Search code examples
windowsdllrundll32

What is the actual use of rundll32.exe?


I was searching why rundll32.exe process is running on my system, when I found out the information that it acts as a container to run dll as application / exe. I cannot comprehend a reason / use case in which I would want a dll to be run as application. Aren't libraries just meant to provide functional support rather than running as an individual application?


Solution

  • rundll32 isn't meant to generically "run dlls" (it actually would make no sense, dlls don't have a single entrypoint and "classic" dlls don't have enough meta-information to call correctly any of the exported symbols).

    Instead, it allows to use dlls conforming to some well defined specifications to act as executables with multiple entrypoints; I think that the idea was either to allow coalescing multiple small utilities with much shared code into a single binary, and/or to provide extra "testing" entrypoints (to be invoked manually) to libraries mainly meant for consumption by other applications.

    What rundll does is essentially loading the dll in memory and invoking the specified function, with the expectation that it has to have the same signature as that of the exe entrypoint.

    More information is available in the relevant KB article.