COM question, how to corelate a COM server(EXE) created by a client request.

GHANASHYAM SATPATHY 301 Reputation points
2020-11-23T13:36:23.953+00:00

I have a COM server(EXE) and when I access the object first time using CoCreateInstance/Ex the EXE starts running. However the parent for this process seems to be svchost.exe , not the client application that asked for the Object Activation. I verified with ProcExplorer of sysinternal utils. Even through ETW and WMI I see similar correlation about parent process.

How can I correlate to my original client application with the COM exe?

Any help is highly appreciated.

Thanks.

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,082 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. mariora 376 Reputation points
    2020-12-29T10:29:53.807+00:00

    There is no way in PE to get that correlation.. because of COM working you will always get a system man-in-the-middle object..
    If you need that information you need windbg.. in windbg there are extensions to see the COM correlation ID, so attaching a WIndbg session to every object will show you the correlation ID.

    HTH
    -mario