COM-Code-Helper – Two IDAPython Scripts Help You To Reconstruct Microsoft COM (Component Object Model) Code

Click the icon to Follow me:- twitterTelegramRedditDiscord
COM Code Helper 1 COM Code Before After 1

Two IDAPython Scripts help you to reconstruct Microsoft COM (Component Object Model) Code Especially malware reversers will find this useful, as COM Code is still regularly found in malware.

ClassAndInterfaceToNames.py

This IDAPython script scans an idb file for class and interfaces UUIDs and creates the matching structure and its name. Make sure to copy interfaces.txt + classes.txt is in the same directory as ClassAndInterfaceToNames.py

Microsoft-SDK-Vtable-Structs.py

This IDAPython script creates vtables derrived from Microsoft SDK. Execution of the script takes a while, as lot of structures are created. After the script finished, go to the COM code you like to reconstruct, press ‘T’ and select the correct vtable-structure.

To learn about COM check out the Microsoft website: https://docs.microsoft.com/en-us/windows/win32/com/the-component-object-model

Code was tested on IDA 7.4 and Python versions 2+3

COM Code Helper 1 COM Code Before After 1 1

COM Code Helper 2 COM Code Before After 2

COM Code Helper 3 COM Code Before After 3

Download COM-Code-Helper

If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.

Discord

Original Source