Questions tagged [com]
Use this tag for questions on Component Object Model or ActiveX. For DOS .COM files, use dos-com instead.
17
questions
2
votes
1
answer
94
views
Programmatically Find COM Object Method Offset in Image from Method Name
What is a way to lookup a COM method offset with an image, just based on the module name and method name.
For example want to find "Exec" method in "WScript.Shell" In this scenario ...
- 1,235
1
vote
0
answers
61
views
Breakpoints in InProc COM object .dll?
I have a very simple exe that just uses CoCreateInstance to load a COM dll. This dll contains 1 function. I know where it is, I know what it's called etc. I know where in the exe it calls it. But ...
- 56
1
vote
0
answers
102
views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
- 1,235
4
votes
3
answers
4k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
4
votes
1
answer
819
views
Load .IDL / TypeLib into Ida Pro
I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool).
Is there a way to load the ...
- 3,228
1
vote
1
answer
119
views
ODA generates data segment instead of code (8086 COM hexdump)
I upload an hexdump of 8086 COM file and want to compile it into a COM executable that is running. (I don't upload it, because it is a riddle)
Since it is a COM file it should start at 100h. But ODA ...
- 141
1
vote
2
answers
4k
views
How to add/find parameters to a function declaration in IDA/HexRays?
I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode:
...
- 1,569
2
votes
1
answer
570
views
What are guidelines to find COM functions definition through a proxy DLL? [duplicate]
I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows S_OK with CoCreateInstance() and all ...
- 1,569
2
votes
0
answers
352
views
COM interface call from managed code
I have managed assembly that calls COM interface methods. I am interested in IManager interface, here is the code from NET Reflector:
namespace Lib
{
[ComImport, CompilerGenerated, CoClass(...
- 21
1
vote
0
answers
91
views
Understanding IE11's Ineterprocess Communication via COM
I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
- 215
5
votes
2
answers
4k
views
IDA Pro list COM methods
I have a dll file, containing some exported functions and COM methods.
Here is my dll information opened by DLL Export Viewer:
But when i open the dll file in ida pro, i see just exported functions ...
- 51
3
votes
2
answers
636
views
Crash after exe modification [closed]
I am testing a malware that built as COM EXE service. This exe file has a digital signature.
I succeeded to remove the digital signature for trying to modify it for reverse engineering tests.
But when ...
- 211
0
votes
1
answer
247
views
Logging COM calls with OllyDBG
I want to look at directx calls with ollydbg, and log and decode all parameters. Somebody knows how to do that?
1
vote
1
answer
182
views
Patch methods in COM dll
I have COM DLL with one class and one interface.
When I open it with COMView I see all the methods in the class/interface.
I want to modify the behavior of one method in this COM but I don't know how....
- 211
2
votes
1
answer
818
views
Trouble with ActiveX Reverseengineering (DispCallFunc Trick does not work)
It is common to set a breakpoint on oleaut32!DispCallFunc to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got ...
- 329
3
votes
2
answers
2k
views
OCX methods execution monitoring
I have a OCX control which is loaded in Internet Explorer (used to show stream from IP camera). To see live video I have to properly connect to server etc. using methods of created object. The best ...
- 385
17
votes
1
answer
5k
views
COM interface methods
I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?)
push offset ppv ; Address of ...
- 173