OBJREF
From Wikipedia, the free encyclopedia
OBJREF is the name of the structure of marshalled interfaces in COM and DCOM. Because COM interfaces can only be called directly from the context (like a thread, process or machine) where they originated, when they are needed in another context they are marshalled in this structure, which is then passed to the destination context where it is unmarshalled to a proxy that takes care of the necessary communication, for example passing messages or network packets or marshalling other interfaces passed in calls.[1][2]
Format
The layout of the structure is as follows:[3][4]
| Offset | Size | Description |
|---|---|---|
| 0 | 4 | Signature: 'MEOW' |
| 4 | 4 | Flag indicating the kind of structure |
| 8 | 16 | Interface identifier |
| Flag = 1: standard | ||
| 24 | 4 | Flags, mostly reserved for the system, but can be used to turn off pinging objects.[5] |
| 28 | 4 | Reference count |
| 32 | 8 | OXID – object exporter identifier[6] |
| 40 | 8 | OID – object identifier[6] |
| 48 | 16 | IPID – interface pointer identifier[7] |
| 64 | variable | DUALSTRINGARRAY |
| Flag = 2: handler (an extension of standard)[8] | ||
| 64 | 16 | Class identifier of a class that will be used as a handler for the interface, i.e. sit between the client and the proxy. |
| 80 | variable | DUALSTRINGARRAY |
| Flag = 4: custom marshalling[9] | ||
| 24 | 16 | Class identifier of the custom proxy |
| 40 | 4 | 0 (reserved value) |
| 44 | 4 | Size of the data below |
| 48 | variable | Custom marshalling data |
| Flag = 8: extended (also an extension of standard)[10] | ||
| 64 | 4 | Signature 'VYSN' |
| 68 | variable | DUALSTRINGARRAY |
| 4 | 1 (historically the number of data elements below, but there always is only a single element) | |
| 4 | Signature 'VYSN' | |
| Data element used to identify and marshal an envoy context:[11][12][13] | ||
| 16 | Context identifier[14] | |
| 4 | Size of the data below, excluding padding | |
| 4 | Size of the data below, including padding | |
| 8n | A marshalled envoy context, padded to a multiple of eight bytes | |
The layout of DUALSTRINGARRAY is:[15][16]
| Offset | Size | Description |
|---|---|---|
| 0 | 2 | Total number of entries in the arrays below, including nulls |
| 2 | 2 | Number of entries in the array that represent string bindings |
| 4 | 2n | String and security bindings |
The string bindings are null-terminated records specifying connection information, like IP addresses, and the security bindings are null-terminated records specifying authentication information. Both arrays are null-terminated too.
