It is common to set a breakpoint on oleaut32!DispCallFunc to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got from some web file storage site and IE does not stop on DispCallFunc. Any other tricks to catch function call to ActiveX ?

  • Seems it is programmed in MFC
    – Jaewon Min
    Apr 4, 2014 at 8:09

1 Answer 1


You can use the !activex command in Immunity debugger to list and set breakpoints.

  • It does not seem to working. It fails to find ActiveX functions and print "ActiveX Methods Trapped"
    – Jaewon Min
    Apr 7, 2014 at 0:52
  • I've just verified the source code of the command (it's python in pycommands folder, the filename is the same as the command), the return value is normal, did you use these command ("!activex <name of Control> - this outputs all functions and their addresses.", "!activex <name of Control> break <function name> - set a breakpoint on a function name.") to inspect and break on your module, this is extracted from the usage message.
    – 3asm_
    Apr 7, 2014 at 9:06
  • Yest I used that command but it outputs "ActiveX Methods Trapped" message and no breakpoints are set :(
    – Jaewon Min
    Apr 9, 2014 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.