A new way to write FASM assembly code with Extended Headers

[Beege 98]

Years ago I tried to put some functionality together to do some of this here. I started off in the right direction but it ended up getting out of control. Any new thing I learned along the way (as I was creating it), I kept trying to add in and it all became a mess. One of my primary goals with that was to make sure the code could always be pre-compiled and still run. That part did work and I was able create a couple of good projects with it, but still a lot of parts I wouldn't consider correct now and certainly not manageable. 

Here is a redo of what I was going for there only this time I'm not going to be generating any of the assembly code. That's all going to be done using the built in macro engine already within fasm.dll and the macros written by Tomasz Grysztar (creator of fasm) so this time I don't have to worry about any of the code that gets generated. Im not going to touch the source at all. In fact there is not even going to be _fasmadd or global variables tracking anything. None of that is needed with the added basic and extended headers that you can read more about in the fasm documentation. You can use almost all of whats in the documentation section for basic/extended headers but ignore the parts about import,exports,resources,text encoding. doesn't really apply here.

Here are examples I came up with that covers a lot of core functionality to write assembly code in a manner that you already know how. If/while using multiple conditional logic statements,  multiple functions, local variables, global variables, structures, COM interfaces, strings as parameters, nesting function calls. These are all things you dont even have to think about when your doing it in autoit and I'm hoping this helps bring some of that same comfort to fasm. 

These 3 simple callback functions will be used through out the examples  

Global $gConsoleWriteCB = DllCallbackRegister('_ConsoleWriteCB', 'dword', 'str;dword'), $gpConsoleWriteCB = DllCallbackGetPtr($gConsoleWriteCB)
Global $gDisplayStructCB = DllCallbackRegister('_DisplayStructCB', 'dword', 'ptr;str'), $gpDisplayStructCB = DllCallbackGetPtr($gDisplayStructCB)
Global $gSleepCB = DllCallbackRegister('_SleepCB', 'dword', 'dword'), $gpSleepCB = DllCallbackGetPtr($gSleepCB)

Func _ConsoleWriteCB($sMsg, $iVal)
    ConsoleWrite($sMsg & $iVal & @CRLF)
EndFunc   ;==>_ConsoleWriteCB

Func _DisplayStructCB($pStruct, $sStr)
    _WinAPI_DisplayStruct(DllStructCreate($sStr, $pStruct), $sStr, 'def=' & $sStr)
EndFunc   ;==>_DisplayStructCB

Func _SleepCB($iSleep)
    Sleep($iSleep)
EndFunc   ;==>_SleepCB

 

proc/endp - like func and endfunc with some extra options. "uses" statement will preserve the registers specified. stdcall is the default call type if not specified. DWORD is the default parameter size if not specified. ret value is also handled for you. You don't have to worry about adjusting a number every time you throw on an extra parameter. In fact you don't ever have to specify/touch ebp/esp at all with these macros. See Basic headers -> procedures for full description.

force - just a macro I added for creating a anonymous label for the first/primary function to ensure the code gets generated. The problem we are getting around is this: in our example, _main is never actually called anywhere within fasm code and fasm engine detects that and thinks the code is doing nothing. Because of that it wants to skip generating that code and all code that was called by it leaving you with nothing. This is actually a great feature but we obviously want to make an exception for our main/initial/primary function that starts it all off so thats all this does.

Func _Ex_Proc()
    $g_sFasm = '' 

    _('force _main')
    _('proc _main uses ebx, parm1, parm2') ; _('proc _main stdcall uses ebx, parm1:DWORD, parm2:DWORD'); full statement
    _('     mov ebx, [parm1]')
    _('     add ebx, [parm2]')
    _('     mov eax, ebx')
    _('     ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    Local $iAdd = DllCallAddress('dword', DllStructGetPtr($tBinary), 'dword', 5, 'dword', 5)
    ConsoleWrite('Parm1+Parm2=' & $iAdd[0] & @CRLF)

EndFunc   ;==>_Ex_Proc

 

    Here Im showing you calling _ConsoleWriteCB autoit function we set up as a callback. Its how you would call any function in autoit from fasm.
    Strings - Notice Im creating and passing "edx = " string to the function on the fly. So helpful!
    invoke - same as a stdcall with brackets []. Use this for when calling autoit functions
 

Func _Ex_Callback()
    $g_sFasm = ''

    _('force _main')
    _('proc _main, pConsoleWriteCB, parm1, parm2')
    _('     mov edx, [parm1]')
    _('     add edx, [parm2]')
    _('     invoke pConsoleWriteCB, "edx = ", edx') ;
;~  _('     stdcall [pConsoleWriteCB], "edx = ", edx') ; same as invoke
    _('     ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    DllCallAddress('ptr', DllStructGetPtr($tBinary), 'ptr', $gpConsoleWriteCB, 'dword', 5, 'dword', 5)

EndFunc   ;==>_Ex_Callback

 

Showing .while/.endw, .if/.elseif/.else/.endif usage. .repeat .until are also macros you can use. See Extended Headers -> Structuring the source. Ignore .code, .data, .end - Those are gonna be more for a full exe.

invokepcd/invokepd - these are macros I added that are the same as invoke, just preserve (push/pop) ECX or both ECX and EDX during the call. Below is also a good example of what can happen when you don't preserve registers that are caller saved (us calling the function) vs callie saved (us creating the function). EAX,ECX,EDX are all caller saved so when we call another function like the autoit callback _ConsoleWriteCB, those registers could have very different values then what was in them before the call. This function below should do at least two loops, but it doesn't (at least on my pc) without preserving ECX because ECX is no longer zero when the function returns.

Keep the same thought in mind for registers EBX,ESI,EDI when you are creating assembly functions (callie saved). If your functions uses those registers, You need to preserve and restore them before your code returns back to autoit or else you could cause a similar effect to autoit. "trashing" registers is a term I've seen used alot when referring to these kind of mistakes

Func _Ex_IfElseWhile()
    $g_sFasm = ''

    _('force _main')
    _('proc _main uses ebx, pConsoleWriteCB')
    _(' xor edx, edx') ; edx=0
    _(' mov eax, 99') ;
    _(' mov ebx, 10')
    _(' xor ecx, ecx') ; ecx=0
    _(' .while ecx = 0')
    _('     .if eax<=100 & ( ecx | edx )') ; not true on first loop
    _('         inc ebx')
    _('         invokepcd pConsoleWriteCB, "Something True - ebx=", ebx')
    _('         ret')
    _('     .elseif eax < 99') ; Just showing you the elseif statement
    _('         inc ebx')
    _('     .else')
;~  _('         invokepcd pConsoleWriteCB, "Nothing True - ebx=", ebx') ; comment this and uncomment the line below
    _('         invoke pConsoleWriteCB, "Nothing True - ebx=", ebx')
    _('         inc edx') ; this will make next loop true
    _('     .endif')
    _(' .endw')
    _(' ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    DllCallAddress('dword', DllStructGetPtr($tBinary), 'ptr', $gpConsoleWriteCB)

EndFunc   ;==>_Ex_IfElseWhile

 

    Sub Functions : You already understand this. Not really "sub", its just another function you call. And those functions call other functions and so on.
    fix : syntax sugar - Look how easy it was to replace invoke statement with our actual autoit function name
    ptr : more sugar - same thing as using brackets [parm1]
    Nesting : In subfunc1 we pass the results of two function calls to the same function we are calling

expandcollapse popup

Func _Ex_SubProc()
    $g_sFasm = ''

    ;replace all '_ConsoleWriteCB' statments with 'invoke pConsoleWriteCB' before* assembly
    _('_ConsoleWriteCB fix invoke pConsoleWriteCB')

    _('force _main')
    _('proc _main uses ebx, pConsoleWriteCB, parm1, parm2')
    _('     mov ebx, [parm1]')
    _('     add ebx, [parm2]')
    _('     _ConsoleWriteCB, "ebx start = ", ebx')
    _('     stdcall _subfunc1, [pConsoleWriteCB], [parm1], [parm2]')
    _('     _ConsoleWriteCB, "ebx end = ", ebx')
    _('     ret')
    _('endp')
    ;
    _('proc _subfunc1 uses ebx, pConsoleWriteCB, parm1, parm2')
    _('     mov ebx, [parm1]')
    _('     _ConsoleWriteCB, "  subfunc1 ebx start = ", ebx')
    _('     stdcall _SubfuncAdd, <stdcall _SubfuncAdd, [parm1], [parm2]>, <stdcall _SubfuncAdd, ptr parm1, ptr parm2>') ; Nesting functions
    _('     _ConsoleWriteCB, "      _SubfuncAdd nested <5+5><5+5> = ", eax')
    _('     _ConsoleWriteCB, "  subfunc1 ebx end = ", ebx')
    _('     ret')
    _('endp')
    ;
    _('proc _SubfuncAdd uses ebx, parm1, parm2')
    _('     mov ebx, [parm1]')
    _('     add ebx, [parm2]')
    _('     mov eax, ebx')
    _('     ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    DllCallAddress('dword', DllStructGetPtr($tBinary), 'ptr', $gpConsoleWriteCB, 'dword', 5, 'dword', 5)

EndFunc   ;==>_Ex_SubProc

 

This demonstrates the struct macro. See basic headers -> Structures for more info

_FasmAu3StructDef will create an equivalent formated structure definition. All elements already have a sizeof.#name created internally. So in this example sizeof.AUTSTRUCT.x would equal 8. sizeof.AUTSTRUCT.z would equal 16 (2*8). I have added an additional one sot.#name (sizeoftype) for any array that gets created. Below is the source of what gets generate from 'dword x;dword y;short z[8]'. Also dont get confused that in fasm data definitions,  d is for data as in db (data byte) or dw (data word). Not double like it is in autoit's dword (double word). See intro -> assembly syntax -> data definitions
   

struct AUTSTRUCT
    x dd ?
    y dd ?
    z dw 8 dup ?
ends
define sot.AUTSTRUCT.z 2

Func _Ex_AutDllStruct()
    $g_sFasm = ''

    Local Const $sTag = 'dword x;dword y;short z[8]'
    _(_FasmAu3StructDef('AUTSTRUCT', $sTag))

    _('force _main')
    _('proc _main uses ebx, pDisplayStructCB, pAutStruct')
    _(' mov ebx, [pAutStruct]') ; place address of autoit structure in ebx
    _(' mov [ebx+AUTSTRUCT.x], 1234')
    _(' mov [ebx+AUTSTRUCT.y], 4321')
    _(' xor edx, edx')
    _(' mov ecx, 5') ; setup ecx for loop instruction
    _(' Next_Z_Index:') ; set elements 1-6 (0-5 here in fasm)
    _('     mov [ebx+AUTSTRUCT.z+(sot.AUTSTRUCT.z*ecx)], cx') ; cx
    _(' loop Next_Z_Index')
    _(' invoke pDisplayStructCB, [pAutStruct], "' & $sTag & '"')
    _(' mov [ebx+AUTSTRUCT.z+(sot.AUTSTRUCT.z*6)], 666')
    _(' mov [ebx+AUTSTRUCT.z+(sot.AUTSTRUCT.z*7)], 777')
    _(' ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    Local $tAutStruct = DllStructCreate($sTag)
    DllCallAddress('ptr', DllStructGetPtr($tBinary), 'ptr', $gpDisplayStructCB, 'struct*', $tAutStruct)
    _WinAPI_DisplayStruct($tAutStruct, $sTag)

EndFunc   ;==>_Ex_AutDllStruct

 

Here shows the locals/endl macros for creating local variables. See basic headers -> procedures. We create a local string and the same dll structure as above. Notice that you can initialize all the values of the structure on creation. There is a catch to this though that I will show you in next example.

addr macro - This will preform the LEA instruction in EDX and then push the address on to the stack. This is awesome, just remember its using EDX to perform that and does not preserve it. You'll pretty much want to use that for any local variables you are passing around.

Edit: I shouldn't say things like that so causally.  Use the addr macro as much as you want but remember that it is adding a couple of extra instuctions each time you use it so if your calling invoke within a loop and ultimate performance is one of your goals, you should probably perform the LEA instructions before the loop and save the pointer to a separate variable that your would then use in the loop. 

Func _Ex_LocalVarsStruct()
    $g_sFasm = ''

    Local Const $sTag = 'dword x;dword y;short z[8]'
    _(_FasmAu3StructDef('POINT', $sTag))

    _('force _main')
    _('proc _main, pDisplayStructCB')
    _(' locals')
    _('     sTAG db "' & $sTag & '", 0') ; define local string. the ', 0' at the end is to terminate the string.
    _('     tPoint POINT 1,2,<0,1,2,3,4,5,6,7>') ; initalize values in struct
    _(' endl')
    _(' invoke pDisplayStructCB, addr tPoint, addr sTAG')
    _(' mov [tPoint+POINT.x], 4321')
    _(' mov [tPoint+POINT.z+sot.POINT.z*2], 678')
    _(' invoke pDisplayStructCB, addr tPoint, addr sTAG')
    _(' ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    Local $ret = DllCallAddress('ptr', DllStructGetPtr($tBinary), 'ptr', $gpDisplayStructCB)

EndFunc   ;==>_Ex_LocalVarsStruct

 

Back to the catch. Alignment is the problem here but only with the initializes. I'm handling all the alignment ok so you don't have to worry about that for creating structures that need alignment, only if you are using the one liner initialize in locals. The problem comes from extra padding being defined to handle the alignment, but fasm doesn't really know its just padding so without adding extra comma's to the initiator statement, your data ends up in the padding or simply fails. The _FasmFixInit will throw in the extra commas needed to skip the padding.

Func _Ex_LocalVarStructEx()
    $g_sFasm = ''

    $sTag = 'byte x;short y;char sNote[13];long odd[5];word w;dword p;char ext[3];word finish'
    _(_FasmAu3StructDef('POINT', $sTag))

    _('force _main')
    _('proc _main, pDisplayStructCB')
    _(' locals')
    _('     tPoint POINT ' & _FasmFixInit('1,222,<"AutoItFASM",0>,<41,43,43,44,45>,6,7,"au3",12345', $sTag))
    _(' endl')
    _(' invoke pDisplayStructCB, addr tPoint, "' & $sTag & '"')
    _(' ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    DllCallAddress('dword', DllStructGetPtr($tBinary), 'ptr', $gpDisplayStructCB)

EndFunc   ;==>_Ex_LocalVarStructEx

 

I love this one and it is really not even that hard to explain. We got multiple functions and want to be able to call them individually. Here I simply use the primary function to tell me where all the functions are. I load all the offsets (byte distance from start of code) of each each function in to a dllstruct, then once its passed back to autoit, adjust all the offsets by where they are actually located in memory (pointer to dll). From there you can call each individual function as shown previously. full code is in the zip. 

String functions came from link below. I ended up modifying strcmp to get a value I understand. CRC32 func is all mine. Made it so easy being able to call _strlen and then use while statements like I normally would    https://www.strchr.com/strcmp_and_strlen_using_sse_4.2

expandcollapse popup

Func _Ex_SSE4_Library()
    $g_sFasm = ''

    _('force _main')
    _('proc _main stdcall, pAdd')
    _(' mov eax, [pAdd]')
    _(' mov dword[eax], _crc32')
    _(' mov dword[eax+4], _strlen')
    _(' mov dword[eax+8], _strcmp')
    _(' mov dword[eax+12], _strstr')
    _(' ret')
    _('endp')

    _('proc _crc32 uses ebx ecx esi, pStr')
    ;
    _('endp')

    _('proc _strlen uses ecx edx, pStr')
    ;
    _('endp')

    _('proc _strcmp uses ebx ecx edx, pStr1, pStr2') ; ecx = string1, edx = string2'
    ;
    _('endp')

    _('proc _strstr uses ecx edx edi esi, sStrToSearch, sStrToFind')
    ;
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    Local $pBinary = DllStructGetPtr($tBinary)

    Local $sFunction_Offsets = 'dword crc32;dword strlen;dword strcmp;dword strstr'
    $tSSE42 = DllStructCreate($sFunction_Offsets)
    $ret = DllCallAddress('ptr', $pBinary, 'struct*', $tSSE42)
    _WinAPI_DisplayStruct($tSSE42, $sFunction_Offsets, 'Function Offsets')

    ;Correct all addresses
    $tSSE42.crc32 += $pBinary
    $tSSE42.strlen += $pBinary
    $tSSE42.strcmp += $pBinary
    $tSSE42.strstr += $pBinary

    $sTestStr = 'This is a test string!'
    ConsoleWrite('$sTestStr = ' & $sTestStr & @CRLF)

    $iCRC = DllCallAddress('int', $tSSE42.crc32, 'str', $sTestStr)
    ConsoleWrite('CRC32 = ' & Hex($iCRC[0]) & @CRLF)

    $aLen = DllCallAddress('int', $tSSE42.strlen, 'str', $sTestStr)
    ConsoleWrite('string len = ' & $aLen[0] & '           :1:' & @CRLF)

    $aFind = DllCallAddress('int', $tSSE42.strcmp, 'str', $sTestStr, 'str', 'This iXs a test')
    ConsoleWrite('+strcmp = ' & $aFind[0] & @CRLF)

    $aStr = DllCallAddress('int', $tSSE42.strstr, 'str', 'This is a test string!', 'str', 'test')
    ConsoleWrite('Strstr = ' & $aStr[0] & @CRLF)

EndFunc   ;==>_Ex_SSE4_Library

 

I'm extremely happy I got a com interface example working. I AM. That being said.. I'm pretty fucking annoyed I cant find the original pointer when using using built in ObjCreateInterface I've tired more than just whats commented out. It anyone has any input (I know someone here does!) that would be great. Using the __ptr__ from _autoitobject works below. Example will delete the tab a couple times.

Edit: Got that part figured out. Thanks again trancexx!

expandcollapse popup

Func _Ex_ComObjInterface()
    $g_sFasm = ''

;~  _AutoItObject_StartUp()
;~  Local Const $sTagITaskbarList = "QueryInterface long(ptr;ptr;ptr);AddRef ulong();Release ulong(); HrInit hresult(); AddTab hresult(hwnd); DeleteTab hresult(hwnd); ActivateTab hresult(hwnd); SetActiveAlt hresult(hwnd);"
;~  Local $oList = _AutoItObject_ObjCreate($sCLSID_TaskbarList, $sIID_ITaskbarList, $sTagITaskbarList)

    Local Const $sCLSID_TaskbarList = "{56FDF344-FD6D-11D0-958A-006097C9A090}", $sIID_ITaskbarList = "{56FDF342-FD6D-11D0-958A-006097C9A090}"
    Local Const $sTagITaskbarList = "HrInit hresult(); AddTab hresult(hwnd); DeleteTab hresult(hwnd); ActivateTab hresult(hwnd); SetActiveAlt hresult(hwnd);"
    Local $oList = ObjCreateInterface($sCLSID_TaskbarList, $sIID_ITaskbarList, $sTagITaskbarList)

    _('interface ITaskBarList,QueryInterface,AddRef,Release,HrInit,AddTab,DeleteTab,ActivateTab,SetActiveAlt')
    ;
    _('force _main')
    _('proc _main uses ebx, pSleepCB, oList, pGUIHwnd')
    _('     comcall [oList],ITaskBarList,HrInit')
    _('     xor ebx, ebx')
    _('     .repeat')
    _('         invoke pSleepCB, 500') ; wait
    _('         comcall [oList],ITaskBarList,DeleteTab,[pGUIHwnd]') ; delete
    _('         invoke pSleepCB, 500') ; wait
    _('         comcall [oList],ITaskBarList,AddTab,[pGUIHwnd]') ; add back
    _('         comcall [oList],ITaskBarList,ActivateTab,[pGUIHwnd]') ; actvate
    _('         inc ebx')
    _('     .until ebx=4')
    _('     ret')
    _('endp')

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    Local $GUI = GUICreate("_Ex_ComObjInterface ------ DeleteTab")
    GUISetState()

;~  DllCallAddress('ptr', DllStructGetPtr($tBinary), 'ptr', $gpSleepCB, 'ptr', $oList.__ptr__, 'dword', Number($GUI))
    DllCallAddress('ptr', DllStructGetPtr($tBinary), 'ptr', $gpSleepCB, 'ptr', $oList(), 'dword', Number($GUI))

EndFunc   ;==>_Ex_ComObjInterface

 

Lastly here is an example of how to use a global variable. Without using the org statement, this value is just an offset like the functions in the library example. In order for your code to know that location, it needs to know where the real starting address is so we have to pass that to our functions. Once you have it, if you write your code proper and preserve registers correctly, you can just leave in EBX. From what I understand, if all functions are following stdcall rules, that register shouldn't change in less you change it. Something cool and important to remember is these variables will hold whatever values left in them till you wipe the memory (dll structure) holding your code. keep that in mind if you made your dll structure with a static keyword. If thats the case treat them like static variables

expandcollapse popup

Func _Ex_GlobalVars()
    $g_sFasm = ''

    _('_ConsoleWriteCB fix invoke pConsoleWriteCB')
    ;
    _('force _main')
    _('proc _main uses ebx, pMem, pConsoleWriteCB, parm1')
    _('     mov ebx, [pMem]') ; This is where are code starts in memory.
    _('     mov [ebx + g_Var1], 111')
    _('     add [ebx + g_Var1], 222')
    _('     _ConsoleWriteCB, "g_Var1 = ", [ebx + g_Var1]')
    _('     stdcall subfunc1, [pMem], [pConsoleWriteCB], [parm1]')
    _('     mov eax, g_Var1')
    _('     ret')
    _('endp')
    ;
    _('proc subfunc1 uses ebx, pMem, pConsoleWriteCB, parm1')
    _('     mov ebx, [pMem]')
    _('     mov [ebx + g_Var1], 333')
    _('     _ConsoleWriteCB, "g_Var1 from subfunc1= ", [ebx + g_Var1]')
    _('     stdcall subfunc2, [pConsoleWriteCB], [parm1]') ; no memory ptr passed. ebx should be callie saved
    _('     _ConsoleWriteCB, "g_Var1 from subfunc1= ", [ebx + g_Var1]')
    _('     stdcall subfunc2, [pConsoleWriteCB], [parm1]')
    _('     ret')
    _('endp')
    ;
    _('proc subfunc2, pConsoleWriteCB, parm1')
    _('     add [ebx + g_Var1], 321')
    _('     _ConsoleWriteCB, "g_Var1 from subfunc2= ", [ebx + g_Var1]')
    _('     ret')
    _('endp')
    ;
    _('g_Var1 dd ?') ; <--------- Global Var

    Local $tBinary = _FasmAssemble($g_sFasm)
    If @error Then Exit (ConsoleWrite($tBinary & @CRLF))

    Local $iOffset = DllCallAddress('dword', DllStructGetPtr($tBinary), 'struct*', $tBinary, 'ptr', $gpConsoleWriteCB, 'dword', 55)[0]
    ConsoleWrite('$iOffset = ' & $iOffset & @CRLF)

    Local $tGVar = DllStructCreate('dword g_Var1', DllStructGetPtr($tBinary) + $iOffset)

    ConsoleWrite('Directly access g_Var1 -> ' & $tGVar.g_Var1 & @CRLF) ; direct access

EndFunc   ;==>_Ex_GlobalVars

 

FasmEx.zip

Edited January 20, 2019 by Beege

[RTFC 376]

Outstanding! Great work.

[Beege 98]

9 hours ago, RTFC said:

Outstanding! Great work.

Thank you! 

[trancexx 1,016]

For InterfaceDispatch objects the original pointer is default property. In this case it would be $oList()

[Beege 98]

18 minutes ago, trancexx said:

For InterfaceDispatch objects the original pointer is default property. In this case it would be $oList()

You are wonderful! Thank you so much! 

With us not having to define QueryInterface,AddRef,Release, I got down a wrong path of thinking it was at some offset