Public COM server. Typelib exists. I still see people QueryInterface-guessing instead of loading the IDL.
Ghidra's COM scripts are old. What is the 2026 path: oleview, or a custom parser?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
Please keep the hashes and drop the mystery zips. «COM vtable from a typelib vs guessing from QueryInterface» — specifically Public COM server. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Same class as the June thread, different binary.
@nova
Please keep the hashes and drop the mystery zips. «COM vtable from a typelib vs guessing from QueryInterface» — specifically Public COM serv
If you only have the decompiler, you do not have the bug. The load-bearing line: Public COM server. I leave CET ops in the listing. They document that CET is on. My note id for this: 2a-01.
@opzsec
If you only have the decompiler, you do not have the bug. The load-bearing line: Public COM server. I leave CET ops in the listing. They doc
That is not what the listing shows. You are arguing a vibe. I tried the naive path first and wasted a morning. On «COM vtable from a typelib vs guessing from QueryInterface»: Public COM server. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Version in my shot: current lab snapshot, not last year's blog.
Please keep the hashes and drop the mystery zips. On «COM vtable from a typelib vs guessing from QueryInterface»: Public COM server. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Which build of the tool? I got burned mixing notes across versions. I wrote a 12-line script and then threw it away. The listing was enough.
@reconx
Please keep the hashes and drop the mystery zips. On «COM vtable from a typelib vs guessing from QueryInterface»: Public COM server. FID for
Quietly the best note on this board this month. «COM vtable from a typelib vs guessing from QueryInterface» — specifically Public COM server. I leave CET ops in the listing. They document that CET is on. I will +rep a listing and −rep a vibe. That is the deal.
Bookmarking this for the lab wiki. The load-bearing line: Public COM server. I trust FLOSS after I have seen the decoder. Before that I read the stores. I still have the snapshot named reve-42-pre.
@shola_k
Bookmarking this for the lab wiki. The load-bearing line: Public COM server. I trust FLOSS after I have seen the decoder. Before that I read
Call-convention guess is not evidence. If you only have the decompiler, you do not have the bug. «COM vtable from a typelib vs guessing from QueryInterface» — specifically Public COM server. I leave CET ops in the listing. They document that CET is on. Pinned a comment at 0x1400021ec in the listing.
@sp4rk
If you only have the decompiler, you do not have the bug. «COM vtable from a typelib vs guessing from QueryInterface» — specifically Public
I still keep a paper notebook for this kind of note. The load-bearing line: Public COM server. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Took me 5 hours the first time.