📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  How to find addresses of the Interface method in COM

Topic created on: October 16, 2009 07:14 CDT by ronnie291983 .

hi

Can somebody point me to a tool or script (IDA/OLLY) that wud fetch interface method addresses from Virtual function table of a COM component.

  AmesianX     October 23, 2009 01:04.38 CDT
This is my article for COM Interface Dump Algorithm..
(LINK: hxxp://simples.kr/bbs/board.php?bo_table=04_4&wr_id=94          - powerhacker forum -)

and Alreay exist the COM DUMP IDA Plugin..

Find IDA COM Helper Plugin!(source code included)

thank you..

  AmesianX     October 23, 2009 01:24.05 CDT
COM Dump algorithm is very simple.

1. CoCreateInstance -> extract this pointer!
2. this+(index*4) is order for methods index.
3. find opcode for each methods.

COM model is the same C++. thus If you know C++,

can dump.. this+(index*4)..

clearly this is not this pointer.

you will need this pointer's virtual function table pointer.

vfpt(virtual function pointer)

---- IUnknown(Restricted Zone) ----
0. QueryInterface  (vfpt+(index*4) <= index is 0)
1. AddRef   (vfpt+(index*4) <= index is 1)
2. Release  (vfpt+(index*4) <= index is 2)
------- IDispatch [Restricted Zone] ----------
3. GetTypeInfoCount   (vfpt+(index*4) <= index is 3)
4. GetTypeInfo     (vfpt+(index*4) <= index is 4)
5. GetIDsOfNames   (vfpt+(index*4) <= index is 5)
6. Invoke          (vfpt+(index*4) <= index is 6)
------ Inherited Private Zone [Access Zone] ----------------
7. PrivateDeveloperFunc_0  (vfpt+(index*4) <= index is 7)
8. PrivateDeveloperFunc_1  (vfpt+(index*4) <= index is 8)
9. PrivateDeveloperFunc_2  (vfpt+(index*4) <= index is 9)
10. ...                    (vfpt+(index*4) <= index is 10)
------ Inherited Private Zone2 [Access Zone] ---------
11. OtherGeekDeveloperFunc_0 (vfpt+(index*4) <= index is 11)
12. OtherGeekDeveloperFunc_1 (vfpt+(index*4) <= index is 12)
13. OtherGeekDeveloperFunc_2 (vfpt+(index*4) <= index is 13)
14. OtherGeekDeveloperFunc_3 (vfpt+(index*4) <= index is 14)
...
...

unlimited inheritance classes..

Dump is very simple..

COM's index call is really used to internal call..

Thus COM isn't need pointer about the script language..

just you need to know the index..

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit