📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  ActiveX Without Registration

Topic created on: September 14, 2007 07:00 CDT by MohammadHosein .

hey people
this may sound a bit weired , well the world itself is a weired  place .

i need to know if there is "any" way to use an Activex without registration , without touching registry and regsvr32 and underlaying APIs ? i am old and lazy to dig into COM crap , any of you ever thought of something like this ? is there any special pair of loadlibrary/getprocaddress to load a copy of target object and give me a handle ?

  jms     September 14, 2007 10:04.05 CDT
Well yeah it would be nice to be able to instantiate a COM object without registering it, however that kind of goes against the whole COM architecture. Using this Matt Pietrek article you may be able to try to load the object, determine the address of a function you want to call and then try to call that function, but there are a few roadblocks you will run into.

Defintely let us know if you make any headway.

  igorsk     September 14, 2007 10:26.48 CDT
MediaPlayerClassic does something like that.
http://guliverkli.svn.sourceforge.net/viewvc/guliverkli/trunk/guliverkli/src/apps/mplayerc/FakeFilterMapper2.cpp?view=markup
However, if you know the class' GUID, you can call DllGetClassObject directly to get its interface pointer.

  VLaaD     September 15, 2007 06:26.47 CDT
Try to experiment with the following COM API function: CoRegisterClassObject(...).

It exists even on Win2K, and it worked for me since then. In order to get a picture how it can be used, please find the class snippet (just for illustration, this is very old code) below the message text that I used to register custom URL schema.

This is, IMHO, extremely elegant solution, the only quirk is that you have to implement your own IClassFactory interface (just once, you can easily create a template), since this function needs it (and thats what you get when you call CoGetClassObject()). The good side of this is that your class factory can generate a lot of new instances you need.

If you specify REGCLS_MULTIPLEUSE and CLSCTX_LOCAL_SERVER this will implicitly set CLSCTX_INPROC_SERVER behavior, thus any application knowing your CLSID can get class factory and instantiate desired object; otherwise, specify REGCLS_SINGLEUSE, and only the caller process has access to the defined class factory, please see the Platform SDK documentation. On the end, do not forget to call CoRevokeClassObject().

HTH,
^VLaaD^

"En una pelicula de terror"

///// SNIP ////////////////////////////////////////////
BOOL CIPFactory::Initialize(LPCWSTR pcwszProtocol)
{
tInitialized=FALSE;
ulRef=0;
clsidProtocol=CLSID_NULL;
pwszScheme=NULL;
dwCookie=0;

if(CoCreateGuid(&clsidProtocol)!=S_OK)
return FALSE;

HRESULT hr;
if((hr=CoRegisterClassObject( clsidProtocol,
(IClassFactory*)this,
CLSCTX_INPROC_SERVER,
REGCLS_MULTI_SEPARATE,
&dwCookie))!=S_OK) {
clsidProtocol=CLSID_NULL;
return FALSE;
}

IInternetSession* pInternetSession;
pInternetSession=NULL;
if(CoInternetGetSession( 0,
&pInternetSession,
0)!=S_OK) {
clsidProtocol=CLSID_NULL;
return FALSE;
}

IClassFactory* pClassFactory;
pClassFactory=NULL;
if(CoGetClassObject( clsidProtocol,
CLSCTX_SERVER,
NULL,
IID_IClassFactory,
(LPVOID*)&pClassFactory)!=S_OK) {
pInternetSession->Release();
clsidProtocol=CLSID_NULL;
return FALSE;
}

hr=pInternetSession->RegisterNameSpace( this,
clsidProtocol,
pcwszProtocol,
0,
NULL,
0);
pInternetSession->Release();
pClassFactory->Release();

if(hr!=S_OK) {
clsidProtocol=CLSID_NULL;
return FALSE;
}

if((pwszScheme=new WCHAR[wcslen(pcwszProtocol)+1])==NULL) {
clsidProtocol=CLSID_NULL;
return FALSE;
}

wcscpy(pwszScheme, pcwszProtocol);
tInitialized=TRUE;

IP_TRACE(_T("IPFactory(%08X)::Initialize()"), this);

return TRUE;
}
///// SNIP ////////////////////////////////////////////

  JohnF     August 20, 2008 14:28.35 CDT
> i need to know if there is \"any\" way to use an Activex without registration , without touching registry and regsvr32 and underlaying APIs ?

yes, there is a way:
http://boxedapp.com/

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit