Flag: Tornado!
Hurricane!
|
|
 Error: Authentication required to access requested resource.
Topic created on: by  .
This is my article for COM Interface Dump Algorithm..
(LINK: hxxp://simples.kr/bbs/board.php?bo_table=04_4&wr_id=94 - powerhacker forum -)
and Alreay exist the COM DUMP IDA Plugin..
Find IDA COM Helper Plugin!(source code included)
thank you..
|
COM Dump algorithm is very simple.
1. CoCreateInstance -> extract this pointer!
2. this+(index*4) is order for methods index.
3. find opcode for each methods.
COM model is the same C++. thus If you know C++,
can dump.. this+(index*4)..
clearly this is not this pointer.
you will need this pointer's virtual function table pointer.
vfpt(virtual function pointer)
---- IUnknown(Restricted Zone) ----
0. QueryInterface (vfpt+(index*4) <= index is 0)
1. AddRef (vfpt+(index*4) <= index is 1)
2. Release (vfpt+(index*4) <= index is 2)
------- IDispatch [Restricted Zone] ----------
3. GetTypeInfoCount (vfpt+(index*4) <= index is 3)
4. GetTypeInfo (vfpt+(index*4) <= index is 4)
5. GetIDsOfNames (vfpt+(index*4) <= index is 5)
6. Invoke (vfpt+(index*4) <= index is 6)
------ Inherited Private Zone [Access Zone] ----------------
7. PrivateDeveloperFunc_0 (vfpt+(index*4) <= index is 7)
8. PrivateDeveloperFunc_1 (vfpt+(index*4) <= index is 8)
9. PrivateDeveloperFunc_2 (vfpt+(index*4) <= index is 9)
10. ... (vfpt+(index*4) <= index is 10)
------ Inherited Private Zone2 [Access Zone] ---------
11. OtherGeekDeveloperFunc_0 (vfpt+(index*4) <= index is 11)
12. OtherGeekDeveloperFunc_1 (vfpt+(index*4) <= index is 12)
13. OtherGeekDeveloperFunc_2 (vfpt+(index*4) <= index is 13)
14. OtherGeekDeveloperFunc_3 (vfpt+(index*4) <= index is 14)
...
...
unlimited inheritance classes..
Dump is very simple..
COM's index call is really used to internal call..
Thus COM isn't need pointer about the script language..
just you need to know the index..
|
Note: Registration is required to post to the forums.
|
|
|
|
There are 28,225 total registered users.
|
|
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}