|
Today,While I am installing the Ultraedit,a batch file leave me a great impression.it reads:
rundll32 setupapi.dll,InstallHinfSection DefaultInstall 128 ./Uedit32.inf
these days I use the batch process my work, it is very convenient, which made me want to learn more.
Rundll32 I was very familiar with it, it usually show up in my Task Manager. It is a great tool, but always made use of by crackers.
Rundll32’s command line is as below:
Rundlll32 <dllname>,<entrypoint> <optinal arguments>
Note:The comma betweens <dllname> and <entrypoint> is really important. It will fail without any error messages if it is missed.
The steps executed by rundll32 is :
1. analysing the command line.
2. Load the specified DLL through LoadLibrary()
3. Get the address of <entrypoint> function through GetProcAdress()
4. Call <entrypoint> function and pass the <optinal arguments> to it if it needs
5. When <entrypoint> returns,rundll32 unload DLL and exit
Back up to the batch,it uses the format here:
RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection <section><mode><path>
SETUPAPI.DLL is the dll,InstallHinfSection is the entrypoint and the rest is the arguments. These arguments should used with .inf
| 
转播
