Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/abarbatei/ida-utils

links, information and helper scripts for IDA Pro
https://github.com/abarbatei/ida-utils

com ida

Last synced: 19 minutes ago
JSON representation

links, information and helper scripts for IDA Pro

Awesome Lists containing this project

README 

        
# ida-utils



A small but brave and growing collection of advice, links and observations regarding reverse engineering using IDA Pro.



## Reversing COM binaries



### Understanding COM objects/binaries



[COM](https://msdn.microsoft.com/en-us/library/windows/desktop/ms694363(v=vs.85).aspx) - Component Object Model



https://www.codeproject.com/Articles/13601/COM-in-plain-C

- one of the best articles I have read. I highly recommend it



https://reverseengineering.stackexchange.com/questions/13282/ida-pro-list-com-methods

- a very informative thread



http://bytepointer.com/resources/index.htm

- a very interesting site. Highly recommend all the articles regarding COM



http://www.moserware.com/2008/01/finally-understanding-com-after.html

- interesting article with references to other good links for understanding COM



http://www.moserware.com/2009/04/using-obscure-windows-com-apis-in-net.html

- interesting article referenced in the previous recommendation



COM functions reside in ole32.dll `C:\Windows\System32\ole32.dll`



More information regarding COM can be found everywhere since [it is as old as me](https://en.wikipedia.org/wiki/Component_Object_Model).



### COM reversing tools



- [IDA Pro](https://www.hex-rays.com/products/ida/) :smile:

- [Win32 Python COM module](http://timgolden.me.uk/pywin32-docs/pythoncom.html)

- [RCE COM Tools library](http://www.woodmann.com/collaborative/tools/index.php/Category:COM_Tools)

- [Microsoft OLE-COM Object Viewer](https://msdn.microsoft.com/en-us/library/windows/desktop/ms688269(v=vs.85).aspx)

    - the binary comes when the Windows SDK. On my machine, I found the binary as follows (path and sample MD5 hash):



```

C:\Program Files (x86)\Windows Kits\10\bin\10.0.17134.0\arm64\oleview.exe - dd683d280b74d2cc2e6a31a574ac6da0

C:\Program Files (x86)\Windows Kits\10\bin\10.0.17134.0\x64\oleview.exe   - 3cec2bf41e410926f62e189bef547d30

C:\Program Files (x86)\Windows Kits\10\bin\10.0.17134.0\x86\oleview.exe   - 0eeccd530de75c398329a1ba0194614f

```



### Using IDA Pro



#### Types



As ashamed as I am, I must admit I originally did not know in what type library (if any) I could find the IDA structures relating to COM.



First I used IDA's load header feature to load headers such as [guiddef.h](https://github.com/tpn/winsdk-10/blob/master/Include/10.0.10240.0/shared/guiddef.h).

The files are originally found when installing the Windows SDK (in my case there were in `C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0`).

Initially I found most of my required headers, online, [here](https://github.com/tpn/winsdk-10/blob/master/Include/10.0.10240.0/) for example.



A second attempt was as to create an IDA .til file. Not knowing all the header files I would need I parsed the 133 functions pages displayed here: [MSDN list of functions that are provided by COM.](https://msdn.microsoft.com/en-us/library/windows/desktop/ms680586(v=vs.85).aspx) to find out that all the functions were exported by:

```

Callobj.h

Combaseapi.h

GuidDef.h

Messagedispatcherapi.h

Objbase.h

Ole2.h

Olectl.h

ROApi.h

Urlmon.h

```

witch I subsequently collected from the SDK in order to build into the .til. At this point I realised the types were probabil in a visual studio type library, something that IDA has.



The type library I was looking for was:

`vc9 - Visual Studio v9 headers (without windows.h)`

The header files are also found in `vc6win - Visual C++` but with a different flavor.



One could have used something similar to `for /R %i in (*.til) do (tilib.exe -lc "%i" | grep GUID -c | grep -v 0)` to find any referenced target structures, but where would the reverse engineering fun in that be?



After loading the type library and doing a type change, such beauty beholds, an example:

![IUnknown](/resources/IUnknown_type.png)



#### Scripts

Haven't found many.



- https://github.com/noobdoesre/py-com-tools



#### Plugins



IDA already comes with:



- [Dieter Spaar's COM Interface Plugin](https://www.hex-rays.com/products/ida/support/download.shtml)



- [Class Informer](https://sourceforge.net/projects/classinformer/) plugin by Sirmabus that can help reconstruct RTTI information for your COM object. It requires IDA Pro 6.9 or greater.