎21:19
Class ID:               {D27CDB6E-AE6D-11CF-96B8-444553540000}
Use count:              52850
Block count:            18
File:                   Flash.ocx
Folder:                 C:\Windows\System32\Macromed\Flash

So, we need to analyze Flash.ocx (in C:\Windows\System32\Macromed\Flash for 64-bit or C:\Windows\SysWow64\Macromed\Flash for 32-bit IE).

To debug, set the full path to the file in Debugger-Process Options-Input File, set breakpoint on DllGetClassObject then attach to the IE process. Once a page with a Flash control is loaded the breakpoint should trigger.

  • I looking at IE Manage Add-Ons and found my activeX path, tgere in no ocx file there, only few dll, but when I open the dll and put breakpoint in place that I know it called and attach to IE process, after few seconds Ida detach from process without break in this place Jun 19 '20 at 5:37
  • @yfr24493AzzrggAcom check if you see the dll load event in the output window. Maybe the path is wrong.
    – Igor Skochinsky
    Jun 19 '20 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.