{"id":7702,"date":"2021-02-18T23:41:52","date_gmt":"2021-02-18T23:41:52","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=7702"},"modified":"2021-02-19T09:28:14","modified_gmt":"2021-02-19T09:28:14","slug":"yet-another-secret-of-hosts-file","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2021\/02\/18\/yet-another-secret-of-hosts-file\/","title":{"rendered":"Yet another secret of hosts file"},"content":{"rendered":"\n<p>In my old post I mentioned not a very well known <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/03\/31\/the-little-known-i-think-secret-of-hosts-ics\/\">hosts.ics<\/a> file. Today I cover one more secret that I stumbled upon while digging inside DNS API internals.<\/p>\n\n\n\n<p>Turns out that <em>dnsapi.dll<\/em> and <em>dnsrslvr.dll<\/em> use an internal function called <em>Util_IsRunningOnXboxOne<\/em> to determine if the DLL is loaded on a XBOX system. And if it is, the path to <em>hosts<\/em> and <em>host.ics<\/em> files will not be resolved as relative to the path retrieved via <em>GetSystemDirectory<\/em> API, but by using a hard-coded XBOX path below:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">s:\\windows\\system32<\/pre>\n\n\n\n<p>So, in theory, if you patch <em>Util_IsRunningOnXboxOne<\/em> function to return 1 (XBOX) you should be able to redirect local DNS requests via <em>hosts<\/em>(<em>.ics<\/em>) files to the following paths, respectively:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">s:\\windows\\system32\\drivers\\etc\\hosts<br>s:\\windows\\system32\\drivers\\etc\\hosts.ics<\/pre>\n\n\n\n<p>Last, but not least &#8211; in case you don&#8217;t know, the hosts files can be saved using UTF-8, Unicode16-LE, and Unicode16-BE encoding (BOM is being checked).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In my old post I mentioned not a very well known hosts.ics file. Today I cover one more secret that I stumbled upon while digging inside DNS API internals. Turns out that dnsapi.dll and dnsrslvr.dll use an internal function called &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2021\/02\/18\/yet-another-secret-of-hosts-file\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,13,53,15],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7702"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7702"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7702\/revisions"}],"predecessor-version":[{"id":7714,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7702\/revisions\/7714"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}