{"id":5588,"date":"2018-11-24T01:42:22","date_gmt":"2018-11-24T01:42:22","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5588"},"modified":"2018-11-24T01:45:14","modified_gmt":"2018-11-24T01:45:14","slug":"advpack-dll-delnoderundll32-and-its-flags","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/11\/24\/advpack-dll-delnoderundll32-and-its-flags\/","title":{"rendered":"advpack.dll ! DelNodeRunDLL32 and its flags"},"content":{"rendered":"<p>It&#8217;s one of these &#8220;I was looking at something else, and as usual, came across something else&#8221; cases. In this particular instance it was the good ol&#8217; DelNodeRunDLL32 function exported by the advpack.dll.<\/p>\n<p>A quick search followed, and I soon discovered that <a href=\"https:\/\/twitter.com\/bohops\">@bohops<\/a> <a href=\"https:\/\/twitter.com\/bohops\/status\/988175307172655104\">twitted<\/a> about it a while ago, so there was not that much to add&#8230;<\/p>\n<p>However&#8230;<\/p>\n<p>Looking closer at the DelNodeRunDLL32W function I noticed that it tries to take two arguments, not one, as originally assumed. If the second argument is not present, it is assumed to be 0.<\/p>\n<p>Why not checking what the second argument is all about though? And here we are&#8230;<\/p>\n<p>A few more Google searches later we can (re-)discover that DelNodeRunDLL32 function can delete both individual files, and whole directories + change its behavior if we ask it too.<\/p>\n<p>How?<\/p>\n<p>Via its flags. Ones that we can choose to pass via a command line argument (the second one, as you guessed by now).<\/p>\n<p>Again, googling around I came across this <a href=\"https:\/\/github.com\/tpn\/winsdk-10\/blob\/master\/Include\/10.0.10240.0\/um\/advpub.h\">header file<\/a> that lists all the flags that are documented:<\/p>\n<pre>\/\/ FLAGS:\r\n#define ADN_DEL_IF_EMPTY 0x00000001 \/\/ delete the directory only if it's empty\r\n#define ADN_DONT_DEL_SUBDIRS 0x00000002 \/\/ don't delete any sub-dirs; delete only the files\r\n#define ADN_DONT_DEL_DIR 0x00000004 \/\/ don't delete the dir itself\r\n#define ADN_DEL_UNC_PATHS 0x00000008 \/\/ delete UNC paths\r\n<\/pre>\n<p>Running<\/p>\n<ul>\n<li>rundll32.exe advpack.dll,DelNodeRunDLL32 &#8220;c:\\test&#8221; &#8211; will wipe out the whole &#8216;test&#8217; directory<\/li>\n<li>rundll32.exe advpack.dll,DelNodeRunDLL32 &#8220;c:\\test\\file&#8221; &#8211; will delete the &#8216;file&#8217; only<\/li>\n<li>rundll32.exe advpack.dll,DelNodeRunDLL32 &#8220;c:\\test&#8221;,4 &#8211; will wipe out the whole &#8216;test&#8217; directory except the &#8216;test&#8217; directory itself<\/li>\n<li>rundll32.exe advpack.dll,DelNodeRunDLL32 &#8220;c:\\test&#8221;,1 &#8211; will wipe out the whole &#8216;test&#8217; directory only if it is empty<\/li>\n<\/ul>\n<p>Little trivia, but always&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s one of these &#8220;I was looking at something else, and as usual, came across something else&#8221; cases. In this particular instance it was the good ol&#8217; DelNodeRunDLL32 function exported by the advpack.dll. A quick search followed, and I soon &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/11\/24\/advpack-dll-delnoderundll32-and-its-flags\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5588"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=5588"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5588\/revisions"}],"predecessor-version":[{"id":5591,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5588\/revisions\/5591"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=5588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=5588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=5588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}