Questions tagged [com]

Use this tag for questions on Component Object Model or ActiveX. For DOS .COM files, use dos-com instead.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Memory Viewer/Debugger for VBA

I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc. I want something like this: I.e. a GUI that has some of the ...
1
vote
0answers
51 views

Breakpoints in InProc COM object .dll?

I have a very simple exe that just uses CoCreateInstance to load a COM dll. This dll contains 1 function. I know where it is, I know what it's called etc. I know where in the exe it calls it. But ...
1
vote
0answers
71 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
4
votes
3answers
2k views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
4
votes
1answer
479 views

Load .IDL / TypeLib into Ida Pro

I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool). Is there a way to load the ...
1
vote
1answer
111 views

ODA generates data segment instead of code (8086 COM hexdump)

I upload an hexdump of 8086 COM file and want to compile it into a COM executable that is running. (I don't upload it, because it is a riddle) Since it is a COM file it should start at 100h. But ODA ...
1
vote
2answers
3k views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
1
vote
1answer
430 views

What are guidelines to find COM functions definition through a proxy DLL? [duplicate]

I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows S_OK with CoCreateInstance() and all ...
2
votes
0answers
330 views

COM interface call from managed code

I have managed assembly that calls COM interface methods. I am interested in IManager interface, here is the code from NET Reflector: namespace Lib { [ComImport, CompilerGenerated, CoClass(...
1
vote
0answers
86 views

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
5
votes
2answers
3k views

IDA Pro list COM methods

I have a dll file, containing some exported functions and COM methods. Here is my dll information opened by DLL Export Viewer: But when i open the dll file in ida pro, i see just exported functions ...
3
votes
2answers
574 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file has a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But when ...
0
votes
1answer
220 views

Logging COM calls with OllyDBG

I want to look at directx calls with ollydbg, and log and decode all parameters. Somebody knows how to do that?
1
vote
1answer
129 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
2
votes
1answer
770 views

Trouble with ActiveX Reverseengineering (DispCallFunc Trick does not work)

It is common to set a breakpoint on oleaut32!DispCallFunc to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got ...
2
votes
2answers
2k views

OCX methods execution monitoring

I have a OCX control which is loaded in Internet Explorer (used to show stream from IP camera). To see live video I have to properly connect to server etc. using methods of created object. The best ...
16
votes
1answer
4k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...