Question

With CreateProcessAsUser I can call an .exe file somewhere on the hard disk:

CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine,
                      ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes,
                      bool bInheritHandle, Int32 dwCreationFlags, IntPtr lpEnvrionment,
                      string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo,
                      ref PROCESS_INFORMATION lpProcessInformation);

Each single example I have found in the web uses the lpCommandLine argument to call a program.
I would like to call a function in a dll.
Does anyone know if this is possible? Would be nice to have kind of an example …

Thank you!

Answer 1

You can’t directly call a DLL as a different user as the user/execution level is per process, not DLL or thread. You must start a new process that then calls the DLL. This is the technique used by
COM elevation, etc. If the DLL has the right signature, you can try calling it with rundll32.exe.