RSS Feed

Windows IPC

Created: 12.10.2020

COM (Component Object Model) objects are a way to let processes call other processes. A process, that needs to call someone else loads a COM.dll into it’s address space.

Functions to get COM funcs: OleInitialize and ColnitializeEx. Pass CLSID (class id, 16 bytes GUID) / IID (interface id) to a CoCreateInstance. OS searches for a program that has this functionality. Returns a pointer to a function.

🛠 In IDA Pro use Add Standart Structure -> Add -> Interface Name Vtbl. Example: WebBrowser2Vtbl. Right-click the offset and change to WebBrowser2Vtbl.Navigate. IDA will label the parameters.

These CLSIDs are unique and listed here: HKLM\Software\Classes\CLSID and HKCU\Software\Classes\CLSID. Also lists the path to the dll to the object.