[segark]

I need to analyze a dll which creates a com object using regsvr32.exe.
I was wondering how would you go about analyzing it's interfaces and functions.
when looking at the dll's exports all I see are a set of 5 standard exports.
I've tried 2 ida plugins but they're not very helpful as they claim they work with com dlls written in microsoft visual c++ and the dlls
are written in delphi.

[R136a1]

Hi,

there is an article from Malwarebytes which gives a good introduction to reversing COM files: https://blog.malwarebytes.org/intellige ... ious-code/

[segark]

Will take a look, thank you.

Are there any more resources you know of around the web?
Do you happen to meet malicious com objects occasionally?

[R136a1]

Well, there are some rare articles which deal with COM related malware:
https://www.virusbtn.com/virusbulletin/ ... -IcoScript
https://www.vmray.com/blinding-malware- ... m-objects/

Anyway, the best way to understand COM is to read the Microsoft documentation and start programming. But beware, it's a tough topic...

Microsoft: https://msdn.microsoft.com/en-us/librar ... 85%29.aspx

Programming:
http://www.codeproject.com/Articles/136 ... in-plain-C
http://www.codeproject.com/Articles/138 ... ain-C-Part
http://www.codeproject.com/Articles/140 ... ain-C-Part
http://www.codeproject.com/Articles/141 ... ain-C-Part
http://www.codeproject.com/Articles/141 ... ain-C-Part
http://www.codeproject.com/Articles/149 ... ain-C-Part
http://www.codeproject.com/Articles/150 ... ain-C-Part

[Munsta]

This is little gem to give you an inspiration.
Merry Christmas to soviet friends here :)
https://pbs.twimg.com/media/B7GuAlaCMAAzuvK.jpg:large