RUNDLL32 & INF

Today,While I am installing the Ultraedit,a batch file leave me a great impression.it reads:

rundll32 setupapi.dll,InstallHinfSection DefaultInstall 128 ./Uedit32.inf

these days I use the batch process my work, it is very convenient, which made me want to learn more.

Rundll32 I was very familiar with it, it usually show up in my Task Manager. It is a great tool, but always made use of by crackers.

Rundll32’s command line is as below:

Rundlll32 <dllname>,<entrypoint> <optinal arguments>

Note:The comma betweens <dllname> and <entrypoint> is really important. It will fail without any error messages if it is missed.

The steps executed by rundll32 is :

1.       analysing the command line.

2.       Load the specified DLL through LoadLibrary()

3.       Get the address of <entrypoint> function through GetProcAdress()

4.       Call <entrypoint> function and pass the <optinal arguments> to it if it needs

5.       When <entrypoint> returns,rundll32 unload DLL and exit

Back up to the batch,it uses the format here:

RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection <section><mode><path>

SETUPAPI.DLL is the dll,InstallHinfSection is the entrypoint and the rest is the arguments. These arguments should used with .inf