Home/ Questions/Q 7506993
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T22:23:52+00:00

Consider the following registry export: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] ;… ProtocolName=@%SystemRoot%\\System32\\wshtcpip.dll,-60100 The

  • 0

Consider the following registry export:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
;...
"ProtocolName"="@%SystemRoot%\\System32\\wshtcpip.dll,-60100"

The intention here appears to be for someone to load the DLL in question, and use some form of API retrieve the actual name. But I don’t know what that API is :/

I’d like to avoid loading the DLL into my address space (and thus call DLL_PROCESS_ATTACH) if at all possible; can’t really trust third party DLLs to be trustworthy.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    RegLoadMUIString will do the necessary for you. Note however, that it was introduced in Vista so won’t help if you need to support XP.

    If you want to avoid code in the DLL running whilst you extract resources, use LoadLibraryEx passing LOAD_LIBRARY_AS_IMAGE_RESOURCE | LOAD_LIBRARY_AS_DATAFILE, or possibly LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE. Once you have done that, you can call LoadString to extract the MUI value.

    • 0