 |
| [image source: seowoo_lee on pixabay dot com] |
This blog post was motivated by reading the source code for Rufus (The Reliable USB Formatting Utility). In particular, see line #3388, rufus.c
"// Disable loading system DLLs from the current directory ..."
https://github.com/pbatard/rufus/blob/master/src/rufus.c
[also see my companion LinkedIn post]
–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––
Some suggested background reading on the topics of KnownDLLs, DLL Name Resolution, DDL Search Order, DLL Sideloading, and DLL Hijacking.
knowndlls
https://docs.dissect.tools/en/stable/plugins/knowndlls.html
Virtual memory and KnownDlls
https://github.com/yo-yo-yo-jbo/virtual_memory_known_dlls
Microsoft: Dynamic-link library search order
https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order
How Windows DLL Name Resolution Works - Search Order and SxS (2026)
https://comcomponent.com/en/blog/2026/03/24/002-windows-dll-name-resolution/
DLLs and Ways They Can Hurt Us (2026)
https://www.cynet.com/security-foundations/attack-techniques/dlls-and-ways-they-can-hurt-us/
DLL Sideloading - beyond classic DLL Hijacking - Red team diaries (2026)
https://cp.center/en/blog/post/dll-sideloading-beyond-classic-dll-hijacking-red-team-diaries
Intruders in the Library: Exploring DLL Hijacking (2024)
https://unit42.paloaltonetworks.com/dll-hijacking-techniques/
Breaking into Libraries – DLL Hijacking (2024)
https://labs.jumpsec.com/breaking-into-libraries-dll-hijacking/
Windows DLL 101 (2024)
"What the heck is a DEE ELL ELL and how do I hijack it?"
https://cybytes.substack.com/p/cybytes-issue-1-windows-dll-101
DLL Search Order Hijacking (2023)
https://medium.com/@sealteamsecs/dll-search-order-hijacking-c9c46ea9026c
OpenFileMapping and KnownDlls (2023)
https://inbits-sec.com/posts/openfilemapping-and-knowndlls/
DLL Side Loading (2022)
https://twelvesec.com/2022/12/16/a-dll-side-loading-technique-in-teamspeak-server-that-gains-reverse-shell-with-ms-real-time-enabled/
The DLL Search Order And Hijacking It (2021)
https://malwareandstuff.com/the-dll-search-order-and-hijacking-it/
Detecting and blocking unknown KnownDlls (2021)
https://www.elastic.co/blog/detect-block-unknown-knowndlls-windows-acl-hardening-attacks-cache-poisoning-escalation
DLL Hijacking: Top 7 Attack Variants and 6 Ways to Mitigate Them
https://www.airlockdigital.com/learn/dll-hijacking-top-attack-variants-and-ways-to-mitigate-them
