Search notes:

rundll32.exe

rundll32.exe allows to execute functions within a DLL from cmd.exe.

Function signature

The signature of a function needs to be as follows:

void CALLBACK funcName(
       HWND      hwnd,
       HINSTANCE hinst,
       LPSTR     lpszCmdLine,
       int       nCmdShow
);

See also this example C-source code that can be compiled into a DLL and then have its function called with rundll32.exe.

Syntax

The syntax for using rundll32 is as follows

c:\> rundll32 nameOf.DLL,entryPoint
c:\> rundll32 nameOf.DLL,entryPoint optionalArgument1
c:\> rundll32 nameOf.DLL,entryPoint optionalArgument1 optionalArgument2 
c:\> rundll32 nameOf.DLL,entryPoint optionalArgument1 optionalArgument2 …

When used that way, it loads nameOf.DLL with the WinAPI function LoadLibrary() and determines the address of the function entryPoint with GetProcAddress().

Starting CPL applets

Notably, rundll32.exe is used to start .cpl files (Control Panel applets) with the following convention:

rundll32.exe shell32.dll,Control_RunDLL FooBarBaz.cpl,arguments

Some useful usages

Open mouse control panel

c:\> rundll32.exe shell32.dll,Control_RunDLL main.cpl @0

The mouse settings are apperently stored in the registry under HKEY_CURRENT_USER\Control Panel\Mouse.

Using rundll32 in a creative way

This Stackoverflow question shows how it is possible to execute JavaScript with rundll.32:

C:\> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";alert('Hello-World');

Even more fascinating is the answer that explains why and how this is working.

TODO

The following command is supposed to print a HTML document (in PowerShell), but it isn't (at least when I tried to use it):

rundll32 C:\Windows\System32\mshtml.dll,PrintHTML "Microsoft Print to PDF" $pwd\languages.html

Links

Rob van der Woude's rundll32 page.

Index