Part 9 · DLLs and Windows APIs

Chapter 22 · DLL Architecture

3 min read

Status: ✅ COMPLETE

Scope: How Windows programs share code through DLL files: what a DLL is, how it is linked and loaded, where Windows looks for it, how functions are exported and imported, what happens when a DLL is missing, how many versions live side by side, and how Windows defends against unwanted DLL loading
Time to complete: 80–110 minutes of reading + lab
Prerequisites: Chapter 3 (RAM and Memory Internals), Chapter 8 (Windows Architecture), Chapter 9 (Processes), Chapter 21 (Windows System Files and Directories)
What you'll know after: What is inside a DLL, why programs share them, how the loader finds and connects them, why "DLL not found" errors happen, and how to look at the DLLs in your own running programs

INTRODUCTION

Open any folder of Windows system files and you will see DLL files by the thousand. Nearly every program you run uses them, and many errors you have seen ("the code execution cannot proceed because something.dll was not found") come from them.

A DLL is a shared library of code. Instead of every program carrying its own copy of the code for "open a file" or "draw a window", Windows keeps one copy and lets all programs borrow it. This saves RAM, makes updates easy and keeps programs small.

This chapter is mostly built from diagrams and tables, because DLLs are an idea, not a gadget you can photograph. Every technical term is explained the first time it appears.

This chapter explains:

  • What a DLL is and why sharing code pays off
  • Static linking (copy the code in) versus dynamic linking (borrow it later)
  • How the Windows loader finds, maps and connects DLLs, and how LoadLibrary works
  • The search order: where Windows looks, and why that matters for security
  • Exports and imports: the "menu" and the "order form" between a DLL and a program
  • Dependencies: chains of DLLs, and what the common error messages mean
  • WinSxS: how many versions of the same DLL live together, and why "DLL hell" faded
  • DLL injection, at concept level only, and how Windows defends against it

CHAPTER OUTLINE

Chapter Status: Complete
Estimated reading time: 90 minutes
Practical time: 30 minutes
Knowledge check time: 30 minutes