Chapter 22 · DLL Architecture

Knowledge Check

8 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What does DLL stand for, and what is it?
  2. Which file format do both EXE and DLL files use?
  3. What is the difference between static and dynamic linking?
  4. Which part of Windows loads DLLs into a process, and which DLL contains it?
  5. What is the IAT?
  6. Which function gives you the address of a function inside a DLL loaded at run time?
  7. What is KnownDLLs?
  8. What is a manifest?
  9. Where does Windows keep many versions of the same component side by side?
  10. What does the error "The code execution cannot proceed because XYZ.dll was not found" mean?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. DLL

Dynamic Link Library. A file of code, data and resources that many programs share at run time.

2. File format

PE (Portable Executable).

3. Static vs dynamic

Static: the linker copies library code into the EXE at build time. Dynamic: the EXE only holds a note, and the DLL is connected at run time.

4. The loader

The loader, part of ntdll.dll (its main function is LdrLoadDll).

5. IAT

The Import Address Table: slots in a program that the loader fills with the real addresses of the imported functions.

6. GetProcAddress

GetProcAddress, used after LoadLibrary gives you a handle.

7. KnownDLLs

A list of core system DLLs that Windows loads straight from System32 without searching other folders.

8. Manifest

A small XML description of an assembly or of the assembly versions a program needs. It lets Windows pick the right version side by side.

9. WinSxS

The component store, C:\Windows\WinSxS.

10. Missing DLL error

The loader searched every place in the search order and found no file with that name. The program cannot start.

UNDERSTANDING QUESTIONS

Q1. Why can many programs share one copy of a DLL in RAM?

Answer The code part of a DLL is read-only, so Windows maps the same file's code pages into many processes, all pointing to the same physical RAM pages. Only writable data gets private copies (copy-on-write). This saves a lot of memory.

Q2. Why does the IAT exist instead of calls using a fixed address?

Answer The DLL's location is not known when the program is built, and ASLR changes it. The loader fills in the slots once at load time, so the program's calls always go through the right address without rewriting the code.

Q3. Why is the current directory searched late in safe DLL search mode?

Answer The current directory can be any folder, including one holding untrusted files. If it were checked early, a fake DLL there could win over the real one in System32. Moving it later means real system DLLs are found first.

Q4. Why is importing by name safer than importing by ordinal?

Answer Ordinals are positions in the export table and can change when the DLL is rebuilt. A program using an old number could then call the wrong function. Names are the stable promise between versions.

Q5. How does WinSxS reduce "DLL hell"?

Answer It keeps several versions of an assembly in separate folders, each with a unique identity. A program's manifest says which version it needs, so installing a new version no longer overwrites the one another program depends on.

SCENARIO QUESTIONS (Troubleshooting)

S1. You copied a small program from a friend's PC. It fails with "VCRUNTIME140.dll was not found". What is the likely cause and fix?

Answer The program was built with Visual C++ and needs its runtime DLLs, which are installed by the Visual C++ Redistributable on the original PC. Install the official Microsoft Visual C++ Redistributable (matching 64-bit or 32-bit) from Microsoft's website. Do not download a single DLL from a random site.

S2. A program says "The procedure entry point X could not be located in the dynamic link library Y.dll". The DLL exists. What is happening?

Answer A file named Y.dll was found, but it is a different (often older) version that does not export function X. Look for another copy of Y.dll earlier in the search order (the application folder or a PATH folder), or reinstall or update the program or the package it depends on.

S3. After installing a tool that added its folder to PATH, an older program starts crashing. Why?

Answer Both folders may hold a DLL with the same name but different versions. The older program may now find the wrong copy first through PATH. Fix by changing the PATH order or removing the entry, or by installing the older program's own DLL next to its EXE.

S4. You find helper.dll inside your Downloads folder next to a downloaded installer, and you did not expect it. What should you consider?

Answer Programs run from an unsafe folder may load a DLL placed next to them (search order, application directory). Check the file's digital signature, scan it with Windows Security, and run installers only from trusted sources. Delete the download folder if it is not needed.

S5. File Explorer says C:\Windows\WinSxS uses a huge amount of space and a friend suggests deleting it. What do you say?

Answer Do not delete it. It holds the component store that Windows needs for updates and repairs. Many files are hard links, so the displayed size is overstated. To free space, use Disk Cleanup (Clean up system files) or Microsoft's supported DISM guidance.

INTERVIEW QUESTIONS

I1. Explain the difference between load-time and run-time dynamic linking.

Answer Load-time: the DLL is in the program's import table, and the loader loads it and fills the IAT before the program starts; if it fails, the program does not start. Run-time: the program calls LoadLibrary and GetProcAddress when it wants, so it can handle failure, support plug-ins and load features only when needed. Delay-load is a linker feature that gives run-time behaviour with ordinary-looking code.

I2. Describe what the Windows loader does when a program starts.

Answer It reads the import table, finds each DLL using the search order (KnownDLLs first), maps it into the address space at its preferred base or a different one and relocates it (ASLR), processes that DLL's own imports recursively, fills the IAT, calls DllMain with DLL_PROCESS_ATTACH, and finally starts the program's entry point.

I3. What is DLL search order hijacking and how is it mitigated?

Answer Placing a malicious DLL with the expected name in a location searched before the real one, so the program loads it. Mitigations: KnownDLLs, safe DLL search mode, loading by full path, SetDefaultDllDirectories and LOAD_LIBRARY_SEARCH flags, installing in protected folders, code signing, and security software.

I4. What is an assembly manifest and how does it relate to WinSxS?

Answer A manifest is an XML description (often embedded in the EXE) naming the assembly identities and versions a program needs. When the program starts, the side-by-side system uses it to select the right assembly folder from the WinSxS component store, so different programs can use different versions of the same DLL at the same time.

I5. At a high level, what is DLL injection and how does Windows defend against it?

Answer Making a process load a DLL its author did not intend. Windows defends with separate address spaces, access rights on processes, UAC, Protected Process Light, signature requirements, process mitigation policies, memory integrity, and antivirus/EDR monitoring. Legitimate tools such as debuggers and accessibility software use related techniques with permission, which is why behaviour and signatures matter.

PRACTICAL TASK

Make a "DLL map" of one program. Pick a program that is running (for example your browser or Notepad). Using Get-Process ... | Select-Object -ExpandProperty Modules, list ten modules and, for each, write its folder and one guess about what it does. Mark which ones are from System32, which from WinSxS and which from the program's own folder. Draw a small tree with the program at the top.

Why This Matters

When a program fails to start, or an antivirus complains about a DLL, you can look at the map and see who is supposed to be there. It also trains you to tell a normal module list from a suspicious one.

CHAPTER SUMMARY

  • A DLL is a PE file of shared code, data and resources loaded at run time. Sharing read-only code pages saves RAM, gives one-place updates and smaller EXEs.
  • Static linking copies code into the EXE; dynamic linking connects DLLs when the program runs (load-time via the import table and IAT, run-time via LoadLibrary and GetProcAddress, or delay-load).
  • The loader in ntdll.dll finds and maps DLLs (relocating them with ASLR), fills the IAT, calls DllMain, and tracks reference counts.
  • Search order: KnownDLLs, application folder, system folders, Windows folder, current folder (late in safe mode), PATH. The order matters for security (hijacking).
  • Exports (names, ordinals, forwarders) are matched with imports by the loader.
  • Dependencies form trees; common errors are "not found", "entry point not located" and "bad image".
  • WinSxS and manifests let several versions live side by side and ended most "DLL hell".
  • DLL injection is understood at concept level only: legitimate tools and malware use related ideas, and Windows defends with layered protections.