📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  IDA and Reversing Type Libraries

Topic created on: March 17, 2008 07:56 CDT by mori .

Hi all.
I was wondering if there was a way of interfacing with a tlb which interfaces with the application being decompiled?
Effectively, I have one function in the TLB which I want to decompile, and I can't seem to set a trace at all (application errors out).
As it is, i'm not getting any named functions which represent the functions I can call using the TLB.

Thanks,
Brian

  mori     March 19, 2008 00:06.24 CDT
Actually, I will just be happy to know how to translate a function definition inside a TLB type library, through to a code location in the EXE.

Can anyone help me out?

  nunsnmoses     March 19, 2008 19:07.44 CDT
maybe try TLB Viewer ? (google should help here). It gives you all the info contained in the TypeLib in the Resouces Section of the exe - (TypeLib [msft tag] is just supposedly a partially compiled IDL). After this use the Helper IDA Python scripts for OLE/Com on this website which help create the more standard Vtable Structures. its not the full solution - but gets you a fair distance. Basically once you have the IDL file - guesssing the Vtable structure should be straightforward - shouldnt it ?

  nunsnmoses     March 19, 2008 19:13.22 CDT
- theres some really good info here as well ..
http://www.openrce.org/articles/full_view/17

  mori     March 25, 2008 19:56.19 CDT
I've had some success, and will update this thread once I achive my target.
Thanks for your help nuns..

  AlvinChipmunk   December 3, 2008 22:06.52 CST
Although this is a little late, there's a page with the typelib format specification here:
http://theircorp.byethost11.com/index.php?vw=TypeLib
There's also an open source "dumper" for typelib data. It will get the typelib data from
EXE's, DLL's and OCX's without using the Win32API to do it. It actually ignores the file's
extension and checks its internal format.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit