OBJREF explained

OBJREF is the name of the structure of marshalled interfaces in COM and DCOM. Because COM interfaces can only be called directly from the context (like a thread, process or machine) where they originated, when they are needed in another context they are marshalled in this structure, which is then passed to the destination context where it is unmarshalled to a proxy that takes care of the necessary communication, for example passing messages or network packets or marshalling other interfaces passed in calls.^{[1] [2]}

Format

The layout of the structure is as follows:^{[3] [4]}

Offset	Size	Description
0	4	Signature: 'MEOW'
4	4	Flag indicating the kind of structure
8	16	Interface identifier
Flag = 1: standard
24	4	Flags, mostly reserved for the system, but can be used to turn off pinging objects.^[5]
28	4	Reference count
32	8	OXID – object exporter identifier^[6]
40	8	OID – object identifier
48	16	IPID – interface pointer identifier^[7]
64	variable	DUALSTRINGARRAY
Flag = 2: handler (an extension of standard)^[8]
64	16	Class identifier of a class that will be used as a handler for the interface, i.e. sit between the client and the proxy.
80	variable	DUALSTRINGARRAY
Flag = 4: custom marshalling^[9]
24	16	Class identifier of the custom proxy
40	4	0 (reserved value)
44	4	Size of the data below
48	variable	Custom marshalling data
Flag = 8: extended (also an extension of standard)^[10]
64	4	Signature 'VYSN'
68	variable	DUALSTRINGARRAY
	4	1 (historically the number of data elements below, but there always is only a single element)
	4	Signature 'VYSN'
Data element used to identify and marshal an envoy context:^[11] ^[12] ^[13]
	16	Context identifier^[14]
	4	Size of the data below, excluding padding
	4	Size of the data below, including padding
	8n	A marshalled envoy context, padded to a multiple of eight bytes

The layout of DUALSTRINGARRAY is:^{[15] [16]}

Offset	Size	Description
0	2	Total number of entries in the arrays below, including nulls
2	2	Number of entries in the array that represent string bindings
4	2n	String and security bindings

The string bindings are null-terminated records specifying connection information, like IP addresses, and the security bindings are null-terminated records specifying authentication information. Both arrays are null-terminated too.

References

1. Web site: The Mechanics of COM+. 2008-09-07. Tim Ewald. 2001-03-06. Informit. Pearson Education & Addison-Wesley Professional.
2. Web site: More DCOM notes. 2008-09-07. Mike Hearn. 2005-01-22. Wine Developer's List. Codeweavers.
3. Web site: dcom.idl. 2008-09-06. 2003. Wine. CodeWeavers.
4. Web site: ShowMeMyOBJREF. 2008-09-07. Dharma Shukla. 1998. (This is example code to inspect the contents of an OBJREF.)
5. Web site: Understanding the DCOM Wire Protocol by Analyzing Network Data Packets. 2008-09-07. Eddon. Guy. Eddon, Henry. March 1998. Microsoft Systems Journal. Microsoft.
6. Web site: Windows Protocols Master Glossary: O. 2008-09-06. MSDN. Microsoft. object exporter identifier (OXID): A 64-bit number that uniquely identifies an object exporter within an object server. … object identifier (OID): (1) In the context of an object server, a 64-bit number that uniquely identifies an object..
7. Web site: Windows Protocols Master Glossary: I. 2008-09-06. MSDN. Microsoft. interface pointer identifier (IPID): A 128-bit number that uniquely identifies an interface on an object within an object exporter..
8. Web site: OBJREF_HANDLER. 2008-09-06. MSDN. Microsoft.
9. Web site: OBJREF_CUSTOM. 2008-09-07. MSDN. Microsoft.
10. Web site: OBJREF_EXTENDED. 2008-09-06. MSDN. Microsoft.
11. Web site: Context Properties. 2008-09-07. MSDN. Microsoft.
12. Web site: Context Properties and Marshaling. 2008-09-07. MSDN. Microsoft.
13. Web site: Windows Protocols Master Glossary: E. 2008-09-07. MSDN. Microsoft. envoy context: A context that is marshaled and returned to a client as a result of obtaining an object reference..
14. Web site: Windows Protocols Master Glossary: C. 2008-09-07. MSDN. Microsoft. context: A collection of context properties that describe an execution environment. sqq..
15. Web site: DUALSTRINGARRAY. 2008-09-06. MSDN. Microsoft.
16. Book: Eddon , Guy . Eddon, Henry. Stroo, Eric . Turner, Alice . Young, Marc . Chang, Ina. Inside COM+ Base Services. 1999. Microsoft Press. Redmond. 0-7356-0728-1. Marshaled Interface Pointers.