exe/dll

[deepzero]

Hi,

I´m trying to create an .exe file, which can be used as a dll file at the same time.

Take, for example, this piece of code:

#include <Windows.h>BOOL APIENTRY DllMain( HMODULE hModule,
					  DWORD  ul_reason_for_call,
					  LPVOID lpReserved
					  )
{
	MessageBoxA(0,"dll","dll",0);
}
int main()
{
	MessageBoxA(0,"exe","exe",0);
}

Just executing it like any other exe will run int main(). Now, the idea is that when this .exe file is loaded via LoadLibrary DllMain is called as if it was a dll.

Is this actually possible?

Or is there any other way the exe gets notified when it is LoadLibrary loaded?

deep

Edited December 4, 2010 by deepzero

[Aguila]

yes it is possible. some malware is using this trick (e.g. TDL german article http://blog.raidrush.ws/2010/09/05/malware-analyse-gefahrliches-rootkit-tdl-–-teil-2/)

you can use DllMain as entrypoint for both exe and dll and check the variables if they fit to a dll loading.
/>http://msdn.microsoft.com/en-us/library/ms682583%28v=VS.85%29.aspx

[deepzero]

hi k11,

very nice blog, bookmarked!

However, as far as i understood the article, the malicious file crates a copy of itself, then blows the DllCharacteristic flag in the PE header. Is a PE header manipulation necessary?

Forcing said flag in my example code from post #1 didnt change anything, except for that the file cant be treated as an exe anymore.

deep

[Aguila]

yes you need to change the pe header

compile this as dll:

#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{	if (hinstDLL == GetModuleHandle(0) && fdwReason == DLL_PROCESS_ATTACH && lpvReserved == 0)
	{
		MessageBox(0,L"dll dynamic load",L"dd",MB_OK);
	}
	else
	{
		MessageBox(0,L"exe",L"exe",MB_OK);
	}
}

edit:

sorry it is not GetModuleHandle(0)... it is GetModuleHandle("yourdllname.dll")

Edited December 4, 2010 by k11

[CondZero]

I´m trying to create an .exe file, which can be used as a dll file at the same time.

Getting back to your original question, I would create a dynamic *.dll app from the *.exe

export the functions that you wish to share as a dll.

In the function calls, the parameters can be used to determine

whatever you wish. This can be loaded and exports getprocaddressed.

[ErrorShow]

So magical idea!If you created a win32 console application. ,but,there are two "main" funcation,,,inconceivable!

just like %systemroot%\system32\ntoskrnl.exe

Edited December 22, 2010 by ErrorShow

[Frostbane]

It's kinda late I saw this post but if you'd like to, please check this out:

http://sandsprite.com/CodeStuff/Using_an_exe_as_a_dll.html

[deepzero]

ooops, again i forogt to reply to one of my threads...sorry.

As i found out a while ago, this is how you do it in VS:

1) create a new .dll project

2) set DllMain as EntryPoint in "project->settings->linker->advanced"

3) dll-characteristic flag decides about dll/exe

thanks to everyone involved