Section 4: DLL Search Order

The Big Picture: Where Does Windows Look?

A program says: "I need helper.dll." But it gives only a name, not a full path like C:\Windows\System32\helper.dll. So Windows has to search for the file. It checks a list of folders in a fixed order and uses the first match.

Imagine looking for your keys: first the hook by the door, then your coat pocket, then the kitchen table. The order matters, because whichever place you check first wins. Windows works the same way, and attackers know it.

Important: The exact order depends on your Windows version, on the program's settings and on whether the DLL is a "known" system DLL. The list below is the standard idea. For exact rules on your version, see Microsoft's documentation page "Dynamic-Link Library Search Order".

The Standard Search Order (simplified)

 Program asks for "helper.dll"
        │
        ▼
 0. Already loaded in this process under that name?   -> use it
 0. On the KnownDLLs list?                            -> use the System32 copy
        │ (no)
        ▼
 1. The application directory   (the folder holding the EXE)
 2. The System directory        (C:\Windows\System32)
 3. The 16-bit system directory (C:\Windows\System, legacy)
 4. The Windows directory       (C:\Windows)
 5. The current directory       (in safe mode, checked later)
 6. Folders listed in PATH
        │
        ▼
 Not found anywhere -> "DLL was not found" error

(This list is a simplification. Real Windows also considers things like manifests, redirection files and SetDefaultDllDirectories, see 4.6.)

4.0 KnownDLLs: The Protected Shortcut

What it is: KnownDLLs is a list in the registry of important system DLLs (like kernel32.dll, user32.dll, advapi32.dll). When a program asks for one of these by name, Windows loads the real copy from System32 without searching any other folder. So nobody can sneak in a fake kernel32.dll by putting it next to the EXE.

You can see it on your PC (read-only):

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs"

4.1 Application Directory

What it is: The folder where the EXE lives. Windows looks here first for DLLs that are not in KnownDLLs.

Why first? So each program can ship its own DLLs next to itself. This is how a game can bring its own physics.dll without touching Windows.

Windows-specific tip: This is why you can often fix a "missing DLL" problem by reinstalling the program: the installer puts its DLLs in the application directory.

4.2 System Directories (System32, SysWOW64)

What it is: The Windows system folders hold Microsoft's own DLLs.

When a 32-bit program asks for the "system directory", Windows quietly gives it SysWOW64. Each program sees the right bitness automatically.

4.3 Windows Directory

What it is: C:\Windows itself. It is checked after the system directory. A few older DLLs and files live here. Because normal users cannot write to it without permission, it is a fairly safe place.

4.4 Current Directory

What it is: The current directory is the folder a program is "standing in". If you open a Command Prompt in C:\Downloads and start a program from there, C:\Downloads is the current directory. Also, double-clicking a document often sets the current directory to that document's folder.

Why this is risky: The current directory can be any folder, including a folder full of files from the internet. If Windows checked it early, a bad DLL in a downloaded folder could replace a real one.

Safe DLL search mode. To reduce this risk, Windows turns on safe DLL search mode by default. It moves the current directory from near the top of the list to after the system folders. Now the real System32 copy is always found first. (Hedge: Windows versions have also tightened this further over time. Always check Microsoft's current docs.)

4.5 PATH Directories

What it is: PATH is a setting (an environment variable, a named value every process can read) that holds a list of folders, separated by semicolons. It is mostly used to find programs you type in a command window, but the DLL search also falls back to it.

See yours:

$env:PATH -split ";"

Why it matters: PATH is the last place Windows looks. It is a common cause of version mix-ups: if two folders in PATH hold different versions of libfoo.dll, the first folder in the list wins, which may be a version the program was not made for. (A classic story: installing a tool that adds its folder to PATH and breaks another program.)

4.6 DLL Search Order Hijacking: Security Awareness

What it is: DLL search order hijacking (also called DLL planting) is a trick where someone puts a fake DLL with the right name in a place that Windows searches before the real one. The program then loads the fake and runs its code, with the program's rights.

 Program asks for "helper.dll"

 Real:  C:\Windows\System32\helper.dll    <- searched 2nd

 Fake:  C:\Users\Sam\Downloads\helper.dll <- searched 1st if the
                                             EXE sits in Downloads!

Why the order matters: It decides who gets picked. A low-privilege folder (like Downloads, or a temp folder) earlier in the list than a protected folder is a weakness.

How it is defended (high level):

What you can do:

• Do not run installers and programs from the Downloads folder alongside unknown DLLs.
• Prefer installing apps to Program Files.
• Keep Windows updated; many hijacking weaknesses are fixed in new versions.
• If you see a strange DLL next to a program that you did not expect, scan it.

Note: This section is about understanding the weakness so you can protect yourself. The course does not teach how to build attacks.

Summary