Advertisements

General Musing

blaze your trail

Free Memory with RUNDLL32

leave a comment »

I’m not sure I ever mentioned this in other blogs, but there is some fun stuff you can do with the program RUNDLL32.EXE, you can find it in other places too. It’s a tool for making function calls from windows libraries. You can basically call any command fitting the requirement:
RUNDLL32.EXE <dllname>,<entrypoint> <optional arguments>
Obviously it is sometimes used incorrectly.

“Rundll performs the following steps:
1. It parses the command line.
2. It loads the specified DLL via LoadLibrary().
3. It obtains the address of the function via GetProcAddress().
4. It calls the function, passing the command line tail which is the .
5. When the function returns, Rundll.exe unloads the DLL and exits.”1

The function it calls needs to be in the format:
void CALLBACK EntryPoint(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow);
It is explained in the MSDN blog: The Old New Thing

I didn’t really start this article to explain this, it’s more for those who are interest. This was actually about the wrong use of the function:

rundll32.exe advapi32.dll,ProcessIdleTasks

Before 3.0 was release I was my only saviour for the memory leak in Firefox < 2.x. The function yields all running threads and runs the Idle Tasks such as memory clean-up, which frees memory.

  1. http://support.microsoft.com/kb/164787
  2. A Short RunDll32 Primer for Developers
  3. rundll32 reference guide

Technorati technorati tags: , , , , , ,

Advertisements

Written by Daniël W. Crompton (webhat)

July 3, 2008 at 4:55 pm

Please Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: