Search notes:

DLL

The layout of a DLL is almost the same as that of an EXE. The difference is that the DLL contains an export table.

When DllMain is called, Kernel32.dll is guaranteed to be already loaded into the process address space.

Calling DLLs from different langauges

tasklist /m QuietHours.dll

In order to create a DLL with the C-Sharp compiler (csc), the the compiler option -target must be set to library.

rundll32.exe can be used to call functions in a DLL if the function follows a specific syntax.

Registry: AppInit_DLLs lists DLLs to be loaded (»injected«) into programs that are linked with User32.dll.

.cpl files (Control Panel) are just DLLs with a special file name extension and the entry point CPlApplet.