how to get the dll which created a COM object
Hi guys,
I have an Inprocess COM Server which resides in say dll A. Suppose from a second dll B the Class object is created and a function is called. I am desperately searching for a way to figure out the path of this dll B in the called Interface function.
Until now I know ways to get either the executable where dll B is loaded into, or dll A but not dll B itself.
Both ways use the GetModuleFileName function.
Does anybody know a way how to get the path of the dll B which created the COM object?
it's for sure not an easy task so any help would be much appreciated.
Kind regards,
Makiman
1 Attachment(s)
Re: how to get the dll which created a COM object
Well, unless proxy dll participates in calls, the following sample may help.
Re: how to get the dll which created a COM object
Hello Igor,
thanks a lot for you answer. Your example is really working perfectly.
I tried to apply this to my COM server but unfortunately in my case the caller is in most cases a .NET assembly and I just get the path of this mscorwks.dll. If I watch the call stack I see really no trace of the dll I am interested in. That's annoying and I suppose no solution is existing for this :(
Re: how to get the dll which created a COM object
Quote:
in my case the caller is in most cases a .NET assembly and I just get the path of this mscorwks.dll.
That's what I meant, the additional layer involved in routing a call to server from client. Well, no surprise. COM specification never guarantee anything to server about knowing any real client details, so it's all perfectly legal. :)
Re: how to get the dll which created a COM object
now I'm trying to hook the
BOOL _CorDllMain (HINSTANCE hInst,DWORD dwReason,LPVOID lpReserved)
in MSCORWKS.DLL with the APIHiJack library in order to gain some information of the currently executed .NET assembly.
But in the while loop in
Code:
bool HookAPICalls( SDLLHook* Hook )
{
if ( !Hook )
return false;
HMODULE hModEXE = GetModuleHandle( 0 );
PIMAGE_NT_HEADERS pExeNTHdr = PEHeaderFromHModule( hModEXE );
if ( !pExeNTHdr )
return false;
DWORD importRVA = pExeNTHdr->OptionalHeader.DataDirectory
[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
if ( !importRVA )
return false;
// Convert imports RVA to a usable pointer
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = MakePtr( PIMAGE_IMPORT_DESCRIPTOR,
hModEXE, importRVA );
// Save off imports address in a global for later use
g_pFirstImportDesc = pImportDesc;
// Iterate through each import descriptor, and redirect if appropriate
while ( pImportDesc->FirstThunk )
{
PSTR pszImportModuleName = MakePtr( PSTR, hModEXE, pImportDesc->Name);
if ( lstrcmpi( pszImportModuleName, Hook->Name ) == 0 )
{
OutputDebugString( "Found " );
OutputDebugString( Hook->Name );
OutputDebugString( "...\n" );
RedirectIAT( Hook, pImportDesc, (PVOID)hModEXE );
}
pImportDesc++; // Advance to next import descriptor
}
return true;
are just about five dlls appearing and mscorwks.dll is not among them. And I don't know why.
Actually there are much more dlls loaded in that process.