# COM-Code-Helper | Two IDAPython Scripts Help You To Reconstruct Microsoft COM (Component Object Model) Code

**URL:** <https://onehack.st/t/com-code-helper-two-idapython-scripts-help-you-to-reconstruct-microsoft-com-component-object-model-code/172145>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [February 8, 2021, 1:09pm UTC](https://onehack.st/t/com-code-helper-two-idapython-scripts-help-you-to-reconstruct-microsoft-com-component-object-model-code/172145 "2021-02-08T13:09:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [February 8, 2021, 1:09pm UTC](https://onehack.st/t/com-code-helper-two-idapython-scripts-help-you-to-reconstruct-microsoft-com-component-object-model-code/172145/1 "2021-02-08T13:09:18Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/d/fdf1f8271f1a04ca088cb54aba34894f1af9c88b.png)

# COM-Code-Helper

Two IDAPython Scripts help you to reconstruct Microsoft COM (Component Object Model) Code Especially malware reversers will find this useful, as COM Code is still regularly found in malware.

# ClassAndInterfaceToNames.py

This IDAPython script scans an idb file for class and interfaces UUIDs and creates the matching structure and its name. Make sure to copy interfaces.txt + classes.txt is in the same directory as ClassAndInterfaceToNames.py

# Microsoft-SDK-Vtable-Structs.py

This IDAPython script creates vtables derrived from Microsoft SDK. Execution of the script takes a while, as lot of structures are created. After the script finished, go to the COM code you like to reconstruct, press ‘T’ and select the correct vtable-structure.

To learn about COM check out the Microsoft website: [https://docs.microsoft.com/en-us/windows/win32/com/the-component-object-model](https://docs.microsoft.com/en-us/windows/win32/com/the-component-object-model)

Code was tested on IDA 7.4 and Python versions 2+3

[![alt text](https://github.com/fboldewin/COM-Code-Helper/raw/master/code/COM-Code-Before-After-1.png)](https://github.com/fboldewin/COM-Code-Helper/raw/master/code/COM-Code-Before-After-1.png)

[![alt text](https://github.com/fboldewin/COM-Code-Helper/raw/master/code/COM-Code-Before-After-2.png)](https://github.com/fboldewin/COM-Code-Helper/raw/master/code/COM-Code-Before-After-2.png)

[![alt text](https://github.com/fboldewin/COM-Code-Helper/raw/master/code/COM-Code-Before-After-3.png)](https://github.com/fboldewin/COM-Code-Helper/raw/master/code/COM-Code-Before-After-3.png)

## GitHub:

> **[GitHub - fboldewin/COM-Code-Helper: Two IDAPython Scripts help you to reconstruct...](https://github.com/fboldewin/COM-Code-Helper)**
>
> Two IDAPython Scripts help you to reconstruct Microsoft COM (Component Object Model) Code