1 little known secret of advpack.dll, LaunchINFSection
这篇文章介绍了一种利用Windows的.INF文件加载自选DLL的方法,通过`LoadAdvpackExtension`函数实现,并详细说明了配置和运行步骤。 2025-7-12 22:42:0 Author: www.hexacorn.com(查看原文) 阅读量:7 收藏

Yes, yet another oldie with a secret…

The .inf files are as old as Windows itself, and their internal structure has been covered by many, and over at least last two decades.

So, what’s new?

Well…

Ever heard of LoadAdvpackExtension ?

This simple .inf file demonstrates how to use it to load a DLL of your choice:

[version]
signature=”$CHICAGO$”
AdvancedINF=2.5,”test”

[DefaultInstall]
Patching=1
LoadAdvpackExtension=test64.dll

To launch it, you need to do the following:

Place the above .inf file in c:\test\test.inf
Place test64.dll in c:\test
Go to terminal: cmd.exe
Run: set path=.
Run: c:\windows\system32\rundll32.exe advpack.dll,LaunchINFSection c:\test\test.inf,,1,

We change the PATH to make sure our test64.dll is found in a current directory, and then loaded:


文章来源: https://www.hexacorn.com/blog/2025/07/12/1-little-known-secret-of-advpack-dll-launchinfsection/
如有侵权请联系:admin#unsafe.sh