| Back to logs list
135135 2010 年 11 月 08 日 11:30 Reading (loading. ..) Comments (0) Category: Personal Diary
rundll32 usage and examples
Rundll32.exe What is it?
Gu think Italy, \Its role is to perform an internal function in the DLL file, so that the process which will only have Rundll32.exe, instead of a back door process DLL, so that the process to achieve the hidden. If you see the system has multiple Rundll32.exe, do not panic, this proves how many start with Rundll32.exe the DLL file. Of course, the implementation of the DLL file Rundll32.exe what, we can automatically load from the system where to find.
Now, let me introduce Rundll32.exe this document, the meaning has been said above, function is to command line calling the dynamic link library. There is also a Rundll.exe file system, he means \Take a look at the function prototype used Rundll32.exe:
Void CALLBACK FunctionName (
HWND hwnd,
HINSTANCE hinst,
LPTSTR lpCmdLine,
Int nCmdShow
);
the command line to use as: Rundll32.exe DLLname, Functionname [Arguments]
DLLname for the need to implement the DLL file name; Functionname for the front of the DLL files need to perform the function of specific leads; [Arguments] as leads to the function of specific parameters. Brief Discussion on the role of Rundll32.exe
common friend Windows9x Rundll32.exe and Rundll.exe necessarily be familiar with these two files now, however, because the original functions of these two programs only restricted to internal use at Microsoft, which really knows how to use their friends must have not much. So good, if you do not know, then let me tell you.
First of all, you make a little experiment (please keep it in advance you are the result of the implementation of the program, or ...): click \exe user.exe, restartwindows, then press the Enter key, then you will see, the machine is restarted,
new balance outlet! How, is not it interesting?
course, Rundll features more than just restart your machine. In fact, Rundll who, by definition,
new new balance shoes, the implementation of Dll also, its function is to call the Windows command-line way to the dynamic link library, Rundll32.exe and Rundll.exe difference is that the former is called 32-bit link libraries, and The latter is used in 16-bit link libraries, and their command format is:
RUNDLL.EXE,,
here to note three points: 1.Dll file name can not contain spaces, such as the file is located in c: \ ProgramFiles \ directory You should change the path c: \ Progra ~ 1 \; 2.Dll Dll file name and a comma between the entry point can not be less, otherwise the program will error and will not give any information! 3. This is the most important point: Rundll not be used to call with return value parameter Dll,
new balance running shoes, such Win32API the GetUserName (), GetTextFace () and so on. In Visual Basic, provides a command to execute external program Shell, format:
Shell \instructions, make your own VB programs otherwise difficult or even impossible to achieve the effect: still restart, for example, the traditional method requires you to first create a VB project module, then write the WinAPI's statement, and finally to the program calls. Now only one:
Shell \Is much more convenient?
fact, Rundll32.exe in Windows control panel and call a variety of system options has a unique advantage. Next, I will be on the Internet, I collected about Rundll instructions are listed below (very useful and can save you a lot of time to call Windows API!!), For your reference in programming:
command line: rundll32.exe shell32.dll,
[Transfer] color schemes and color!, Control_RunDLL
function: Display Control Panel
command line: rundll32.exe shell32.dll, Control_RunDLL access.cpl,, 1
features: Display \, Control_RunDLL access.cpl,, 2
features: Display \dll,
new balance sneakers, Control_RunDLL access.cpl,, 3
features: Display \. dll, Control_RunDLL access.cpl,, 4
features: Display \exe shell32.dll, Control_RunDLL access.cpl,, 5
features: Display \. exe shell32.dll, Control_RunDLL sysdm.cpl @ 1
functions: the implementation of the \
command line: rundll32.exe shell32.dll,
new balance mens, SHHelpShortcuts_RunDLL AddPrinter
functions: the implementation of the \
command line: rundll32.exe shell32.dll, Control_RunDLL appwiz.cpl,, 0 &: from top to bottom ,0-3
function: display \Control Panel - Add / Remove Programs - Change or Remove Programs \
command line: rundll32.exe shell32.dll, Control_RunDLL appwiz.cpl,, 1
features: Display \\
command line: rundll32.exe shell32.dll, Control_RunDLL appwiz.cpl,, 2
features: Display \piece \
command line: rundll32.exe shell32.dll, Control_RunDLL appwiz.cpl,, 3
features: Display \Access \
command line: rundll32.exe syncui.dll, Briefcase_Create
function: on the desktop to create a new \
command line: rundll32.exe diskcopy.dll, DiskCopyRunDll
functions: Copy floppy display window
command line: rundll32. exe apwiz.cpl, NewLinkHere% 1
function: display \
command line: rundll32.exe shell32.dll, Control_RunDLL timedate.cpl,, 0
function: display \
command line: rundll32.exe shell32.dll, Control_RunDLL timedate.cpl,, 1
function: display \
command line: rundll32.exe rnaui.dll, RnaDial [the name of a dial-up connection]
function: display a dial-up connection dial-up window. If you have dial-up connection, it shows the connection status of the current window.
command line: rundll32.exe rnaui.dll, RnaWizard
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL desk.cpl,, -1
function: Display the \
command line: rundll32.exe shell32.dll, Control_RunDLL desk.cpl,, 0
function: Display the \
command line: rundll32.exe shell32.dll, Control_RunDLL desk.cpl,, 1
function: Display the \
command line: rundll32.exe shell32.dll, Control_RunDLL desk.cpl,, 2
function: Display the \
command line: rundll32.exe shell32.dll, Control_RunDLL desk.cpl,
new balance shoes,, 3
features: Display shows \
command line: rundll32.exe shell32.dll, SHHelpShortcuts_RunDLL FontsFolder
features: Display Windows \
command line: rundll32.exe shell32.dll, Control_RunDLL main.cpl @ 3
function: the same is to show Windows \
command line: rundll32.exe shell32.dll, SHformatDrive
features: Display Format Floppy dialog box.
command line: rundll32.exe shell32.dll, Control_RunDLL joy.cpl,, 0
features: Display \window.
command line: rundll32.exe shell32.dll, Control_RunDLL joy.cpl,
HP Driver Website - Qzone log,, 1
features: Display \entry window.
command line: rundll32.exe mshtml.dll, PrintHTML (HTML document)
functions: printing HTML documents.
command line: rundll32.exe shell32.dll, Control_RunDLL mlcfg32.cpl
features: Display Microsoft Exchange General Options window.
command line: rundll32.exe shell32.dll, Control_RunDLL main.cpl @ 0
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL main.cpl @ 1
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL main.cpl @ 1,, 1
features: Display \entry window.
command line: rundll32.exe shell32.dll, Control_RunDLL main.cpl @ 2
features: Display Windows \
command line: rundll32.exe shell32.dll, Control_RunDLL main.cpl @ 3
features: Display Windows \
command line: rundll32.exe shell32.dll,
明星爱上只同居不完婚的风潮 - Qzone日志, Control_RunDLL main.cpl @ 4
features: Display \window.
command line: rundll32.exe shell32.dll, Control_RunDLL modem.cpl,, add
functions: the \
command line: rundll32.exe shell32.dll, Control_RunDLL mmsys.cpl,, 0
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL mmsys.cpl,, 1
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL mmsys.cpl,, 2
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL mmsys.cpl,, 3
features: Display \.
command line: rundll32.exe shell32.dll, Control_RunDLL mmsys.cpl,, 4
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL mmsys.cpl @ 1
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL netcpl.cpl
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL odbccp32.cpl
function: display ODBC32 data management options window.
command line: rundll32.exe shell32.dll, OpenAs_RunDLL {drive: \ path \ filename}
Function: Displays the file (drive: \ path \ filename) in the \
command line: rundll32.exe shell32.dll, Control_RunDLL password.cpl
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL powercfg.cpl
features: Display \
command line: rundll32.exe shell32.dll, SHHelpShortcuts_RunDLL PrintersFolder
features: Display Windows \(With rundll32.exe shell32.dll, Control_RunDLL main.cpl @ 2)
command line: rundll32.exe shell32.dll, Control_RunDLL intl.cpl,, 0
Function: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL intl.cpl,, 1
features: Display \window.
command line: rundll32.exe shell32.dll, Control_RunDLL intl.cpl,, 2
features: Display \window.
command line: rundll32.exe shell32.dll, Control_RunDLL intl.cpl,, 3
features: Display \window.
command line: rundll32.exe shell32.dll, Control_RunDLL intl.cpl,, 4
features: Display \window.
command line: rundll32.exe desk.cpl, InstallScreenSaver [Ying screen protection file name]
functions: protection of the specified firefly screen is set to Windows screen saver file and display properties window firefly screen protection.
command line: rundll32.exe shell32.dll, Control_RunDLL sysdm.cpl,, 0
features: Display \
command line: rundll32.exe shell32.dll, Control_RunDLL sysdm.cpl,, 1
features: Display \window.
command line: rundll32.exe shell32.dll, Control_RunDLL sysdm.cpl,, 2
features: Display \Properties window.
command line: rundll32.exe shell32.dll, Control_RunDLL sysdm.cpl,, 3
features: Display \
command line: rundll32.exe user.exe, restartwindows
function: forced to close all programs and restart the machine.
command line: rundll32.exe user.exe, exitwindows
function: forced to close all programs and shut down.
command line: rundll32.exe shell32.dll, Control_RunDLL telephon.cpl
function: display \; command line: rundll32.exe shell32.dll, Control_RunDLL themes.cpl
function: display the \Delphi.VisualC + + and other programming languages can also call external commands ways to use Rundll of these features no longer specific methods described in detail here. Flexible use of Rundll, some programming will make you relax and achieve a multiplier effect!
\; - Open the \user, tilechildwindows \Windows Explorer
\; - exchange the mouse button
\drive \Death, the blue screen
\parameter \Start Windows Explorer
\; - Windows9x quick restart
\Connection \\
winexec ('rundll32.exe shell32.dll, Control_RunDLL', 9);
{Accessibility Properties - Keyboard}
winexec ('rundll32.exe shell32.dll, Control_RunDLL access.cpl, 1' , 9);
{Accessibility Properties - sounds}
winexec ('rundll32.exe shell32.dll, Control_RunDLL access.cpl, 2', 9);
{Accessibility Properties - Display}
winexec ('rundll32.exe shell32.dll, Control_RunDLL access.cpl, 3', 9);
{Accessibility Properties - Mouse}
winexec ('rundll32.exe shell32.dll, Control_RunDLL access . cpl, 4 ', 9);
{Accessibility Properties - General}
winexec (' rundll32.exe shell32.dll, Control_RunDLL access.cpl, 5 ', 9);
{add / Remove Programs Properties - Install / Uninstall}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Appwiz.cpl, 1', 9);
{Add / Remove Programs Properties-Windows Installer}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Appwiz.cpl, 2', 9);
{Add / Remove Programs Properties - startup disk}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Appwiz.cpl , 3 ', 9);
{Display Properties - background}
winexec (' rundll32.exe shell32.dll, Control_RunDLL desk.cpl, 0 ', 9);
{Display Properties - Screen Saver }
winexec ('rundll32.exe shell32.dll, Control_RunDLL desk.cpl, 1', 9);
{Display Properties - Appearance}
winexec ('rundll32.exe shell32.dll, Control_RunDLL desk. cpl, 2 ', 9);
{Display Properties - Settings}
winexec (' rundll32.exe shell32.dll, Control_RunDLL desk.cpl, 3 ', 9);
{Internet Properties - General}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Inetcpl.cpl, 0', 9);
{Internet Properties - Security}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Inetcpl.cpl , 1 ', 9);
{Internet Properties - Content}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Inetcpl.cpl, 2 ', 9);
{Internet Properties - Connection}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Inetcpl.cpl, 3', 9);
{Internet Properties - Programs}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Inetcpl.cpl, 4 ', 9);
{Internet Properties - Advanced}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Inetcpl.cpl, 5 ', 9);
{Regional Settings Properties - Regional Settings}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Intl.cpl, 0', 9);
{Regional Settings Properties - Number}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Intl. cpl, 1 ', 9);
{Regional Settings Properties - Money}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Intl.cpl, 2 ', 9);
{Regional Settings Properties - time}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Intl.cpl, 3', 9);
{Regional Settings Properties - Date}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Intl.cpl, 4 ', 9);
winexec (' rundll32.exe shell32.dll, Control_RunDLL Joy.cpl, 0 ', 9);
winexec (' rundll32.exe shell32 . dll, Control_RunDLL Joy.cpl, 1 ', 9);
{Mouse Properties}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Main.cpl ', 9);
{Multimedia Properties - Audio}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Mmsys.cpl, 0', 9);
{Multimedia Properties - Video}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Mmsys . cpl, 1 ', 9);
{multimedia property-MIDI}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Mmsys.cpl, 2 ', 9);
{attribute-CD Multimedia Music}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Mmsys.cpl, 3', 9);
{multimedia property - equipment}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Mmsys . cpl, 4 ', 9);
{Modem Properties}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Modem.cpl ', 9);
winexec (' rundll32.exe shell32.dll, Control_RunDLL Netcpl.cpl ', 9);
{password attributes}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Password.cpl ', 9);
{scanner and digital Camera Properties}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Sticpl.cpl', 9);
{System Properties - General}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Sysdm. cpl, 0 ', 9);
{System Properties - Device Manager}
winexec (' rundll32.exe shell32.dll, Control_RunDLL Sysdm.cpl, 1 ', 9);
{System Properties - Hardware configuration file}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Sysdm.cpl, 2', 9);
{System Properties - Performance}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Sysdm.cpl, 3 ', 9);
{Date / Time Properties}
winexec (' rundll32.exe shell32.dll, Control_RunDLL timedate.cpl ', 9);
{Power Management Properties}
winexec ('rundll32.exe shell32.dll, Control_RunDLL Powercfg.cpl', 9);
winexec ('rundll32.exe shell32.dll, Control_RunDLL Telephon.cpl', 9);
SO careful
Linear Mode
