Hi, There is buffer overflow in rundll32.exe when it is passed big string as routine name for a module. I've tested this on WindowsXP SP1. But other version of windows might be vuln. rundll32.exe advpack32.dll,<'A'x499> advpack32.dll is just example. Any executable/dll will work. The cmdline does get converted to UNICODE. And EIP ends up being 00410041. - Rick Patel
