how to get the dll which created a COM object

[Makiman]

Hi guys,
I have an Inprocess COM Server which resides in say dll A. Suppose from a second dll B the Class object is created and a function is called. I am desperately searching for a way to figure out the path of this dll B in the called Interface function.
Until now I know ways to get either the executable where dll B is loaded into, or dll A but not dll B itself.
Both ways use the GetModuleFileName function.

Does anybody know a way how to get the path of the dll B which created the COM object?
it's for sure not an easy task so any help would be much appreciated.

Kind regards,
Makiman

[Igor Vartanov]

Well, unless proxy dll participates in calls, the following sample may help.

[Makiman]

Hello Igor,
thanks a lot for you answer. Your example is really working perfectly.

I tried to apply this to my COM server but unfortunately in my case the caller is in most cases a .NET assembly and I just get the path of this mscorwks.dll. If I watch the call stack I see really no trace of the dll I am interested in. That's annoying and I suppose no solution is existing for this

[Igor Vartanov]

in my case the caller is in most cases a .NET assembly and I just get the path of this mscorwks.dll.

That's what I meant, the additional layer involved in routing a call to server from client. Well, no surprise. COM specification never guarantee anything to server about knowing any real client details, so it's all perfectly legal.

[Makiman]

now I'm trying to hook the
BOOL _CorDllMain (HINSTANCE hInst,DWORD dwReason,LPVOID lpReserved)
in MSCORWKS.DLL with the APIHiJack library in order to gain some information of the currently executed .NET assembly.

But in the while loop in

bool HookAPICalls( SDLLHook* Hook )
{
    if ( !Hook )
        return false;

    HMODULE hModEXE = GetModuleHandle( 0 );

    PIMAGE_NT_HEADERS pExeNTHdr = PEHeaderFromHModule( hModEXE );
    
    if ( !pExeNTHdr )
        return false;

    DWORD importRVA = pExeNTHdr->OptionalHeader.DataDirectory
                        [IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    if ( !importRVA )
        return false;

    // Convert imports RVA to a usable pointer
    PIMAGE_IMPORT_DESCRIPTOR pImportDesc = MakePtr( PIMAGE_IMPORT_DESCRIPTOR,
                                                    hModEXE, importRVA );

    // Save off imports address in a global for later use
    g_pFirstImportDesc = pImportDesc;   

    // Iterate through each import descriptor, and redirect if appropriate
    while ( pImportDesc->FirstThunk )
    {
        PSTR pszImportModuleName = MakePtr( PSTR, hModEXE, pImportDesc->Name);

        if ( lstrcmpi( pszImportModuleName, Hook->Name ) == 0 )
        {
            OutputDebugString( "Found " );
            OutputDebugString( Hook->Name );
            OutputDebugString( "...\n" );

            RedirectIAT( Hook, pImportDesc, (PVOID)hModEXE );
        }
        
        pImportDesc++;  // Advance to next import descriptor
    }

    return true;

are just about five dlls appearing and mscorwks.dll is not among them. And I don't know why.
Actually there are much more dlls loaded in that process.