How can I keep track of ActiveX controls created by a process?

Question

I'd like to keep track of the ActiveX controls created by some process. To simplify the problem, I'd first like to monitor the current process only. I want to do this so that I can check whether any ActiveX control supports IOleWindow and if so, whether a given HWND belongs to that ActiveX control (so that I can map HWNDs to ActiveX controls).

Does anybody have experience with this? My first idea was to use API hooking to monitor CoCreateInstance invocations, but I read that this doesn't work in all cases. Some Google research revealed http://www.pocketsoap.com/sf/activation.html which talks about installing a custom class factory - how would this work?

Answer 1

You may find you can find out what you need to know using the UI Automation and Active Accessibility APIs:

• http://msdn.microsoft.com/en-us/library/dd317978(VS.85).aspx

If you are sure you need to do this, be aware of the following. CoCreateInstance is essentially a convenience function, which wraps CoGetClassObject and IClassObject::CreateInstance .

If you are going to use that technique you will therefore have to hook CoGetClassObject too, as the process may use it directly.

And of course there is no law saying any library or DLL cannot provide it's own convenience functions which bypass the COM registry altogether. The registry itself is a convenience - if you know where the DLL is you can use LoadLibrary , GetProcAddress to find DllGetClassObject and retrieve the class object without involving the COM libraries, and indeed without the DLL being registered at all.

Answer 2

我最终挂钩CoCreateInstance和CoGetClassObject来跟踪正在创建的所有COM对象。