Flag: Tornado! Hurricane!

Error: Authentication required to access requested resource.

 Forums >>    >> 

Topic created on: by .


  AmesianX     October 23, 2009 01:04.38 CDT
This is my article for COM Interface Dump Algorithm..
(LINK: hxxp://simples.kr/bbs/board.php?bo_table=04_4&wr_id=94          - powerhacker forum -)

and Alreay exist the COM DUMP IDA Plugin..

Find IDA COM Helper Plugin!(source code included)

thank you..

  AmesianX     October 23, 2009 01:24.05 CDT
COM Dump algorithm is very simple.

1. CoCreateInstance -> extract this pointer!
2. this+(index*4) is order for methods index.
3. find opcode for each methods.

COM model is the same C++. thus If you know C++,

can dump.. this+(index*4)..

clearly this is not this pointer.

you will need this pointer's virtual function table pointer.

vfpt(virtual function pointer)

---- IUnknown(Restricted Zone) ----
0. QueryInterface  (vfpt+(index*4) <= index is 0)
1. AddRef   (vfpt+(index*4) <= index is 1)
2. Release  (vfpt+(index*4) <= index is 2)
------- IDispatch [Restricted Zone] ----------
3. GetTypeInfoCount   (vfpt+(index*4) <= index is 3)
4. GetTypeInfo     (vfpt+(index*4) <= index is 4)
5. GetIDsOfNames   (vfpt+(index*4) <= index is 5)
6. Invoke          (vfpt+(index*4) <= index is 6)
------ Inherited Private Zone [Access Zone] ----------------
7. PrivateDeveloperFunc_0  (vfpt+(index*4) <= index is 7)
8. PrivateDeveloperFunc_1  (vfpt+(index*4) <= index is 8)
9. PrivateDeveloperFunc_2  (vfpt+(index*4) <= index is 9)
10. ...                    (vfpt+(index*4) <= index is 10)
------ Inherited Private Zone2 [Access Zone] ---------
11. OtherGeekDeveloperFunc_0 (vfpt+(index*4) <= index is 11)
12. OtherGeekDeveloperFunc_1 (vfpt+(index*4) <= index is 12)
13. OtherGeekDeveloperFunc_2 (vfpt+(index*4) <= index is 13)
14. OtherGeekDeveloperFunc_3 (vfpt+(index*4) <= index is 14)
...
...

unlimited inheritance classes..

Dump is very simple..

COM's index call is really used to internal call..

Thus COM isn't need pointer about the script language..

just you need to know the index..

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
NirIzr

There are 28,225 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit