Skip to content

Latest commit

 

History

History
42 lines (27 loc) · 1.61 KB

README.md

File metadata and controls

42 lines (27 loc) · 1.61 KB

R2COM Build Status

This radare2 script allows you to easily identify what type of COM object are you dealing with when reversing a binary calling the CoCreateInstance function from the OLE32.DLL library.

This plugin will add a comment in the instruction pushing the rclsid parameter helping you identify what the COM object is.

To get more information regarding reverse engineering COM functionality, you can take a look to the Controlling Internet Explorer with COM section in this post by FireEye.

After using this script, you will still have to figure out what COM object function is being called. The manual process to do so - yep, not done here :( - is detailed here.

Usage

The preferred way to use this plugin is by native radare2 plugin through r2pm:

asciicast

If you want, you can execute it as an external script:

asciicast

$ r2 <binary>
> . r2com.py

Authors

giomismo & newlog

Thanks to

Special thanks to nibble and zlowram