# Access Violations with SetDLLDirectoryA - genuine api or api bait? **URL:** \ **Category:** uncategorized\ **Created:** [August 27, 2022, 9:30am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378 "2022-08-27T09:30:28Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![anon23294430](https://clarionhub.com/user_avatar/clarionhub.com/anon23294430/32/3829_2.png) [@anon23294430](https://clarionhub.com/u/anon23294430)\ **Post date:** [August 27, 2022, 9:30am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/1 "2022-08-27T09:30:28Z")
When ever I try to use SetDLLDirectoryA [SetDllDirectoryA function (winbase.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-setdlldirectorya) I always get an access violation. Now the reason for doing this, is I want to force where a DLL is loaded from. There is a reg setting HKLM\system\currentcontrolset\control\session manager\ SafeDLLSearchMode Dword which when created and set to 0 switches off DLL Safe Search. [Dynamic-Link Library Search Order - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order) [Dynamic-Link Library Security - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security) There is a list of known safe dlls which can be found at **HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs**. which are a few windows dlls, like kernel32.dll, so switching safesearch off would make it possible to use (guessing not tried) a malicious version of the windows dll’s. SetDllDirectoryA also switches off the SafeSearch, so when I tried to do a proof of concept, all I get is access violations when trying to use this api. Now I should stress this is an offline development machine, and whilst I can see the api call in the dll and create a lib file for it, it just crashes when the code is called, making me wonder if this is some sort fake api call built into the kernel32.dll. Anyone got any ideas if its a genuine api call or some sort of api bait? I did see on a MS webpage a comment in a code example that the path can be included for security reasons, negating having to rely on the DLL search order by using [GetSystemDirectoryA function (sysinfoapi.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsystemdirectorya) and [GetWindowsDirectoryA function (sysinfoapi.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getwindowsdirectorya) but I’ve not established if the SxS(Side by Side assemblies - a solution to Dll Hell) which is specified in the app manifest file can still override any specified path. [About Side-by-Side Assemblies - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-) [Side-by-side assembly - Wikipedia](https://en.wikipedia.org/wiki/Side-by-side_assembly) Anyone know if the manifest file can override a path specified in api calls like LoadLibrary(Ex), GetModuleHandle(Ex)? Not tried yet, just curious. [GetModuleHandleA function (libloaderapi.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea) ---
**Author:** ![AbdullahAkilah](https://clarionhub.com/user_avatar/clarionhub.com/abdullahakilah/32/4818_2.png) [@AbdullahAkilah](https://clarionhub.com/u/AbdullahAkilah)\ **Post date:** [August 28, 2022, 11:37pm UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/2 "2022-08-28T23:37:28Z")
I honestly can’t tell from this what it is you’re trying to do, but if you’re loading a DLL using LoadLibrary then just use the full path to whatever DLL it is you want. ---
**Author:** ![anon23294430](https://clarionhub.com/user_avatar/clarionhub.com/anon23294430/32/3829_2.png) [@anon23294430](https://clarionhub.com/u/anon23294430)\ **Post date:** [August 28, 2022, 11:48pm UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/3 "2022-08-28T23:48:02Z")
> [@AbdullahAkilah](#): > > but if you’re loading a DLL using LoadLibrary then just use the full path to whatever DLL it is you want. I’m just trying to use SetDllDirectoryA using the clarion module method, I havent tried the loadlibrary(ex) in all honesty, so I’ll give it go. The TLDR is, SetDllDirectoryA switches off DLLSafesearch until its nulled, so during this time, its possible to force other programs to load dll’s they dont want to! Its another way of hacking apps with minimal effort! Edit. Antivirus cant scan pwd protected files and some antivirus cant scan a zip file nested Russian Doll style inside 100 other zip files, and antivirus looks for strings, like the eicar file [Download Anti Malware Testfile – Eicar](https://www.eicar.org/download-anti-malware-testfile/) [EICAR test file - Wikipedia](https://en.wikipedia.org/wiki/EICAR_test_file) so it would be possible to load a virus (if some code has even been recognised as a virus and thus has a signature) using the virus split over 2 or more strings at a point where it can execute and the AV if it even spots it can at best only kill the process after some damage has been done. This is why the SetDllDirectoryA is a bit of a loose canon. If I get time, I’ll do a proof of concept. ---
**Author:** ![AbdullahAkilah](https://clarionhub.com/user_avatar/clarionhub.com/abdullahakilah/32/4818_2.png) [@AbdullahAkilah](https://clarionhub.com/u/AbdullahAkilah)\ **Post date:** [August 29, 2022, 12:45am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/4 "2022-08-29T00:45:39Z")
So what’s your prototype for SetDllDirectoryA then? A null pointer and a pointer to a null string are not the same, which is why for decades I’ve always prototyped anything as taking a pointer to use a ULONG, then use Address(Cstring) or 0 (as appropriate) as the parameter ---
**Author:** ![anon23294430](https://clarionhub.com/user_avatar/clarionhub.com/anon23294430/32/3829_2.png) [@anon23294430](https://clarionhub.com/u/anon23294430)\ **Post date:** [August 29, 2022, 8:39am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/5 "2022-08-29T08:39:19Z")
> [@AbdullahAkilah](#): > > A null pointer and a pointer to a null string are not the same > The directory to be added to the search path. > If this parameter is an empty string (“”), the call removes the current directory from the default DLL search order. > **If this parameter is NULL, the function restores the default search order.** I know, and whilst I was using \*cstring, your comment has made me think it might need to be a long pointing to a cstring and then null the long. I’ll give that a go because I think there might be some mileage in this attack vector proof of concept if I can get this dll to work. 🤔 Edit. If I’m right, I think I’ve found a way to bypass the MS Windows Ransomware protection measures. ---
**Author:** ![Julian](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/74df32/32.png) [@Julian](https://clarionhub.com/u/Julian)\ **Post date:** [September 8, 2022, 10:42am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/6 "2022-09-08T10:42:55Z")
When I need to specify a particular .dll I use one of these techniques .. a) LoadLibrary b) an entry in the manifest file The former is well documented, but for the latter, I add a line at the bottom of the manifest thus .. ``` ``` I then place my .dlls in the dlls subdirectory beneath my application. Without this, Windows just follows the normal rules searching for the .dll in the application directory, system directory, path etc. ---
**Author:** ![anon23294430](https://clarionhub.com/user_avatar/clarionhub.com/anon23294430/32/3829_2.png) [@anon23294430](https://clarionhub.com/u/anon23294430)\ **Post date:** [September 8, 2022, 11:57am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/7 "2022-09-08T11:57:10Z")
So at the moment, I’m using LoadLibrary and GetProcAddress to find out if the api is available as per [Operating System Version - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version) > You can test for the presence of the functions associated with a feature. To test for the presence of a function in a system DLL, call the [**LoadLibrary**](https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-loadlibrarya) function to load the DLL. Then call the [**GetProcAddress**](https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-getprocaddress) function to determine whether the function of interest is present in the DLL. Use the pointer returned by **GetProcAddress** to call the function. Note that even if the function is present, it may be a stub that just returns an error code such as ERROR\_CALL\_NOT\_IMPLEMENTED. So libmaker could be seeing this api, and the access violation could be because its a stub but I wouldnt have expected an access violation, unless the kernel32.dll I have here doesnt even return an error\_call\_not\_implemented? Dont know, still investigating. Now the manifest way is interesting, so I’ll have to see if the manifest can be overridden. I suspect it can before Windows 8.1 but not after, but havent tested, and there’s still the problem of trying to ensure I have genuine window dll’s loaded. ---
**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\ **Post date:** [September 10, 2022, 9:44am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/8 "2022-09-10T09:44:39Z")
> [@AbdullahAkilah](#): > > So what’s your prototype for SetDllDirectoryA then? So what’s your prototype for SetDllDirectoryA then? So what’s your prototype for SetDllDirectoryA then? So what’s your prototype for SetDllDirectoryA then? Just paste your code. Does it have RAW. ---
**Author:** ![anon23294430](https://clarionhub.com/user_avatar/clarionhub.com/anon23294430/32/3829_2.png) [@anon23294430](https://clarionhub.com/u/anon23294430)\ **Post date:** [September 11, 2022, 2:53am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/9 "2022-09-11T02:53:00Z")
`IS_SetDllDirectoryA(*cstring),Bool,Pascal,Raw,Name('SetDllDirectoryA')` and I had to create a special lib file for it. I will be changing it to `IS_SetDllDirectoryA(long),Bool,Pascal,Name('SetDllDirectoryA')` in due course in order to be able to pass a null address which may be like > IS\_SetDllDirectoryA(\<\*cstring\>),Bool,Pascal,Raw,Name(‘SetDllDirectoryA’) but I will also need to look in the dissembler window to see if an address is passed for a null cstring variable or if a null is passed for the address re the post below to clarify. > [@How to check the hard disc space - Clarion9](https://clarionhub.com/t/how-to-check-the-hard-disc-space-clarion9/5405/8): > > \<\* \> pointer based parameters have no problem, as Clarion assumes the absense of a parameter can be represented with a 0 pointer, but with simple value parameters, extra data is needed to support OMITTED. Here there is an example app based on both prototypes. With \<\> on simple value parameters it crashes, with = 0 it works. Also there is an screen capture of Clarion Debugger where it can be seen the extra PUSH 1’s to the stack when using \<\> [TestOmitParam.clw](https://clarionhub.com/uploads/short-url/oGEi5mW2k0EtHKOtCzwXvDXgE1O.clw) (1,4 KB) At this stage I was only trying to pass a path to the api, I hadnt got as far as passing a null to cancel it. I also meet this criteria > To compile an application that uses this function, define \_WIN32\_WINNT as 0x0502 or later 0x0502 = WinXP SP1 or later. Edit So using the Long works and passing an address in a long or simply a zero in a long aka a null works. `IS_SetDllDirectoryA(long),Bool,Pascal,Name('SetDllDirectoryA')` These module definitions below dont work, both give an access violation. ``` IS_SetDllDirectoryA(*cstring),Bool,Pascal,Raw,Name('SetDllDirectoryA') IS_SetDllDirectoryA(<*cstring>),Bool,Pascal,Raw,Name('SetDllDirectoryA') ``` Looking at the assembler window, the cstring module definition method is sending (pushing) an address to the null cstring from the stack register ebx. The long module definition is pushing a variable (loc:cstringaddress) which contains zero. The api appears to want just a long in this case whether there is a value in the cstring or not. ---
**Author:** ![anon23294430](https://clarionhub.com/user_avatar/clarionhub.com/anon23294430/32/3829_2.png) [@anon23294430](https://clarionhub.com/u/anon23294430)\ **Post date:** [September 12, 2022, 1:19am UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/10 "2022-09-12T01:19:59Z")
> [@Julian](#): > > When I need to specify a particular .dll I use one of these techniques … > > a) LoadLibrary > b) an entry in the manifest file There appears to be some caveats to using manifests. So I’m building what is called an isolated application. [Building C/C++ Isolated Applications | Microsoft Docs](https://docs.microsoft.com/en-us/cpp/build/building-c-cpp-isolated-applications?view=msvc-170) For the Side by Side assembles which can be found in the windows C:\Windows\WinSxS folder [Building C/C++ Side-by-side Assemblies | Microsoft Docs](https://docs.microsoft.com/en-us/cpp/build/building-c-cpp-side-by-side-assemblies?view=msvc-170) > It is important for a DLL that uses an application manifest to have the manifest embedded as a resource with ID equal to 2. If the DLL is dynamically loaded at runtime (for example, using the [LoadLibrary](https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryw) function), t **he operating system loader loads dependent assemblies specified in the DLL’s manifest.** An external application manifest for DLLs is not checked during a `LoadLibrary` call. If the manifest is not embedded, the loader may attempt to load incorrect versions of assemblies or fail to find to find dependent assemblies. TLDR, Loadlibrary ignores external manifests. Manifest has to be embedded in order to avoid loading the wrong external manifest file. Files specified in the manifest without a path found in WinSxS folder. Files specified in the manifest with a path found accordingly. Nothing to say whether SetDllDirectoryA over rides the manifest where paths are specified though. This is the search order for files with embedded manifests, which is different to the loadlibrary(ex) search order. [Assembly Searching Sequence - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/SbsCs/assembly-searching-sequence) I’ve found this in loadlibrary(Ex)(A|W) > If you call **LoadLibrary(Ex)** with the name of an assembly without a path specification and the assembly is listed in the system compatible manifest, the call is automatically redirected to the side-by-side assembly. But in order to install into the SxS folder, the dll needs an embed manifest to meet the criteria for getting into the folder. So then there is the matter of whether a path in the manifest is absolute or relative which this link appears to shed some light on. [c++ - DLL redirection using manifests - Stack Overflow](https://stackoverflow.com/questions/2100973/dll-redirection-using-manifests) This post is suggesting Loadibrary will automatically search the installation folder for a dll specified in the manifest without a path. Still no mention of where SetDllDirectoryA fits in though, like does it override any manifest paths or not? I think this will be a case of having to create and embed a manifest with a path and see what happens, and then there are the knowndll’s ie windows system dll’s to test, otherwise this could come into play… [Intercepted: Windows Hacking via DLL Redirection - EH-Net Online Mag (archive.org)](https://web.archive.org/web/20150915101918/https://www.ethicalhacker.net/columns/heffner/intercepted-windows-hacking-via-dll-redirection) Edit Another thing to check to see if it affects the manifest file assemblys and api call SetDLLDirectoryA is the registry entry HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\Control\Session Manager SafeDLLSearchMode DWORD 0 or 1 I cant believe MS would make it so difficult for an app to ensure its loading the right dll’s. Havent seen any mention of this registry setting in any of the docs either. ---
**Author:** ![anon77170705](https://clarionhub.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@anon77170705](https://clarionhub.com/u/anon77170705)\ **Post date:** [October 7, 2022, 9:15pm UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/11 "2022-10-07T21:15:47Z")
Attached program works for me with both variants of the SetDLLDirectory’s prototype. Actual parameters are pushing to the stack correctly. [test.clw](https://clarionhub.com/uploads/short-url/pUGTXF8lojUrbzdJtN2MxANoeYt.clw) (650 Bytes) ---
**Author:** ![anon23294430](https://clarionhub.com/user_avatar/clarionhub.com/anon23294430/32/3829_2.png) [@anon23294430](https://clarionhub.com/u/anon23294430)\ **Post date:** [October 7, 2022, 9:34pm UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/12 "2022-10-07T21:34:04Z")
Yeah, I found the problem, I had two pascal’s in the api definition, the rest of it was perfect, a bit of word blindness I think, but thanks. 😀 ---
**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\ **Post date:** [October 8, 2022, 8:01pm UTC](https://clarionhub.com/t/access-violations-with-setdlldirectorya-genuine-api-or-api-bait/5378/13 "2022-10-08T20:01:52Z")
Thank you for the code! You can paste Code like that into the response. Like GitHub MarkDown type Triple Backticks ``` on a Line Above and Line Below to … ```auto format it as Code. ``` There is a `` button on the Toolbar for Code Format but it indents to note code. I find it easily messed up by edits. I prefer to type the 3 backticks as it always always works and is not messed up by copy/paste within the code lines. ```auto PROGRAM MAP Test() MODULE('') SetDLLDirectory (),BOOL,PROC,PASCAL,NAME('SetDllDirectoryA') !alternative SetDLLDirectory (<*CSTRING>),BOOL,PROC,PASCAL,RAW,NAME('SetDllDirectoryA') END END TestPath1 CSTRING('C:\TEMP'),PRIVATE TestPath2 CSTRING(''),PRIVATE CODE Test() RETURN ! ========================================================================== Test PROCEDURE() CODE SetDLLDirectory (TestPath1) SetDLLDirectory (TestPath2) SetDLLDirectory () RETURN ``` The `code` formatting does preserve Quotes as CHR(39) otherwise they are changed to typesetter quotes so the code pasted into Clarion does not work. E.g. below lines with quotes: TestPath1 CSTRING(‘C:\TEMP’),PRIVATE TestPath2 CSTRING(‘’),PRIVATE One other advantage … the Test.clw attachment will not easily display on my phone or Android tablet, it wants to download.