Generating EXE vs DLL

In the context of Windows programming, understanding the difference between EXE and DLL files is essential. Both EXE and DLL files are based on the Portable Executable (PE) format, but they serve different purposes and are used in different ways by the operating system.

1. EXE (Executable) Files:

   • An EXE file is an executable program. It is intended to be run or executed directly by the user or by a system process.
   • Each EXE has a main entry point (the main function), which is where execution begins when the program is started.
   • EXE files are standalone, meaning they don't depend on being loaded by another EXE. They can use DLLs, but they're not required to.

2. DLL (Dynamic Link Libraries) Files:

   • A DLL is a library that contains code and data that can be used by more than one program at the same time.
   • Unlike EXE files, DLLs cannot be directly executed. Instead, they are loaded by other programs (EXEs or other DLLs) that use the functions or resources provided by the DLL.
   • DLLs have multiple entry points, each corresponding to a function or resource that the DLL provides.

Malware authors may choose to use EXEs or DLLs depending on the situation.

An EXE might be used for a standalone piece of malware that infects a system and then runs on its own.

A DLL might be used for a piece of malware that needs to inject itself into other programs, or that provides services to other malware components.

EXE example code:

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void) {

    printf("This is an EXE for malware development!\n");
    
    getchar();
    
    return 0;
}

DLL code example:

#include <Windows.h>
#pragma comment (lib, "user32.lib")


BOOL APIENTRY DllMain(HMODULE hModule,  DWORD  ul_reason_for_call, LPVOID lpReserved) {

    switch (ul_reason_for_call)  {
    case DLL_PROCESS_ATTACH:
    case DLL_PROCESS_DETACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return TRUE;
}

extern "C" {
__declspec(dllexport) BOOL WINAPI RunME(void) {
    
    MessageBox(
        NULL,
        "This is an EXE for malware development!",
        "!",
        MB_OK
    );
     
         return TRUE;
    }
}