newlog / r2com Goto Github PK

This radare2 script allows you to easily identify what type of COM object are you dealing with when reversing a binary calling the CoCreateInstance function from the OLE32.DLL library.

This plugin will add a comment in the instruction pushing the rclsid parameter helping you identify what the COM object is.

To get more information regarding reverse engineering COM functionality, you can take a look to the Controlling Internet Explorer with COM section in this post by FireEye.

After using this script, you will still have to figure out what COM object function is being called. The manual process to do so - yep, not done here :( - is detailed here.

The preferred way to use this plugin is by native radare2 plugin through r2pm:

If you want, you can execute it as an external script:

$ r2 <binary>
> . r2com.py

giomismo & newlog

Special thanks to nibble and zlowram