com_map

Windows COM/COM+ registry inventory scanner (CLSID/AppID/Interface/TypeLib) with 32-bit vs 64-bit views, plus ETW-based RPC/COM observation.

Build

dotnet build

Run (Inventory)

dotnet run -- --out . --verbose

Optional flags:

• --include-user-hkcu include HKCU\Software\Classes
• --include-typelib scan TypeLib registry
• --hash sha256 compute SHA-256 for server binaries
• --verbose

Run (Observe / ETW)

dotnet run -- --observe --duration 30 --top --include-local --json rpc_capture.json --csv rpc_capture.csv

Common observe flags:

• --observe start ETW capture
• --discover-providers list providers via logman
• --provider <name|guid> add provider (repeatable)
• --duration <sec> capture N seconds then stop
• --remote-only only ncacn_ip_tcp (default)
• --include-local include ncalrpc/ncacn_np
• --transport <tcp|np|lpc|all> filter by transport
• --process <name|pid> filter by process
• --interface <uuid> filter by interface IID
• --method <name|opnum> filter by method name or opnum
• --binding <string> filter by binding/protocol sequence
• --instrument <process|pid> enable instrumented mode (repeatable, comma-separated)
• --ip <addr> filter by remote IP
• --top show top talkers summary
• --top-window <sec> sliding window for top talkers (default: 60)
• --allow-service <name> allow list for services (repeatable)
• --deny-service <name> deny list for services (repeatable)
• --rate-limit <n> max events/sec per process+transport
• --sample <n> keep 1 of N events
• --json <path> export JSON capture
• --csv <path> export CSV capture

Streaming capture

Use streaming capture for long runs with rotation and periodic flush:

dotnet run -- --observe --include-local --capture-dir .\captures --capture-format both --capture-max-mb 50 --capture-rotate 5 --capture-flush 5

Streaming options:

• --capture-dir <dir> enable streaming capture with rotation
• --capture-format <json|csv|both> output format
• --capture-max-mb <n> rotate when file exceeds N MB
• --capture-rotate <n> keep N rotated files (0 = unlimited)
• --capture-flush <sec> flush every N seconds (0 = disable)

Instrumented mode (Detours hook)

Instrumented mode injects a small hook DLL into target processes to capture client binding details and missing opnum values. It is opt-in via --instrument.

Build the hook DLL (requires Microsoft Detours):

cd instrumentation
# Run from a Visual Studio Developer Prompt (x64 or x86)
.\build_instrumentation.ps1 -DetoursRoot "C:\path\to\detours" -Arch x64

Then run observe mode with targets:

dotnet run -- --observe --include-local --instrument lsass --instrument 1234 --duration 20

The capture directory includes:

• rpc_capture_stream_*.jsonl (one JSON event per line)
• rpc_capture_stream_*.csv
• rpc_capture_meta.json (capture metadata/settings)

Outputs

Inventory:

• com_inventory.json
• com_inventory_clsid.csv
• com_inventory_interfaces.csv
• com_inventory_appid.csv
• com_inventory_report.txt
• com_inventory_typelib.json (only with --include-typelib)

Observe (standard export):

• rpc_capture.json
• rpc_capture.csv

Capture Schema (JSON/CSV)

Each event includes the following fields (null/empty when unavailable):

• timestamp
• provider
• event_id
• event_name
• pid
• process
• transport (tcp, np, lpc)
• protocol_sequence (ex: ncacn_ip_tcp, ncacn_np, ncalrpc)
• local_address
• local_port
• remote_address
• remote_port
• endpoint (named pipe or ncalrpc endpoint)
• binding_string (raw RPC string binding when available)
• interface_uuid
• interface_name
• interface_version (major.minor)
• proxystub_clsid
• proxystub_clsid32
• typelib_guid
• typelib_version
• clsid
• clsid_name
• appid
• appid_name
• client_pid
• client_process
• server_pid
• server_process
• correlation_id
• services
• client_services
• server_services

CLI reference (FR)

See docs/cli_fr.md.

Notes

• Windows-only (uses registry + ETW APIs).
• ETW capture may require elevation.
• TypeLib parsing is registry-only; no IDL extraction.