Control Panel · DLL Applet

CPL Builder.

.cpl

Builds Windows Control Panel applets (.cpl) — DLLs exporting CPlApplet that are launched by rundll32.exe via shell32.dll,Control_RunDLL. Visually identical to system applets like sysdm.cpl or themes.cpl, ideal for highly-targeted spear engagements.

DLL payload

PE Format

rundll32 host

Trusted Loader

x86 / x64

Architectures

Custom icon

System-Look Spoof

Overview

What is a CPL applet?

A CPL file is a Windows DLL with a CPlApplet exported entrypoint, designed to be loaded by the Control Panel (shell32.dll!Control_RunDLL). When a user double-clicks a .cpl, Windows hosts the DLL inside rundll32.exe and calls its CPlApplet dispatch function with init/run messages.

Exploit Builder produces a properly-exported CPL DLL where the CPlApplet handler executes your payload during initialization, presenting either a fake system dialog or silent termination as decoy.

Native PE DLL — full execution surface (Win32 API, in-process)
Hosted by rundll32.exe — Microsoft-signed loader, broadly whitelisted
System-applet visual spoof: same icon as sysdm.cpl or themes.cpl
Both x86 and x64 builds; architecture chosen automatically per target

Execution Flow

How the builder works.

STEP 01

Provide Payload

Embed-only. Drop in a local PE or shellcode blob — bytes are encrypted into the CPL's resource section and decrypted in-memory at CPL_INIT. CPL does not support remote URL fetch.

STEP 02

Pick Visual Spoof

Choose icon & metadata: System Properties, Themes, Display, or custom.

STEP 03

Configure Behavior

Decoy dialog or silent run; sandbox checks; persistence options.

STEP 04

Build CPL

Output: signed-or-unsigned .cpl (x86 or x64) ready for delivery.

Technical Details

Under the hood.

CPlApplet Export

Exports the CPlApplet entry handling CPL_INIT, CPL_GETCOUNT, CPL_INQUIRE, CPL_DBLCLK, CPL_STOP, CPL_EXIT messages.

Init-Triggered Payload

Payload fires on CPL_INIT or CPL_DBLCLK — both occur before any UI is rendered, so the user sees execution context immediately.

Resource Spoofing

Embeds icon + version-info resources matching sysdm.cpl, themes.cpl, desk.cpl, or other selectable system applets.

Architecture Targeting

x86 and x64 builds. x86 runs in WoW64 rundll32; x64 runs in native rundll32. Builder picks based on payload requirements.

Decoy Dialog

Optional fake "Settings cannot be loaded" / "Initializing..." MessageBox so the user perceives a normal-looking failure or progress window.

String & Code Mutation

Per-build randomization: import name re-ordering, string XOR, junk-block injection, ordinal/named export shuffling.

applet.cpp · simplified CPlApplet handler

LONG APIENTRY CPlApplet(HWND hWnd, UINT uMsg, LPARAM lp1, LPARAM lp2) {
    switch (uMsg) {
        case CPL_INIT:
            RunPayload();      // fires before UI
            return 1;
        case CPL_GETCOUNT:
            return 0;          // no applets advertised
    }
    return 0;
}

Specifications

Module specs.

Output Format	Control Panel Applet (`.cpl`) — PE/DLL with `CPlApplet` export
Delivery Mode	Local embed only — payload bytes encrypted in the applet's resource section, decrypted in-memory. No URL/stager mode.
Architectures	x86 · x64
OS Compatibility	Windows 7 / 8.1 / 10 / 11
Host Process	`rundll32.exe shell32.dll,Control_RunDLL`
Trigger	`CPL_INIT` (or `CPL_DBLCLK`) message handling
Visual Spoof	Icon & metadata cloning of system applets
Decoy	Fake "Initializing"/"Cannot load settings" dialog
Anti-Analysis	Cursor activity · Hostname filter · Sleep skewing · Sandbox detection
Polymorphism	Exports · String XOR · Junk-blocks · Resource layout