OBJREF

OBJREF is the name of the structure of marshalled interfaces in COM and DCOM. Because COM interfaces can only be called directly from the context (like a thread, process or machine) where they originated, when they are needed in another context they are marshalled in this structure, which is then passed to the destination context where it is unmarshalled to a proxy that takes care of the necessary communication, for example passing messages or network packets or marshalling other interfaces passed in calls.^[1][2]

Format

The layout of the structure is as follows:^[3][4]

Offset	Size	Description
0	4	Signature: 'MEOW'
4	4	Flag indicating the kind of structure
8	16	Interface identifier
Flag = 1: standard
24	4	Flags, mostly reserved for the system, but can be used to turn off pinging objects.[5]
28	4	Reference count
32	8	OXID – object exporter identifier[6]
40	8	OID – object identifier[6]
48	16	IPID – interface pointer identifier[7]
64	variable	DUALSTRINGARRAY
Flag = 2: handler (an extension of standard)[8]
64	16	Class identifier of a class that will be used as a handler for the interface, i.e. sit between the client and the proxy.
80	variable	DUALSTRINGARRAY
Flag = 4: custom marshalling[9]
24	16	Class identifier of the custom proxy
40	4	0 (reserved value)
44	4	Size of the data below
48	variable	Custom marshalling data
Flag = 8: extended (also an extension of standard)[10]
64	4	Signature 'VYSN'
68	variable	DUALSTRINGARRAY
	4	1 (historically the number of data elements below, but there always is only a single element)
	4	Signature 'VYSN'
Data element used to identify and marshal an envoy context:[11][12][13]
	16	Context identifier[14]
	4	Size of the data below, excluding padding
	4	Size of the data below, including padding
	8n	A marshalled envoy context, padded to a multiple of eight bytes

The layout of DUALSTRINGARRAY is:^[15][16]

Offset	Size	Description
0	2	Total number of entries in the arrays below, including nulls
2	2	Number of entries in the array that represent string bindings
4	2n	String and security bindings

The string bindings are null-terminated records specifying connection information, like IP addresses, and the security bindings are null-terminated records specifying authentication information. Both arrays are null-terminated too.