Skip to main content

Questions tagged [com]

Use this tag for questions on Component Object Model or ActiveX. For DOS .COM files, use dos-com instead.

Filter by
Sorted by
Tagged with
2 votes
1 answer
95 views

Programmatically Find COM Object Method Offset in Image from Method Name

What is a way to lookup a COM method offset with an image, just based on the module name and method name. For example want to find "Exec" method in "WScript.Shell" In this scenario ...
chentiangemalc's user avatar
1 vote
0 answers
61 views

Breakpoints in InProc COM object .dll?

I have a very simple exe that just uses CoCreateInstance to load a COM dll. This dll contains 1 function. I know where it is, I know what it's called etc. I know where in the exe it calls it. But ...
FrankRizzo's user avatar
1 vote
0 answers
102 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
chentiangemalc's user avatar
4 votes
3 answers
4k views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
Anton.P's user avatar
  • 143
4 votes
1 answer
830 views

Load .IDL / TypeLib into Ida Pro

I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool). Is there a way to load the ...
Remko's user avatar
  • 3,273
1 vote
1 answer
119 views

ODA generates data segment instead of code (8086 COM hexdump)

I upload an hexdump of 8086 COM file and want to compile it into a COM executable that is running. (I don't upload it, because it is a riddle) Since it is a COM file it should start at 100h. But ODA ...
user1387682's user avatar
1 vote
2 answers
4k views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
Biswapriyo's user avatar
  • 1,569
2 votes
1 answer
576 views

What are guidelines to find COM functions definition through a proxy DLL? [duplicate]

I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows S_OK with CoCreateInstance() and all ...
Biswapriyo's user avatar
  • 1,569
2 votes
0 answers
352 views

COM interface call from managed code

I have managed assembly that calls COM interface methods. I am interested in IManager interface, here is the code from NET Reflector: namespace Lib { [ComImport, CompilerGenerated, CoClass(...
igntec's user avatar
  • 21
1 vote
0 answers
91 views

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
Dev.K.'s user avatar
  • 215
5 votes
2 answers
4k views

IDA Pro list COM methods

I have a dll file, containing some exported functions and COM methods. Here is my dll information opened by DLL Export Viewer: But when i open the dll file in ida pro, i see just exported functions ...
newmrd's user avatar
  • 51
3 votes
2 answers
636 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file has a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But when ...
nrofis's user avatar
  • 211
0 votes
1 answer
248 views

Logging COM calls with OllyDBG

I want to look at directx calls with ollydbg, and log and decode all parameters. Somebody knows how to do that?
Borbon Hause's user avatar
1 vote
1 answer
184 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
nrofis's user avatar
  • 211
2 votes
1 answer
819 views

Trouble with ActiveX Reverseengineering (DispCallFunc Trick does not work)

It is common to set a breakpoint on oleaut32!DispCallFunc to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got ...
Jaewon Min's user avatar
3 votes
2 answers
2k views

OCX methods execution monitoring

I have a OCX control which is loaded in Internet Explorer (used to show stream from IP camera). To see live video I have to properly connect to server etc. using methods of created object. The best ...
n3vermind's user avatar
  • 385
17 votes
1 answer
5k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...
astrophonic's user avatar