Mastering RunDLL32 commands in Windows 10

Windows operating systems have a plethora of built-in tools and commands that make it a versatile platform for both developers and advanced users.

RunDLL32.exe is one of those mysterious Windows components that often leaves users scratching their heads. It’s a legitimate Microsoft utility that allows dynamic link libraries (DLLs) to be executed as if they were standalone applications.

Whether you’re looking to create shortcuts or perform administrative tasks, RunDLL32.exe commands can become an invaluable part of your toolkit.

What is RunDLL32?

RunDLL32, short for Run DLL 32-bit, is a Microsoft Windows utility designed to execute functions within DLLs. DLLs are shared libraries that contain code, data, and resources used by various programs to perform specific tasks. Unlike executable (exe) files, DLLs cannot run independently; they require an intermediary to invoke their functions. This is where RunDLL32 comes in.

Introduced in Windows 95 , RunDLL32.exe is in the System32 directory of Windows installations. It is a native Windows component, meaning it is built into the OS and does not require additional downloads or installations.

How RunDLL32 Works

RunDLL32 works by loading a specified DLL and then calling an entry point (a specific function) within that DLL. It does this through a command-line syntax that specifies the DLL, the function to be called, and any necessary parameters.

The basic syntax for using RunDLL32 is as follows:

RunDLL32.exe 'DLL name','Function name' [Arguments]

• DLL name: The name of the DLL that contains the function you want to execute.
• Function name: The name of the function within the DLL that you want to call.
• Arguments: Any additional parameters required by the function.

Common RunDLL32 Commands

Here are some common RunDLL32.exe commands that can be used to perform various tasks in Windows.

One of the most frequent uses of RunDLL32 is to open specific Control Panel applets. For example, to open the Add or Remove Programs applet, you can use the following command:

RunDLL32.exe shell32.dll,Control_RunDLL appwiz.cpl

If you need to quickly access the User Accounts dialog, you can use this command:

RunDLL32.exe netplwiz.dll,UsersRunDll

If you need to adjust the Date and Time settings on your computer, you can use this command:

RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl

For quickly accessing the Environment Variables dialog, you can use this command:

RunDLL32.exe sysdm.cpl,EditEnvironmentVariables

Creating Shortcuts with RunDLL32 Commands

RunDLL32 commands can also be used to create shortcuts for frequently used functions, and can be particularly useful for administrators or advanced users who need quick access to specific settings or tools.

Create a shortcut to open the “Add or Remove Programs” applet:

1. Right-click on the Desktop or in a folder, select New, and then select Shortcut.
2. In the “Type the location of the item” field, enter the RunDLL32 command: RunDLL32.exe shell32.dll,Control_RunDLL appwiz.cpl
3. Click Next, give your shortcut a name (e.g., Add or Remove Programs), and click Finish.

You now have a shortcut that, when double-clicked, will open the “Add or Remove Programs” applet.

Windows 10 has approximately 50 different Control Panel applets, each accessible via its respective .cpl file. By leveraging RunDLL32 commands, users can quickly access these applets without navigating through the traditional Control Panel interface.

Exploring RunDLL32 Options

For those who wish to dive deeper into the capabilities of RunDLL32.exe, it’s essential to explore the extensive range of options available. While Windows does not provide a built-in list of all RunDLL32 commands, you can use third-party tools to discover and list these options.

Total PE

Total PE  is a great tool that simplifies the process of exploring DLL files and identifying potential RunDLL32 commands. By loading a DLL like shell32.dll, you can delve into the details of the file and examine the list of exported functions.

An improved version of Total PE is available. Screenshots in this post are updated to reflect the new version.

GitHub - zodiacon/TotalPE2: PE Viewer

PE Viewer. Contribute to zodiacon/TotalPE2 development by creating an account on GitHub.

To start, load the desired DLL into Total PE. The tool’s intuitive interface will display a wealth of information, including the list of exported functions. These functions represent the commands that can potentially be called using Rundll32.exe.

By carefully scrolling through this list, it is possible to identify the relevant functions and understand their respective roles. This method not only aids in uncovering hidden functionalities but also enhances the overall understanding of the DLL’s capabilities.

RunDLL32.exe commands can simplify various tasks, enhancing efficiency and control over the Windows environment. These commands will provide quick access to essential system functions and settings, enabling users to navigate and configure their system with ease.

Finding RunDLL32 Command-lines with Process Monitor

Another great tool to explore RunDLL32 commands is Process Monitor (Procmon) , part of the Sysinternals  suite. Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

You can use Procmon to capture RunDLL32 command lines as they are executed by the system or applications.

Download and run Procmon from Microsoft Sysinternals. It immediately begins capturing all system activity, which can be overwhelming without filters.

To add filters, open the Filter dialog by pressing CTRL + L or clicking the filter icon in the toolbar. This is where you define rules to narrow down the flood of events.

Add a Process Name filter In the filter window, set:

• Condition: Process Name
• Relation: is
• Value: rundll32.exe

Click Add. This ensures Procmon only shows events generated by RunDLL32.

Add an Operation filter Still in the filter window, add another rule:

• Condition: Operation
• Relation: is
• Value: Process Start

Click Add. This narrows the view to just the moments when RunDLL32 starts a new process.

Click Apply and click OK to apply the filters.

Procmon will display events, where RunDLL32.exe is invoked and the Operation is Process Start. Notice the command line arguments used in the Details column. Each entry will show the command line arguments used, revealing which DLL and function were executed.

By capturing these command lines, you gain insight into:

• System behavior: See which DLLs Windows itself is calling through RunDLL32.
• Troubleshooting: Identify misbehaving or redundant DLL calls that may slow down startup or cause errors.
• Security analysis: Detect suspicious or unauthorized DLLs being launched, a common tactic in malware persistence.

To get deeper into Process Monitor, head over to Windows IT Pro  on YouTube, and find loads of great videos on Sysinternals tools, e.g.;

Sysinternals | Fireside Chat - Mark Russinovich

A fantastic fireside chat with Mark Russinovich, co-founder of Sysinternals. A must-watch for anyone interested in Windows internals and troubleshooting.

Sysinternals | Process Monitor deep dive | Sami Laiho

A deep dive into Process Monitor, one of the most powerful tools in the Sysinternals suite. A must-watch for anyone interested in Windows internals and troubleshooting.

RunDLL32.exe shell32.dll,ShellAbout

RunDLL32.exe shell32.dll,Control_RunDLL

RunDLL32.exe devmgr.dll DeviceManager_Execute

RunDLL32.exe powrprof.dll,SetSuspendState 0,1,0

RunDLL32.exe shell32.dll,Control_RunDLL srchadmin.dll

RunDLL32.exe user32.dll,LockWorkStation

RunDLL32.exe shell32.dll,Control_RunDLL powercfg.cpl

RunDLL32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,1

RunDLL32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,2

RunDLL32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,3

RunDLL32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,4

RunDLL32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,5

RunDLL32.exe shell32.dll,Control_RunDLL desk.cpl

RunDLL32.exe shell32.dll,Control_RunDLL desk.cpl,,0

RunDLL32.exe shell32.dll,Control_RunDLL desk.cpl,,1

RunDLL32.exe shell32.dll,Control_RunDLL desk.cpl,,2

RunDLL32.exe shell32.dll,Options_RunDLL 1

RunDLL32.exe shell32.dll,Options_RunDLL 3

RunDLL32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,0

RunDLL32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,1

RunDLL32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,2

RunDLL32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,3

RunDLL32.exe shell32.dll,Control_RunDLL ncpa.cpl

RunDLL32.exe shell32.dll,SHHelpShortcuts_RunDLL Connect

RunDLL32.exe shell32.dll,Control_RunDLL NetSetup.cpl

RunDLL32.exe shell32.dll,Control_RunDLL main.cpl @0,0

RunDLL32.exe user32.dll,SwapMouseButton

RunDLL32.exe shell32.dll,Control_RunDLL main.cpl @1

RunDLL32.exe shell32.dll,Control_RunDLL tabletpc.cpl

RunDLL32.exe shell32.dll,Control_RunDLL joy.cpl

RunDLL32.exe shell32.dll,Options_RunDLL 0

RunDLL32.exe shell32.dll,Options_RunDLL 2

RunDLL32.exe shell32.dll,Options_RunDLL 7

RunDLL32.exe shell32.dll,SHHelpShortcuts_RunDLL FontsFolder

RunDLL32.exe shell32.dll,Control_RunDLL appwiz.cpl,,0

RunDLL32.exe shell32.dll,Control_RunDLL appwiz.cpl,,2

RunDLL32.exe shell32.dll,Control_RunDLL appwiz.cpl,,3

RunDLL32.exe shell32.dll,SHHelpShortcuts_RunDLL AddPrinter

RunDLL32.exe tcpmonui.dll,LocalAddPortUI

RunDLL32.exe shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

RunDLL32.exe shell32.dll,Control_RunDLL HotPlug.dll

RunDLL32.exe shell32.dll,Control_RunDLL wscui.cpl

RunDLL32.exe shell32.dll,Control_RunDLL nusrmgr.cpl

RunDLL32.exe keymgr.dll,KRShowKeyMgr

RunDLL32.exe shell32.dll,Control_RunDLL firewall.cpl

RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl

RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl,,1

RunDLL32.exe shell32.dll,Control_RunDLL Intl.cpl,,0

RunDLL32.exe shell32.dll,Control_RunDLL Intl.cpl,,1

RunDLL32.exe shell32.dll,Control_RunDLL access.cpl

RunDLL32.exe shell32.dll,Control_RunDLL odbccp32.cpl

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 1

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 2

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 8

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 16

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 32

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 255

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

RunDLL32.exe InetCpl.cpl,ClearMyTracksByProcess 16384

RunDLL32.exe shdocvw.dll,DoOrganizeFavDlg

RunDLL32.exe shell32.dll,Control_RunDLL inetcpl.cpl

RunDLL32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,1

RunDLL32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,2

RunDLL32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,3

RunDLL32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,4

RunDLL32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,5

RunDLL32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,6

RunDLL32.exe shell32.dll,Control_RunDLL [file].cpl,,[arguments]

Security Considerations

While RunDLL32.exe is a powerful tool, it also comes with potential security risks. Because it can execute code within DLLs, it may be exploited by malicious software to run harmful functions.

Therefore, it’s crucial to only use RunDLL32.exe commands from trusted sources and to ensure that your system is protected by up-to-date Endpoiont Security software.

Final Thoughts

RunDLL32.exe is a versatile command-line utility that provides advanced users and administrators with a way to directly invoke functions within DLLs. From opening Control Panel applets to setting up shortcuts for common tasks, RunDLL32.exe commands can save time and enhance productivity.

However, it is important to use these commands responsibly and be aware of the potential security implications.

By understanding and leveraging RunDLL32.exe commands, you can unlock new levels of control and efficiency within the Windows operating system. Whether you’re customizing your workflow or managing system settings, RunDLL32.exe is a powerful tool that is well worth exploring.

–Jesper