JSI Tip 0716. How does Windows NT locate .DLL files?

Windows NT uses different approaches for 32-bit versus 16-bit apps.

For 32-bit apps, Windows NT searches for implicitly loaded DLLs at:

The .exe file directory.
The current directory.
The %SystemRoot%\SYSTEM32 directory.
The %SystemRoot% directory.
The directories in your Path.

If the DLL is listed as a KnownDLLs at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager as a type REG_SZ entry with a Value Name of the DLL without the extension and a data value of the DLL with the .DLL extension, then the search is:

The %SystemRoot%\SYSTEM32 directory.
The .exe file directory.
The current directory.
The %SystemRoot% directory.
The directories in your Path.

The KnownDLLs are mapped at boot time. Rernaming or moving during a session has no effect.

You can alter this behavior by including the 8.3 DLL name in the ExcludeFromKnownDlls entry, a type REG_MULTI_SZ value, one per line. This will make NT believe that the DLL is not listed in KnownDLLs.

For 16-bit apps, Windows NT uses KnownDLLs for both implicitly and explicitly load DLLs. The value is at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WOW. At this key, KnownDLLs is a type REG_SZ value which lists the 8.3 DLL names, separated by spaces. Wihout a KnownDLLs entry, WOW searches:

The current directory.
The %SystemRoot% directory.
The %SystemRoot%\SYSTEM directory.
The %SystemRoot%\SYSTEM32 directory.
The .exe file directory.
The directories in your Path.

With the KnownDLLs entry, WOW only searches the %SystemRoot%\SYSTEM32 directory.

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish