How to check whether a PE(DLL,EXE) is a COM component or Win32 DLL/EXE?
Hello,
I need to write a stub(module), when given some PE (DLL/EXE) as input , it should give the information that this PE is Win32 DLL/EXE or COM DLL/EXE? I need it programatically to determine this.
Is there any windows APIs?
Regards
Usman
Re: How to check whether a PE(DLL,EXE) is a COM component or Win32 DLL/EXE?
Well, if you find a DllRegisterServer entry point, then it's a COM DLL.
Re: How to check whether a PE(DLL,EXE) is a COM component or Win32 DLL/EXE?
And about COM exe you only can guess by finding imports something like OLE32.DLL::CoRegisterClassObject, OLE32.DLL::CoRevokeClassObject.
Re: How to check whether a PE(DLL,EXE) is a COM component or Win32 DLL/EXE?
This is only for COM DLL not for EXE.
Exe don't have any entry point at all.
More over this is an out of the way. More generic method we need to apply for this test. These methods can be user defined in these Exe's or DLL's, I mean we can define these methods in Win32 Exe's and DLL's as well. So GetProcAddress won't be the answer.
Re: How to check whether a PE(DLL,EXE) is a COM component or Win32 DLL/EXE?
Quote:
Originally Posted by
Igor Vartanov
And about COM exe you only can guess by finding imports something like OLE32.DLL::CoRegisterClassObject, OLE32.DLL::CoRevokeClassObject.
It means then we need to read out import table of that PE , So that we can look up its imports.
Re: How to check whether a PE(DLL,EXE) is a COM component or Win32 DLL/EXE?
Quote:
Originally Posted by
glitteringsound
This is only for COM DLL not for EXE.
Exe don't have any entry point at all.
More over this is an out of the way. More generic method we need to apply for this test. These methods can be user defined in these Exe's or DLL's, I mean we can define these methods in Win32 Exe's and DLL's as well. So GetProcAddress won't be the answer.
Check for these exports and also check the registry if it's been registered with COM.
