14

When doing RE on some Microsoft binaries I run across COM object references all the time. Is there a good central place to translate some of the GUID's that I find to some sort of object type without having to follow it back to some known parent (if I am lucky?). Would there be interest in establishing such a repository?

15

There is such a list here:

http://mikolajapp.appspot.com/uuid/uuidmap

If you use IDA, consider enabling the COM Helper plugin. When you create an instance of a GUID structure, it checks the list loaded from cfg/clsid.cfg and, if a match found, renames the location automatically and tries to import "<Classname>Vtbl" structure from the loaded type libraries, so you can start using that structure to identify called methods.

Here's a short demo:

enter image description here

| improve this answer | |
  • Thanks for the reply Igor. Do you know if there are any type libraries out there for some of the COM objects not typically public in the Microsoft Symbols (such as IE and some of the more specialized Win32k and Office objects). I have RE'd a lot of them the hard way and it would be nice if there was somewhere that I could give back so that other people wouldn't have to go through the same pain. – Modoc Mar 20 '13 at 2:05
  • Nope, never heard of anything like that. – Igor Skochinsky Mar 20 '13 at 14:00
  • Unfortunately, mikolajapp.appspot.com seems to have broken at some point: it still responds to HTTP requests, but seems to give 404 no matter what you ask for. (It gives me the distinct impression that it got wiped and never re-deployed.) There's a slight possibility that some archive service managed to snag a copy of the downloadable version, but I did not manage to discover one. – SamB Sep 30 '16 at 19:30
6

I don't know of any repository but the Ole/COM Object Viewer (oleview.exe) does a lot of the dereferencing in a reasonably convenient way. I think it comes with most Visual Studios and is in various Windows resource kits.

| improve this answer | |
  • Um, could you be more specific? Where do I a paste the GUID for which to search? – SamB Sep 30 '16 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.