{"id":2448,"date":"2014-08-04T13:33:58","date_gmt":"2014-08-04T13:33:58","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=2448"},"modified":"2014-09-20T22:22:52","modified_gmt":"2014-09-20T22:22:52","slug":"beyond-good-ol-run-key-part-15","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2014\/08\/04\/beyond-good-ol-run-key-part-15\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 15"},"content":{"rendered":"<p>Today I am going to show you yet another debugging mechanism that allows to load a couple of phantom DLLs.<\/p>\n<p>This time the culprit is DirectX.<\/p>\n<p>The DirectX is pretty much a standard for programming anything that is multimedia-related on Windows. Since this includes games, animations, demos, as well as video players, picture viewers, etc. the phantom DLLs (they are debug DLLs in this case) can be easily made persistent because they will be loaded anytime one of such DirectX-aware applications starts.<\/p>\n<p>Dropping one (or both) of these DLLs:<\/p>\n<ul>\n<li>d3d8d.dll<\/li>\n<li>d3d9d.dll<\/li>\n<\/ul>\n<p>in one of the directories covered by the PATH variable and adding the following Registry Entry<\/p>\n<pre style=\"padding-left: 30px;\">[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Direct3D]\r\n@=\"\"\r\n\"LoadDebugRuntime\"=dword:00000001\r\n\r\n<\/pre>\n<p>will ensure that these DLLs will be loaded anytime a Direct\u00a0X (its component called Direct 3D)\u00a0is being used by some application. They are loaded by respective Direct X versions (8 or 9).<\/p>\n<p>To test on XP (DirectX version 8 still is being used by dxdiag):<\/p>\n<ul>\n<li>Add the registry entry<\/li>\n<li>Drop test <strong>d3d8d.dll<\/strong> and <strong>d3d9d.dll<\/strong> into e.g. c:\\windows\\system32 directory<\/li>\n<li>Run <strong>dxdiag<\/strong><\/li>\n<li>Go to <strong>Display<\/strong> tab<\/li>\n<li>Click Test <strong>Direct 3D<\/strong><\/li>\n<li>You should see that <strong>d3d9d.dll<\/strong> is loaded when dxdiag starts and <strong>d3d8d.dll<\/strong> loads when you test <strong>Direct 3D<\/strong> feature on the <strong>Display<\/strong> tab<\/li>\n<\/ul>\n<p>To test on Win 7 (DirectX version 8 doesn&#8217;t seem to be used by dxdiag, but DLLs are present and applications loading Direct X 8 libraries will _still_ load the DLLs):<\/p>\n<ul>\n<li>Add the registry entry<\/li>\n<li>Drop test <strong>d3d9d.dll<\/strong> into e.g. c:\\windows\\system32 directory<\/li>\n<li>Run <strong>dxdiag<\/strong><\/li>\n<li>You should see that <strong>d3d9d.dll<\/strong> is loaded when dxdiag starts<\/li>\n<\/ul>\n<p>In other words, it should work on all OSes that have the Direct X 8 or 9 installed.<\/p>\n<p>You may be wondering if the same trick works for newer versions of DirectX.<\/p>\n<p>It does.<\/p>\n<p>The naming convention stays the same (e.g. d3d10d.dll, d3d11d.dll), but the major change is that:<\/p>\n<ul>\n<li>The loading is not system-wide (or, more specifically DirectX-ecosystem wide), but application specific, hence a different registry entry is being used to load these DLLs\n<ul>\n<li>e.g. for dxdiag it would be\n<ul>\n<li style=\"text-align: left;\">\n<pre>HKEY_CURRENT_USER\\Software\\<\/pre>\n<pre> Microsoft\\Direct3D\\dxdiag\\<\/pre>\n<pre> D3D10LoadDebugRuntime=1<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>The DLLs (e.g. d3d10d.dll) are loaded only under very specific circumstances (only a couple of Direct X functions related to shaders load the debug DLLs) so chance for it to be a successful persistent mechanism are much lower\n<ul>\n<li>I guess the DLLs are used to test performance of the graphic primitives, but I have no programming experience with Direct X so can only speculate here<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Today I am going to show you yet another debugging mechanism that allows to load a couple of phantom DLLs. This time the culprit is DirectX. The DirectX is pretty much a standard for programming anything that is multimedia-related on &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2014\/08\/04\/beyond-good-ol-run-key-part-15\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2448"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=2448"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2448\/revisions"}],"predecessor-version":[{"id":2453,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2448\/revisions\/2453"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=2448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=2448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=2448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}