{"id":9440,"date":"2024-09-06T22:46:24","date_gmt":"2024-09-06T22:46:24","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9440"},"modified":"2024-09-06T22:51:11","modified_gmt":"2024-09-06T22:51:11","slug":"the-art-of-underdlloading","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2024\/09\/06\/the-art-of-underdlloading\/","title":{"rendered":"The art of underDLLoading"},"content":{"rendered":"\n<p>In my previous <a href=\"https:\/\/www.hexacorn.com\/blog\/2024\/09\/05\/the-art-of-overdlloading\/\" data-type=\"post\" data-id=\"9430\">post<\/a> I created a posh artisan .exe file ornamented with a large number of intricate system32 DLL imports. The process of building that file was painful &#8211; before I even managed to run the final executable I had to troubleshoot a number issues &#8211; many of which I didn&#8217;t even expect (missing DLLs, missing manifest, random crashes, etc.).<\/p>\n\n\n\n<p>In the process of sculpting it I decided to kick off a parallel mini project that would look at the problem from a different angle &#8212; instead of a single file, I decided to generate a lot of test executable files, where each of these files would import just ONE single DLL from the system32 directory + the kernel32 as I needed it for its <em>ExitProcess <\/em>API. I then ran all these compiled files one by one. The original idea was to isolate and troubleshoot problematic DLLs, but to my surprise, I got some other interesting results.<\/p>\n\n\n\n<p>First of all, with the real-time detection on, Windows Defender started picking up on some of these executables one by one:<\/p>\n\n\n\n<ul>\n<li><a href=\"https:\/\/www.virustotal.com\/gui\/file\/160abf0a6591d638b8de8dc1844ee0a134b3e7e01858d35025ffc312824a5149?nocache=1\">test_aadtb.exe<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.virustotal.com\/gui\/file\/cf2ad4a99a20dd480b38d4ddfa45c1feb30accc9fb89753be6e0c53712dab66b?nocache=1\">test_adhapi.exe<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.virustotal.com\/gui\/file\/e1cb5a107d2b48b2d7a3b13ab94703ea589845747be488ffc01a02dda22d8631?nocache=1\">test_user32.exe<\/a><\/li>\n\n\n\n<li>and many others (I quickly disabled the real-time protection and restored the quarantined files to carry on with the test):<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/windefend_test_detections.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/windefend_test_detections.png\" alt=\"\" class=\"wp-image-9444\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/windefend_test_detections.png 518w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/windefend_test_detections-260x300.png 260w\" sizes=\"(max-width: 518px) 100vw, 518px\" \/><\/a><\/figure>\n\n\n\n<p>Linking to <em>dpnaddr.dll<\/em>, <em>dpnathlp.dll<\/em>, <em>dpnet.dll<\/em>, <em>dpnhpast.dll<\/em>, <em>dpnhupnp.dll<\/em>, <em>dpnlobby.dll<\/em> causes an interesting side-effect. When you run an .exe that links to any of these libraries, you get a DirectPlay Windows Features install dialog box:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/dplay_feature.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/dplay_feature.png\" alt=\"\" class=\"wp-image-9445\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/dplay_feature.png 658w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/dplay_feature-300x219.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/dplay_feature-411x300.png 411w\" sizes=\"(max-width: 658px) 100vw, 658px\" \/><\/a><\/figure>\n\n\n\n<p>This is a result of <em>svchost.exe<\/em> hosting <em>Program Compatibility Assistant Service<\/em> (<em>C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc<\/em>) launching this dialog via <em>fondue.exe<\/em>:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Fondue.exe \/enable-feature:DirectPlay \/show-caller \/top-most \/caller-name:\"test_&lt;dllname&gt;.exe\"<\/pre>\n\n\n\n<p>This looks like a shim at work, but I have not verified it. And no, we cannot launch our own <em>fondue.exe<\/em> here as far as I can tell \ud83d\ude41<\/p>\n\n\n\n<p>Many other test files fail too, for many different reasons: <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/gdi32.png\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/gdi32.png\" alt=\"\" class=\"wp-image-9446\" width=\"356\" height=\"159\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/gdi32.png 356w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/gdi32-300x134.png 300w\" sizes=\"(max-width: 356px) 100vw, 356px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/shdocvw.png\"><img decoding=\"async\" loading=\"lazy\" width=\"395\" height=\"152\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/shdocvw.png\" alt=\"\" class=\"wp-image-9447\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/shdocvw.png 395w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/shdocvw-300x115.png 300w\" sizes=\"(max-width: 395px) 100vw, 395px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/tasksched.png\"><img decoding=\"async\" loading=\"lazy\" width=\"185\" height=\"72\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/tasksched.png\" alt=\"\" class=\"wp-image-9448\"\/><\/a><\/figure>\n\n\n\n<p>We can extract crash details from the Windows Event Logs\/Applications:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/tasksched_eventlog.png\"><img decoding=\"async\" loading=\"lazy\" width=\"521\" height=\"272\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/tasksched_eventlog.png\" alt=\"\" class=\"wp-image-9449\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/tasksched_eventlog.png 521w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/tasksched_eventlog-300x157.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/tasksched_eventlog-500x261.png 500w\" sizes=\"(max-width: 521px) 100vw, 521px\" \/><\/a><\/figure>\n\n\n\n<p>When you start experimenting with a PE file format itself, there are no limits. By playing around with its frivolous structure we can create a lot of interesting and unexpected results.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In my previous post I created a posh artisan .exe file ornamented with a large number of intricate system32 DLL imports. The process of building that file was painful &#8211; before I even managed to run the final executable I &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2024\/09\/06\/the-art-of-underdlloading\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,58,18],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9440"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9440"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9440\/revisions"}],"predecessor-version":[{"id":9451,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9440\/revisions\/9451"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}