2

It is common to set a breakpoint on oleaut32!DispCallFunc to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got from some web file storage site and IE does not stop on DispCallFunc. Any other tricks to catch function call to ActiveX ?

  • Seems it is programmed in MFC – Jaewon Min Apr 4 '14 at 8:09
2

You can use the !activex command in Immunity debugger to list and set breakpoints.

  • It does not seem to working. It fails to find ActiveX functions and print "ActiveX Methods Trapped" – Jaewon Min Apr 7 '14 at 0:52
  • I've just verified the source code of the command (it's python in pycommands folder, the filename is the same as the command), the return value is normal, did you use these command ("!activex <name of Control> - this outputs all functions and their addresses.", "!activex <name of Control> break <function name> - set a breakpoint on a function name.") to inspect and break on your module, this is extracted from the usage message. – 3asm_ Apr 7 '14 at 9:06
  • Yest I used that command but it outputs "ActiveX Methods Trapped" message and no breakpoints are set :( – Jaewon Min Apr 9 '14 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.