动态链接库函数启动器Rundll32　

关注

原创最新推荐文章于 2026-10-14 10:00:07 发布 1.1k 阅读 AI 写同款· GEO 优化 ›

rundll32原理与安全运维实践：DLL函数调用机制详解 rundll32.exe 是 Windows 系统中用于动态调用 DLL 导出函数的核心工具，其本质并非执行 DLL 文件，而是通过 LoadLibrary 和 GetProcAddress 实现标准化函数调用。它依托 DLL 导出表定位入口，严格遵循 CALLBACK 调用约定，具备轻量、免依赖、全版本兼容等技术价值。广泛应用于控制面板打开、回收站清空、网络配置等系统级 UI 自动化场景，也是企业无痕运维脚本与 IT 排障工具包的关键组件。理解其命令语法约束（如逗号分隔、无空格、必须带.dll扩展名）及阅读详情

HMODULE g_hmodDLL;

BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD ul_reason_for_call,
                       LPVOID lpReserved
      )
{
if (ul_reason_for_call == DLL_PROCESS_ATTACH)
        g_hmodDLL =HMODULE(hModule);

return TRUE;
}

extern "C" __declspec(dllexport) void CALLBACK MagicDel(HWND,
                                                        HINSTANCE,
                                                        LPTSTR lpCmdLine,
                                                        int)
{
    // delete the executable file that created this process
    Sleep(2000);
    DeleteFile(lpCmdLine);

    // delete ourself
    char filenameDLL[MAX_PATH];
    GetModuleFileName(g_hmodDLL, filenameDLL, sizeof(filenameDLL));

    __asm
    {
   lea     eax, filenameDLL
   push    0
   push    0
   push    eax
   push    ExitProcess
   push    g_hmodDLL
   push    DeleteFile
   push    FreeLibrary
   ret
    }
}

extern   "C"   __declspec(dllexport) void __cdecl   MyEntry(HWND   hwnd,                 //   handle   to   owner   window
               HINSTANCE   hinst,     //   instance   handle   for   the   DLL
               LPTSTR   lpCmdLine,   //   string   the   DLL   will   parse
               int   nCmdShow             //   show   state
               )
{
MessageBox(NULL,lpCmdLine,"",MB_OK);
}

调用方法：
rundll32.exe rdTest.dll,MyEntry "hello!"

The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:

void CALLBACK EntryPoint(
  HWND hwnd,        // handle to owner window
  HINSTANCE hinst,  // instance handle for the DLL
  LPTSTR lpCmdLine, // string the DLL will parse
  int nCmdShow      // show state
);

Note that EntryPoint is a placeholder for the actual function name. For a list of possible show states, see WinMain.

The following is the command-line syntax for Rundll32:

rundll32 DllName,FunctionName [Arguments]

DllName

Specifies the name of the DLL. The name cannot contain spaces, commas, or quotation marks. The utility searches for the DLL using the search criteria documented for the LoadLibrary function. Therefore, it is best to use the short name and provide a full path for the DLL.

FunctionName

Specifies the name of the function to call in DllName. Requires a comma (without no spaces) between DllName and FunctionName.

Arguments

Optional arguments for FunctionName.

Rundll32 loads the specified DLL using LoadLibrary, obtains the address of the function using the GetProcAddress function, and calls the function with the specified arguments, if any. When the function returns, Rundll32 unloads the DLL and exits.

Windows NT/2000: It is possible to create a Unicode version of the function. Rundll32 first tries to find a function named EntryPointW. If it cannot find this function, it tries EntryPointA, then EntryPoint. To create a DLL that supports ANSI on Windows 95/98/Me and Unicode otherwise, export two functions: EntryPointW and EntryPoint.

参阅：

http://support.microsoft.com/kb/164787

http://blogs.msdn.com/b/oldnewthing/archive/2004/01/15/58973.aspx

收录于