com-interface-reconstruction

Reconstruct COM/WRL interface metadata from IDA Pro decompiled binaries.

17|3|Updated Feb 22, 2026
One-click install
npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill com-interface-reconstruction
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: com-interface-reconstruction
Source: https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/com-interface-reconstruction
Command: npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill com-interface-reconstruction

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Reconstructs COM and WRL interface definitions from IDA Pro decompiled Windows binaries by analyzing vtable slots, QueryInterface/AddRef/Release patterns, mangled names, and WRL template instantiations.

Core Features & Use Cases

  • Identify COM interfaces and WRL runtime classes from decompiled code and analysis databases.
  • Generate IDL-like descriptions and class-to-interface mappings to document interfaces and dependencies.
  • Support workflows to map interfaces to CLSIDs, decode WRL templates, and understand vtable-based layouts in extracted modules.

Quick Start

Find your module DB with find_module_db.py, then run the COM interface reconstruction workflow (scan COM interfaces, decode WRL templates, map class interfaces, and generate IDL descriptions).

Frequently Asked Questions about com-interface-reconstruction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reconstruct COM interfaces from decompiled binaries?

To reconstruct COM interfaces from decompiled binaries, analyze vtable layouts, QueryInterface patterns, and mangled names to generate IDL-like descriptions and map class-to-interface dependencies.

How do I decode WRL template instantiations in IDA Pro analysis databases?

Decoding WRL template instantiations involves scanning extracted_dbs to identify WRL runtime classes, mapping template usage to reveal structured interface inventories and class hierarchies within the analyzed Windows binaries.

What is the best way to map CLSIDs to supported COM interfaces in decompiled code?

Mapping CLSIDs to supported COM interfaces is achieved by analyzing QueryInterface/AddRef/Release patterns and vtable slots, which documents the relationships between COM classes and their implemented interface definitions.

Does COM interface reconstruction work with binaries analyzed outside of IDA Pro?

COM interface reconstruction requires Windows binaries analyzed by IDA Pro and stored in extracted_dbs, as it relies on the specific vtable layouts and decompiled code structures generated by that analysis environment.

How do I generate IDL descriptions from vtable layouts in extracted modules?

Generating IDL descriptions from vtable layouts requires scanning the module database to analyze QueryInterface patterns and WRL templates, producing structured interface inventories and IDL-like definitions for the extracted modules.

Why do I need to analyze QueryInterface patterns to identify COM interfaces?

Analyzing QueryInterface patterns is necessary because they expose the GUIDs and vtable structures that define COM interfaces, allowing you to accurately reconstruct interface metadata and class hierarchies from compiled binaries.