To exploit the rundll32.exe your exported function must follow some rules, for instance the prototype must be like the following
void CALLBACK MsgBoxW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow);
then a working sample (at least, on XP it works...) will be
void CALLBACK MsgBoxW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow)
{
MessageBox(hwnd, lpszCmdLine, L"MyMessageBox", MB_OK);
}
with def file
LIBRARY "MyDLL"
EXPORTS
MsgBoxW @1
for a complete discussion see [^] :)
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler. -- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong. -- Iain Clarke