Skip to content
/ r2com Public

radare2 script to help on COM objects reverse engineering

Notifications You must be signed in to change notification settings

newlog/r2com

Repository files navigation

R2COM Build Status

This radare2 script allows you to easily identify what type of COM object are you dealing with when reversing a binary calling the CoCreateInstance function from the OLE32.DLL library.

This plugin will add a comment in the instruction pushing the rclsid parameter helping you identify what the COM object is.

To get more information regarding reverse engineering COM functionality, you can take a look to the Controlling Internet Explorer with COM section in this post by FireEye.

After using this script, you will still have to figure out what COM object function is being called. The manual process to do so - yep, not done here :( - is detailed here.

Usage

The preferred way to use this plugin is by native radare2 plugin through r2pm:

asciicast

If you want, you can execute it as an external script:

asciicast

$ r2 <binary>
> . r2com.py

Authors

giomismo & newlog

Thanks to

Special thanks to nibble and zlowram

About

radare2 script to help on COM objects reverse engineering

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages