search

tyranid / oleviewdotnet

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container
GNU General Public License v3.0
1.1k stars 182 forks source link

"View Proxy Definition" throws NullReferenceException on Windows 11 22H2 #38

Open Leo40Git opened 2 years ago

Leo40Git commented 2 years ago

Precise build number is 22621.1.

Exception is thrown here in COMUtilities - apparently it's being passed null instead of a mangled WinRT name.

If it helps: I was trying to view the proxy definition of IVirtualDisplayManager (GUID {DBADADFC-454C-44C9-9648-F2A0827AD279}).

Ciantic commented 1 year ago

I also got it running by simply making it name ?? "" in my fork:

https://github.com/Ciantic/oleviewdotnet/blob/e3306cbab9fd05c6951adce320e80cb20977aee8/OleViewDotNet.Main/COMUtilities.cs#L2039

However this is not a fix yet, where can we get more WinRT names? Now they are all null or empty, it's still better but we need to figure out a way to get mangled names.

tyranid commented 1 year ago

Sorry that I didn't reply for so long. It does seem that MS is no longer building proxy definitions with names anymore which is a real shame as that was super helpful. I've added a fix for the NPD so hopefully it at least doesn't crash.

Ciantic commented 1 year ago

@tyranid There are tools such as https://github.com/t1m0thyj/GetVirtualDesktopAPI_DIA that gets the PDB symbols from Micorosoft.com/symbols and combines them to produce proxy definition interface with all the names. Even for Windows internals such as those Virtual Desktop APIs.

I know that oleviewdotnet is probably on maintenance, but that's what I was actually looking to do with my fork, somehow download symbols and combine.

Here is an example I produced with that python script:

https://github.com/Ciantic/DumpVDIA/blob/master/current.txt

I think the combination needs to find an implementing class from a DLL, and with PDB figure out the interface definitions from there. It's kind of tricky.

EDIT Now I know, it should be separate feature, to browse class instances that can be viewed with PDB, that's how IDA does it too, but it's view is so confusing compared to oleview