Patch methods in COM dll

Question

I have COM DLL with one class and one interface.
When I open it with COMView I see all the methods in the class/interface.

I want to modify the behavior of one method in this COM but I don't know how. I failed debugging it in debugger because it uses multiple threads and I couldn't find the DLL's code.

Is there a way to patch a function without using the debugger?

Answer 1

Debugging COM is indeed a bit on an issue, however you don't necessarily need to debug it in order to retrieve an address to the function you're interested in. Additionally, there are tricks to find COM related functions while debugging.

Once you got the function's address, simply open that COM dll with any patching tool and patch the assembly as you'd like. Just google for a binary patching tool you feel comfortable with.

There are basically three ways I can think of to get the address of that function:

1. First, the function you're interested in might be exported. This is not a requirement for COM servers to function in most cases but occasionally happens. If it is exported, this is obviously the easiest way to find it.
2. You could write a small executable that uses the COM server. That executable should call the function you're looking for, and by debugging it you will find the RVA of the function you're after. Just patch in memory and save (olly allows that, for example) or translate the RVA to file offset and patch statically.
3. This is a bit more difficult but still possible. You could statically find the COM object's virtual table and resolve it using type libraries. You could then get the function's offset just the same. See This Q&A for more info about type libraries.