Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Use this tag for questions on Component Object Model or ActiveX. For DOS .COM files, use dos-com instead.

3
votes
1answer
36 views

Load .IDL / TypeLib into Ida Pro

I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool). Is there a way to load the ...
0
votes
1answer
41 views

ODA generates data segment instead of code (8086 COM hexdump)

I upload an hexdump of 8086 COM file and want to compile it into a COM executable that is running. (I don't upload it, because it is a riddle) Since it is a COM file it should start at 100h. But ODA ...
1
vote
2answers
117 views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
1
vote
1answer
79 views

What are guidelines to find COM functions definition through a proxy DLL? [duplicate]

I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows S_OK with CoCreateInstance() and all ...
0
votes
0answers
57 views

Using an undocumented com object

I'm looking at what I believe to be a COM object dll. The exports that I see are DllCanUnloadNow, DllGetClassObject, and DllEntryPoint. I believe that this dll is responsible for launching an http ...
2
votes
0answers
137 views

COM interface call from managed code

I have managed assembly that calls COM interface methods. I am interested in IManager interface, here is the code from NET Reflector: namespace Lib { [ComImport, CompilerGenerated, CoClass(...
1
vote
0answers
60 views

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
5
votes
2answers
1k views

IDA Pro list COM methods

I have a dll file, containing some exported functions and COM methods. Here is my dll information opened by DLL Export Viewer: But when i open the dll file in ida pro, i see just exported functions ...
3
votes
2answers
273 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file had a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But ...
0
votes
1answer
133 views

Logging COM calls with OllyDBG

I want to look at directx calls with ollydbg, and log and decode all parameters. Somebody knows how to do that?
1
vote
1answer
93 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
2
votes
1answer
624 views

Trouble with ActiveX Reverseengineering (DispCallFunc Trick does not work)

It is common to set a breakpoint on oleaut32!DispCallFunc to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got ...
2
votes
2answers
1k views

OCX methods execution monitoring

I have a OCX control which is loaded in Internet Explorer (used to show stream from IP camera). To see live video I have to properly connect to server etc. using methods of created object. The best ...
16
votes
1answer
3k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...