{"id":4100,"date":"2017-01-21T00:13:01","date_gmt":"2017-01-21T00:13:01","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4100"},"modified":"2017-01-21T01:20:45","modified_gmt":"2017-01-21T01:20:45","slug":"this-is-not-an-exe-this-is-not-a-dll-this-is-a-windows-app","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/01\/21\/this-is-not-an-exe-this-is-not-a-dll-this-is-a-windows-app\/","title":{"rendered":"This is not an EXE, this is not a DLL, This is a Windows App"},"content":{"rendered":"<p>I normally don&#8217;t pay much attention to Windows apps, but since I knew calc.exe is just a dumb redirector that loads a Calculator app I eventually got curious and loaded the app into IDA. What caught my eye immediately was a number of exported functions:<\/p>\n<ul>\n<li>DllGetActivationFactory<\/li>\n<li>DllCanUnloadNow<\/li>\n<li>VSDesignerDllMain<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4101\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain-300x65.png\" width=\"500\" height=\"109\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain-300x65.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain.png 690w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>When I queried my test win10 system for executables that contain these strings I discovered that pretty much all of them are Windows Apps. I then googled around trying to find out if there is any mention of these functions online, and in particular, how they are being used. I didn&#8217;t find anything interesting, but found some references, including this excerpt from an automatically\u00a0 generated build file:<\/p>\n<pre>#if (defined(_M_IX86) || defined(_M_AMD64)) &amp;&amp; !defined(_VSDESIGNER_DONT_LOAD_AS_DLL)\r\n#if defined(_M_IX86)\r\n#pragma comment(linker, \"\/EXPORT:DllGetActivationFactory=_DllGetActivationFactory@8,PRIVATE\")\r\n#pragma comment(linker, \"\/EXPORT:DllCanUnloadNow=_DllCanUnloadNow@0,PRIVATE\")\r\n#pragma comment(linker, \"\/EXPORT:VSDesignerDllMain=_VSDesignerDllMain@12,PRIVATE\")\r\n#pragma comment(linker, \"\/INCLUDE:___refMTAThread\")\r\n#elif defined(_M_AMD64)\r\n#pragma comment(linker, \"\/EXPORT:DllGetActivationFactory=DllGetActivationFactory,PRIVATE\")\r\n#pragma comment(linker, \"\/EXPORT:DllCanUnloadNow,PRIVATE\")\r\n#pragma comment(linker, \"\/EXPORT:VSDesignerDllMain,PRIVATE\")\r\n#pragma comment(linker, \"\/INCLUDE:__refMTAThread\")\r\n#endif<\/pre>\n<p>So, looks like the building script depends on the _VSDESIGNER_DONT_LOAD_AS_DLL variable. I installed the latest Visual Studio trial version and queried all files for the &#8216;VSDesignerDllMain&#8217; and &#8216;_VSDESIGNER_DONT_LOAD_AS_DLL&#8217; strings&#8230; and didn&#8217;t get many results either&#8230;<\/p>\n<p>Just a few files:<\/p>\n<ul>\n<li>Microsoft.VisualStudio.DesignTools.Utility.dll<\/li>\n<li>Microsoft.VisualStudio.TestPlatform.BuildTasks.dll<\/li>\n<li>Microsoft.Windows.UI.Xaml.81.Build.Tasks.dll<\/li>\n<li>Microsoft.Windows.UI.Xaml.Build.Tasks.dll<\/li>\n<\/ul>\n<p>Their code didn&#8217;t really explain much (none of them actually refer to code using the &#8216;VSDesignerDllMain&#8217; function, only generate files containing references to it).<\/p>\n<p>So, I am curious what is the purpose of these functions&#8230; either some legacy tool, or some internal testing platform? &#8216;VSDesigner&#8217; suggests IDE integration of some sort &#8211; potentially quicker way to debug the app? Anyway, just guessing here&#8230;\u00a0 If you are a Windows App programmer, or spent more time on reversing Apps and know how these are being used I&#8217;d be grateful if you could share.<\/p>\n<p>In terms of code, the function simply calls the _DllMainCRTStartup function after setting the internal variable VSDesignerDllMain_status to 3, the DllMainCRTStartup eventually calls DllMain function:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4104\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain2-300x88.png\" width=\"500\" height=\"147\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain2-300x88.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/app_VSDesignerDllMain2.png 524w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a>So, we have 2 entry points &#8211; one for the Windows exe (&#8216;start&#8217;) and the second one for the DLL (&#8216;VSDesignerDllMain&#8217;-&gt;&#8217;DllMain&#8217;)<\/p>\n<p>In the mean time, a typical Windows App is like a Frankenstein&#8217;s monster &#8211; it is a MZ DOS executable, a PE executable &amp; DLL in one, a .NET assembly, a HTML\/XAML madness, and&#8230; it can&#8217;t be even launched directly from the Explorer, because it needs to be activated via one of the 3 methods offered by the <a href=\"https:\/\/msdn.microsoft.com\/EN-US\/library\/windows\/desktop\/hh706902(v=vs.85).aspx\">IApplicationActivationManager<\/a> COM interface (AFAIK, not sure if there is any other way). While the plot thickens the platform gets more and more complicated and reversing work harder and harder&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I normally don&#8217;t pay much attention to Windows apps, but since I knew calc.exe is just a dumb redirector that loads a Calculator app I eventually got curious and loaded the app into IDA. What caught my eye immediately was &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/01\/21\/this-is-not-an-exe-this-is-not-a-dll-this-is-a-windows-app\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[44],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4100"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4100"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4100\/revisions"}],"predecessor-version":[{"id":4106,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4100\/revisions\/4106"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}