{"id":10276,"date":"2025-12-07T00:01:10","date_gmt":"2025-12-07T00:01:10","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10276"},"modified":"2025-12-07T00:01:10","modified_gmt":"2025-12-07T00:01:10","slug":"1-little-secret-of-sqlsrv32-dll","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2025\/12\/07\/1-little-secret-of-sqlsrv32-dll\/","title":{"rendered":"1 little secret of sqlsrv32.dll"},"content":{"rendered":"\n<p>This post is not really about <em>sqlsrv32.dll<\/em>, but since it is poking in this library&#8217;s code that led me to rediscover the <em><a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/desktop\/hh829625(v=vs.85)\">BidInterface<\/a><\/em> interface for the third time (I even described it <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/07\/13\/beyond-good-ol-run-key-part-111\/\">twice<\/a> <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/10\/17\/beyond-good-ol-run-key-part-129\/\">before<\/a>, without anyone noticing!), it ended up in a title of this post&#8230;<\/p>\n\n\n\n<p>Anyway, back to the rediscovery bit&#8230; I am actually quite surprised that I was able to not only rediscover it for the 3rd time, but also find a new way to abuse it. And as usual, it is the Procmon logs that did most of the work here&#8230;<\/p>\n\n\n\n<p>When you attempt to load <em>sqlsrv32.dll<\/em> via <em>rundll32.exe<\/em> and execute any of its exported functions f.ex.:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rundll32 sqlsrv32.dll, TestDlgProc<\/pre>\n\n\n\n<p>the <em>sqlsrv32.dll<\/em> library will try to activate that aforementioned BidInterface libraries:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface1.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface1.png\" alt=\"\" class=\"wp-image-10277\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface1.png 796w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface1-300x40.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface1-768x101.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface1-500x66.png 500w\" sizes=\"(max-width: 796px) 100vw, 796px\" \/><\/a><\/figure>\n\n\n\n<p>As we can see, not only the <em>:Path<\/em> is being looked at, but also a few more other things:<\/p>\n\n\n\n<ul>\n<li>the full path of the executable+ its Process ID (PID)<\/li>\n\n\n\n<li>the full path of the executable<\/li>\n\n\n\n<li>the directory extracted from the path of the executable, with an asterisk<\/li>\n<\/ul>\n\n\n\n<p>That&#8217;s a very granular control over the BidInterface tracing, and after testing these entries for <em>rundll32.exe<\/em>, I was able to immediately load the test DLL of my choice:<\/p>\n\n\n\n<ul>\n<li>first we create the entry for <em>C:\\WINDOWS\\system32\\rundll32.exe<\/em> and pointing it to <em>c:\\test\\test64_dll.dll<\/em>:<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface2.png\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface2.png\" alt=\"\" class=\"wp-image-10278\" width=\"500\" height=\"89\"\/><\/a><\/figure>\n\n\n\n<ul>\n<li>and then we launch the <em>rundll32.exe<\/em> command listed above:<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface3.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface3-1024x190.png\" alt=\"\" class=\"wp-image-10279\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface3-1024x190.png 1024w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface3-300x56.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface3-768x142.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface3-500x93.png 500w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface3.png 1059w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>Obviously, the <em>C:\\WINDOWS\\system32\\*<\/em> entry pointing to the same library works as well:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface4.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface4-1024x196.png\" alt=\"\" class=\"wp-image-10280\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface4-1024x196.png 1024w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface4-300x57.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface4-768x147.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface4-500x96.png 500w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2025\/12\/BidInterface4.png 1078w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>That&#8217;s it!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This post is not really about sqlsrv32.dll, but since it is poking in this library&#8217;s code that led me to rediscover the BidInterface interface for the third time (I even described it twice before, without anyone noticing!), it ended up &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2025\/12\/07\/1-little-secret-of-sqlsrv32-dll\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[126,56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10276"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10276"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10276\/revisions"}],"predecessor-version":[{"id":10281,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10276\/revisions\/10281"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}