# Realizar un programa que compruebe dlls e intente ejecutar calc.exe
```MS-DOS
rundll32 zipfldr.dll, RouteTheCall calc.exe
rundll32 advpack.dll, RegisterOCX calc.exe
```

# Robber
Robber is open source tool for finding executables prone to DLL hijacking

https://mojtabatajik.github.io/Robber/

# DUMPBIN
https://docs.microsoft.com/es-es/dotnet/framework/interop/identifying-functions-in-dlls

```MS-DOS
dumpbin /exports C:\Windows\System32\advpack.dll
link /dump /exports C:\Windows\System32\zipfldr.dll
```

```MS-DOS
C:\Program Files (x86)\Microsoft Visual Studio\2017\Community>dumpbin /exports C:\Windows\System32\zipfldr.dll
Microsoft (R) COFF/PE Dumper Version 14.13.26131.1
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file C:\Windows\System32\zipfldr.dll

File Type: DLL

  Section contains the following exports for ZIPFLDR.dll

    00000000 characteristics
    79DFBB48 time date stamp
        0.00 version
           1 ordinal base
           3 number of functions
           3 number of names

    ordinal hint RVA      name

          2    0 00014230 DllCanUnloadNow
          3    1 00006A10 DllGetClassObject
          1    2 0000EE40 RouteTheCall

  Summary

        2000 .data
        1000 .didat
        2000 .pdata
        C000 .rdata
        1000 .reloc
       1C000 .rsrc
       34000 .text
```
