{"id":8992,"date":"2023-12-26T15:22:47","date_gmt":"2023-12-26T15:22:47","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=8992"},"modified":"2024-12-25T23:20:29","modified_gmt":"2024-12-25T23:20:29","slug":"1-little-known-secret-of-runonce-exe-32-bit","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2023\/12\/26\/1-little-known-secret-of-runonce-exe-32-bit\/","title":{"rendered":"1 little known secret of runonce.exe (32-bit)"},"content":{"rendered":"\n<p>When you execute 32-bit version of <em>runonce.exe<\/em> on a 64-bit version of Windows and pass to it the <em>\/RunOnceEx6432<\/em> argument you will make the program load <em>iernonce.dll<\/em> library and execute its <em>RunOnceExProcess<\/em> API&#8230;<\/p>\n\n\n\n<p>Since the <em>iernonce.dll<\/em> library is loaded using <em>LoadLibraryW<\/em> we can simply copy <em>runonce.exe<\/em> to a different folder, and run it from there. This will load the <em>iernonce.dll<\/em> library we can control&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2023\/12\/runonce.png\"><img decoding=\"async\" loading=\"lazy\" width=\"383\" height=\"60\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2023\/12\/runonce.png\" alt=\"\" class=\"wp-image-8993\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2023\/12\/runonce.png 383w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2023\/12\/runonce-300x47.png 300w\" sizes=\"(max-width: 383px) 100vw, 383px\" \/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>When you execute 32-bit version of runonce.exe on a 64-bit version of Windows and pass to it the \/RunOnceEx6432 argument you will make the program load iernonce.dll library and execute its RunOnceExProcess API&#8230; Since the iernonce.dll library is loaded using &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2023\/12\/26\/1-little-known-secret-of-runonce-exe-32-bit\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[126,56,64,79],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8992"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=8992"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8992\/revisions"}],"predecessor-version":[{"id":8994,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8992\/revisions\/8994"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=8992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=8992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=8992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}