[GH-ISSUE #3618] [Feature] ActiveX, COM, and OCX reverse engineering: TypeLib extraction, DispID mapping, IObjectSafety auditing, and Ghidra COM vtable hydration #1347

New issue

Open

opened 2026-10-16 21:04:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:31 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3618

Summary

Microsoft ActiveX controls (packaged as .ocx and .dll PE/COFF binaries, often distributed via Cabinet .cab archives) served as the primary native extension mechanism for Internet Explorer and desktop applications for over two decades. They were widely deployed for hardware integration (signature pads, smart card readers, biometric scanners), surveillance systems (DVR/NVR video players), banking security plugins, and intranet software.

From a security and reverse engineering standpoint, ActiveX controls represent one of the most significant historical attack surfaces on Windows: arbitrary code execution, unsafe scriptable methods, insecure initialization, and memory corruption triggered directly from untrusted web pages.

While REA provides deep native PE analysis via Ghidra and Rizin, it currently treats ActiveX/COM binaries as generic PE executables without recovering their COM-specific semantics: Type Libraries (TYPELIB), Dispatch Interfaces (IDispatch), DispIDs, IObjectSafety flags, and COM virtual function tables.

This feature proposal introduces dedicated ActiveX, COM, and OCX Reverse Engineering to REA, automating TypeLib extraction, interface reconstruction, scriptability security auditing, and Ghidra COM vtable hydration.

Technical Capabilities

1. Packaging & Deployment Analysis (CAB, HTML, INF)

Cabinet (.cab) Extraction: Safe, streaming decompression of Microsoft Cabinet (.cab) archives, extracting bundled .ocx and .dll binaries, license files, and .inf installation scripts.
HTML Embedding Parser: Parse HTML <object> tags, extracting classid (clsid:XXXXXXXX-...), codebase, version requirements, and <param name="..." value="..."> initialization properties.
INF File Parser: Parse setup instructions, registry keys, and self-registration directives (RegisterDlls).

2. Type Library (TLB) Parsing & Interface Reconstruction

Embedded & Standalone TLB Parser: Extract and parse embedded TYPELIB resources in the PE .rsrc section as well as standalone .tlb files.
Type Information Recovery:
- Extract all defined CoClasses, CLSIDs, ProgIDs, and threading models (Apartment, Free, Both, Neutral).
- Reconstruct custom COM interfaces (IUnknown-derived) and dispatch interfaces (IDispatch-derived).
- Map DispIDs (Dispatch IDs) to human-readable method names, parameter types (BSTR, VARIANT, LONG, pointers), default values, and return types.
- Map Property Getters ([propget]), Setters ([propput], [propputref]), and outgoing event interfaces (Connection Points via IConnectionPointContainer).
IDL & Header Generation: Automatically generate clean Microsoft Interface Definition Language (.idl) and C++ header files representing the recovered COM interfaces.

3. Security & Scriptability Safety Auditing

IObjectSafety Interface Inspection:
- Detect implementation of IObjectSafety::GetInterfaceSafetyOptions and IObjectSafety::SetInterfaceSafetyOptions.
- Identify whether the control marks itself with:
  - INTERFACESAFE_FOR_UNTRUSTED_CALLER (Safe for Scripting)
  - INTERFACESAFE_FOR_UNTRUSTED_DATA (Safe for Initializing)
Component Categories (CATID) Verification:
- Statically analyze DllRegisterServer / DllUnregisterServer routines to detect registration of:
  - CATID_SafeForScripting ({7DD95801-9882-11CF-9FA9-00AA006C42C4})
  - CATID_SafeForInitializing ({7DD95802-9882-11CF-9FA9-00AA006C42C4})
Dangerous Scriptable Method Heuristics:
- Automatically audit methods exposed via IDispatch for high-risk capabilities:
  - File system read/write/deletion (CreateFile, DeleteFile, WriteFile).
  - Process creation and command execution (CreateProcess, ShellExecute, WinExec).
  - Registry modification (RegSetValue, RegCreateKey).
  - Unchecked memory copies or buffer operations susceptible to overflow via script-supplied BSTR parameters.

4. Headless Ghidra & Rizin COM VTable Hydration

VTable Symbol Annotation:
- Automatically locate virtual function tables matching registered CoClasses and interfaces.
- Label anonymous vtable function pointers with their qualified interface names (e.g. IUnknown::QueryInterface, AddRef, Release, followed by IDispatch methods, and custom interface methods in exact vtable index order).
GUID & CLSID Annotation: Annotate raw GUID memory bytes in data sections with recognized interface and class symbolic names.
Standard Export Checking: Verify standard COM exports: DllGetClassObject, DllCanUnloadNow, DllRegisterServer, DllUnregisterServer.

Acceptance Criteria

Introduce analyze_activex_control in REA CLI and MCP contracts, accepting .ocx, .dll, .cab, and HTML inputs.
Accurately unpack .cab archives and extract .inf registration metadata.
Parse embedded TypeLib resources from synthetic PE fixtures, emitting structured JSON documenting CoClasses, interfaces, and DispIDs.
Audit IObjectSafety implementation and report scriptability safety flags in structured evidence.
Automatically label COM vtables and method signatures in headless Ghidra and Rizin analysis.
Flag potentially hazardous scriptable methods based on parameter signatures and downstream system API calls.

#743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
#492 Inspect recovered native data types and layouts
#3614 [Feature] Adobe Flash & SWF Reverse Engineering
#3616 [Feature] Microsoft Silverlight & XAP reverse engineering

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3618 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Microsoft ActiveX controls (packaged as `.ocx` and `.dll` PE/COFF binaries, often distributed via Cabinet `.cab` archives) served as the primary native extension mechanism for Internet Explorer and desktop applications for over two decades. They were widely deployed for hardware integration (signature pads, smart card readers, biometric scanners), surveillance systems (DVR/NVR video players), banking security plugins, and intranet software. From a security and reverse engineering standpoint, ActiveX controls represent one of the most significant historical attack surfaces on Windows: arbitrary code execution, unsafe scriptable methods, insecure initialization, and memory corruption triggered directly from untrusted web pages. While REA provides deep native PE analysis via Ghidra and Rizin, it currently treats ActiveX/COM binaries as generic PE executables without recovering their COM-specific semantics: Type Libraries (`TYPELIB`), Dispatch Interfaces (`IDispatch`), DispIDs, `IObjectSafety` flags, and COM virtual function tables. This feature proposal introduces dedicated **ActiveX, COM, and OCX Reverse Engineering** to REA, automating TypeLib extraction, interface reconstruction, scriptability security auditing, and Ghidra COM vtable hydration. --- ## Technical Capabilities ### 1. Packaging & Deployment Analysis (CAB, HTML, INF) - **Cabinet (.cab) Extraction:** Safe, streaming decompression of Microsoft Cabinet (`.cab`) archives, extracting bundled `.ocx` and `.dll` binaries, license files, and `.inf` installation scripts. - **HTML Embedding Parser:** Parse HTML `<object>` tags, extracting `classid` (`clsid:XXXXXXXX-...`), `codebase`, version requirements, and `<param name="..." value="...">` initialization properties. - **INF File Parser:** Parse setup instructions, registry keys, and self-registration directives (`RegisterDlls`). ### 2. Type Library (TLB) Parsing & Interface Reconstruction - **Embedded & Standalone TLB Parser:** Extract and parse embedded `TYPELIB` resources in the PE `.rsrc` section as well as standalone `.tlb` files. - **Type Information Recovery:** - Extract all defined CoClasses, CLSIDs, ProgIDs, and threading models (`Apartment`, `Free`, `Both`, `Neutral`). - Reconstruct custom COM interfaces (`IUnknown`-derived) and dispatch interfaces (`IDispatch`-derived). - Map DispIDs (Dispatch IDs) to human-readable method names, parameter types (BSTR, VARIANT, LONG, pointers), default values, and return types. - Map Property Getters (`[propget]`), Setters (`[propput]`, `[propputref]`), and outgoing event interfaces (Connection Points via `IConnectionPointContainer`). - **IDL & Header Generation:** Automatically generate clean Microsoft Interface Definition Language (`.idl`) and C++ header files representing the recovered COM interfaces. ### 3. Security & Scriptability Safety Auditing - **`IObjectSafety` Interface Inspection:** - Detect implementation of `IObjectSafety::GetInterfaceSafetyOptions` and `IObjectSafety::SetInterfaceSafetyOptions`. - Identify whether the control marks itself with: - `INTERFACESAFE_FOR_UNTRUSTED_CALLER` (Safe for Scripting) - `INTERFACESAFE_FOR_UNTRUSTED_DATA` (Safe for Initializing) - **Component Categories (CATID) Verification:** - Statically analyze `DllRegisterServer` / `DllUnregisterServer` routines to detect registration of: - `CATID_SafeForScripting` (`{7DD95801-9882-11CF-9FA9-00AA006C42C4}`) - `CATID_SafeForInitializing` (`{7DD95802-9882-11CF-9FA9-00AA006C42C4}`) - **Dangerous Scriptable Method Heuristics:** - Automatically audit methods exposed via `IDispatch` for high-risk capabilities: - File system read/write/deletion (`CreateFile`, `DeleteFile`, `WriteFile`). - Process creation and command execution (`CreateProcess`, `ShellExecute`, `WinExec`). - Registry modification (`RegSetValue`, `RegCreateKey`). - Unchecked memory copies or buffer operations susceptible to overflow via script-supplied BSTR parameters. ### 4. Headless Ghidra & Rizin COM VTable Hydration - **VTable Symbol Annotation:** - Automatically locate virtual function tables matching registered CoClasses and interfaces. - Label anonymous vtable function pointers with their qualified interface names (e.g. `IUnknown::QueryInterface`, `AddRef`, `Release`, followed by `IDispatch` methods, and custom interface methods in exact vtable index order). - **GUID & CLSID Annotation:** Annotate raw GUID memory bytes in data sections with recognized interface and class symbolic names. - **Standard Export Checking:** Verify standard COM exports: `DllGetClassObject`, `DllCanUnloadNow`, `DllRegisterServer`, `DllUnregisterServer`. --- ## Acceptance Criteria 1. Introduce `analyze_activex_control` in REA CLI and MCP contracts, accepting `.ocx`, `.dll`, `.cab`, and HTML inputs. 2. Accurately unpack `.cab` archives and extract `.inf` registration metadata. 3. Parse embedded TypeLib resources from synthetic PE fixtures, emitting structured JSON documenting CoClasses, interfaces, and DispIDs. 4. Audit `IObjectSafety` implementation and report scriptability safety flags in structured evidence. 5. Automatically label COM vtables and method signatures in headless Ghidra and Rizin analysis. 6. Flag potentially hazardous scriptable methods based on parameter signatures and downstream system API calls. --- ## Related - #743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - #492 Inspect recovered native data types and layouts - #3614 [Feature] Adobe Flash & SWF Reverse Engineering - #3616 [Feature] Microsoft Silverlight & XAP reverse engineering

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:10:34 +00:00

[PR #1347] [MERGED] perf(javascript): index version relationships once per comparison #2813