Dynamic link library (DLL) search sequence

Transfer an article to support Windows 7, Win8, and 2008. Therefore, I will attach the original article link:

Http://msdn.microsoft.com/en-us/library/ms682586%28VS.85%29.aspx

Dynamic-link library search order

A system can contain multiple versions of the same dynamic-link library (DLL ). applications can control the location from which a DLL is loaded by specifying a full path or using another mechanic such as a manifest. if these methods are not used, the system searches for the DLL at load time as described in this topic.

Factors that affect searching

The following factors affect whether the system searches for a DLL:

• If a DLL with the same module name is already loaded in memory, the system checks only for redirection and a manifest before resolving to the loaded DLL, no matter which directory it is in. the system does not search for the DLL.
• If the DLL is on the list of known DLLs for the version of Windows on which the application is running, the system uses its copy of the known DLL (and the known DLL's dependent DLLs, if any) instead of searching for the DLL. for a list of known DLLs on the current system, see the following registry key:HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ knowndlls.
• If a DLL has dependencies, the system searches for the dependent DLLs as if they were loaded with just their module names. This is true even if the first DLL was loaded by specifying a full path.

Search Order for Windows Store apps

When a Windows Store app loads a packaged module by callingLoadpackagedlibraryFunction, the DLL must be in the package dependency graph of the process. For more information, seeLoadpackagedlibrary. When a Windows Store app loads a module by other means and does not specify a full path, the system searches for the DLL and its dependencies at load time as described in this section.

Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows Server 2003, and Windows XP:Windows Store apps are supported starting with Windows 8 and Windows Server 2012.

Before the system searches for a DLL, it checks the following:

• If a DLL with the same module name is already loaded in memory, the system uses the loaded DLL, no matter which directory it is in. The system does not search for the DLL.
• If the DLL is on the list of known DLLs for the version of Windows on which the application is running, the system uses its copy of the known DLL (and the known DLL's dependent DLLs, if any ). the system does not search for the DLL. for a list of known DLLs on the current system, see the following registry key:HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ knowndlls.

If the system must search for a module or its dependencies, it always uses the search order for Windows Store apps even if a dependency is not Windows Store app code.

Standard search order for Windows Store apps

If the module is not already loaded or on the list of known DLLs, the System Searches these locations in this order:

1. The package dependency graph of the process. This is the application's package plus any dependencies specified<PackageDependency>In<Dependencies>Section of the application's package manifest. dependencies are searched in the order they appear in the manifest.
2. The Directory The Calling process was loaded from.
3. The system directory (% SystemRoot % \ system32 ).

If a DLL has dependencies, the system searches for the dependent DLLs as if they were loaded with just their module names. This is true even if the first DLL was loaded by specifying a full path.

Alternate search order for Windows Store apps

If a module changes the standard search order by callingLoadLibraryExFunctionLoad_with_altered_search_path, The System Searches the directory the specified module was loaded from instead of the directory of the calling process. The System Searches these locations in this order:

1. The package dependency graph of the process. This is the application's package plus any dependencies specified<PackageDependency>In<Dependencies>Section of the application's package manifest. dependencies are searched in the order they appear in the manifest.
2. The directory the specified module was loaded from.
3. The system directory (% SystemRoot % \ system32 ).

Search Order for desktop applications

Desktop applications can control the location from which a DLL is loaded by specifying a full path, using DLL redirection, or by using a manifest. if none of these methods are used, the system searches for the DLL at load time as described in this section.

Before the system searches for a DLL, it checks the following:

• If a DLL with the same module name is already loaded in memory, the system uses the loaded DLL, no matter which directory it is in. The system does not search for the DLL.
• If the DLL is on the list of known DLLs for the version of Windows on which the application is running, the system uses its copy of the known DLL (and the known DLL's dependent DLLs, if any ). the system does not search for the DLL. for a list of known DLLs on the current system, see the following registry key:HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ knowndlls.

If a DLL has dependencies, the system searches for the dependent DLLs as if they were loaded with just their module names. This is true even if the first DLL was loaded by specifying a full path.

ImportantIf an attacker gains control of one of the directories that is searched, it can place a malicious copy of the DLL in that directory. for ways to help prevent such attacks, see dynamic-link library security.

Standard search order for desktop applications

The standard DLL search order used by the system depends on whether Safe DLL Search Mode is enabled or disabled. Safe DLL Search Mode places the user's current directory later in the search order.

Safe DLL Search Mode is enabled by default. To disable this feature, createHKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager\SafeDllSearchModeRegistry Value and set it to 0. CallingSetdlldirectoryFunction compute tively disablesSafeDllSearchModeWhile the specified directory is in the search path and changes the search order as described in this topic.

Windows XP:Safe DLL Search Mode is disabled by default. To enable this feature, create SafeDllSearchModeRegistry Value and set it to 1. Safe DLL Search Mode is enabled by default starting with Windows XP with Service Pack 2 (SP2 ).

IfSafeDllSearchModeIs enabled, the search order is as follows:

1. The directory from which the application loaded.
2. The system directory. UseGetsystemdirectoryFunction to get the path of this directory.
3. The 16-bit system directory. There is no function that obtains the path of this directory, but it is searched.
4. The Windows directory. UseGetwindowsdirectoryFunction to get the path of this directory.
5. The current directory.
6. The directories that are listed in the PATH environment variable. Note that this does not include the per-Application Path specified byAPP pathsRegistry key.APP pathsKey is not used when computing the DLL search path.

IfSafeDllSearchModeIs disabled, the search order is as follows:

1. The directory from which the application loaded.
2. The current directory.
3. The system directory. UseGetsystemdirectoryFunction to get the path of this directory.
4. The 16-bit system directory. There is no function that obtains the path of this directory, but it is searched.
5. The Windows directory. UseGetwindowsdirectoryFunction to get the path of this directory.
6. The directories that are listed in the PATH environment variable. Note that this does not include the per-Application Path specified byAPP pathsRegistry key.APP pathsKey is not used when computing the DLL search path.

Alternate search order for desktop applications

The standard search order used by the system can be changed by callingLoadLibraryExFunctionLoad_with_altered_search_path. The standard search order can also be changed by callingSetdlldirectoryFunction.

Windows XP:Changing the standard search order by calling SetdlldirectoryIs not supported until Windows XP with Service Pack 1 (SP1 ).

If you specify an alternate search strategy, its behavior continues until all associated executable modules have been located. After the system starts processing DLL initialization routines, the system reverts to the standard search strategy.

TheLoadLibraryExFunction supports an alternate search order if the call specifiesLoad_with_altered_search_pathAndLpfilenameParameter specifies an absolute path.

Note that the standard search strategy and the alternate search strategy specifiedLoadLibraryExWithLoad_with_altered_search_pathDiffer in just one way: the standard search begins in the calling application's directory, and the alternate search begins in the directory of the executable module thatLoadLibraryExIs loading.

IfSafeDllSearchModeIs enabled, the alternate search order is as follows:

1. The directory specifiedLpfilename.
2. The system directory. UseGetsystemdirectoryFunction to get the path of this directory.
3. The 16-bit system directory. There is no function that obtains the path of this directory, but it is searched.
4. The Windows directory. UseGetwindowsdirectoryFunction to get the path of this directory.
5. The current directory.
6. The directories that are listed in the PATH environment variable. Note that this does not include the per-Application Path specified byAPP pathsRegistry key.APP pathsKey is not used when computing the DLL search path.

IfSafeDllSearchModeIs disabled, the alternate search order is as follows:

1. The directory specifiedLpfilename.
2. The current directory.
3. The system directory. UseGetsystemdirectoryFunction to get the path of this directory.
4. The 16-bit system directory. There is no function that obtains the path of this directory, but it is searched.
5. The Windows directory. UseGetwindowsdirectoryFunction to get the path of this directory.
6. The directories that are listed in the PATH environment variable. Note that this does not include the per-Application Path specified byAPP pathsRegistry key.APP pathsKey is not used when computing the DLL search path.

TheSetdlldirectoryFunction supports an alternate search order ifLppathnameParameter specifies a path. The alternate search order is as follows:

1. The directory from which the application loaded.
2. The directory specified byLppathnameParameterSetdlldirectory.
3. The system directory. UseGetsystemdirectoryFunction to get the path of this directory. The name of this directory is system32.
4. The 16-bit system directory. There is no function that obtains the path of this directory, but it is searched. The name of this directory is system.
5. The Windows directory. UseGetwindowsdirectoryFunction to get the path of this directory.
6. The directories that are listed in the PATH environment variable. Note that this does not include the per-Application Path specified byAPP pathsRegistry key.APP pathsKey is not used when computing the DLL search path.

IfLppathnameParameter is an empty string, the call removes the current directory from the search order.

SetdlldirectorySpecified tively disables Safe DLL search mode while the specified directory is in the search path. To restore Safe DLL Search Mode Based onSafeDllSearchModeRegistry Value and restore the current directory to the search order, callSetdlldirectoryWithLppathnameAs null.

Search Order using load_library_search flags

An application can specify a search order by using one or moreLoad_library_searchFlags withLoadLibraryExFunction. An application can also useLoad_library_searchFlags withSetdefadldlldirectoriesFunction to establish a DLL search order for a process. The application can specify additional directories for the process DLL search order by usingAdddlldirectoryOrSetdlldirectoryFunctions.

Windows 7, Windows Server 2008 R2, Windows Vista, and Windows Server 2008:The Load_library_searchFlags are available on systems with kb2533623 installed.

Windows Server 2003 and Windows XP:The Load_library_searchFlags are not supported.

The directories that are searched depend on the flags specifiedSetdefadldlldirectoriesOrLoadLibraryEx. If more than one flag is used, the corresponding directories are searched in the following order:

1. The directory that contains the DLL (Load_library_search_dll_load_dir). This directory is searched only for dependencies of the DLL to be loaded.
2. The application directory (Load_library_search_application_dir).
3. Paths explicitly added withAdddlldirectoryFunction (Load_library_search_user_dirs) OrSetdlldirectoryFunction. If more than one path has been added, the order in which the paths are searched is unspecified.
4. The system directory (Load_library_search_system32).

If the application does not callLoadLibraryExWith anyLoad_library_searchFlags or establish a DLL search order for the process, the system searches for DLLs using either the standard search order or the alternate search order.

 

DLL search brief secure DLL Search Mode Enabled

If the security DLL search mode is enabled, the search order is as follows:

• Application Path
• Windows System directory. You can call the getsystemdirectory function to obtain the directory path.
• 16-bit system directory. No function can obtain the path of this directory, but it will be searched.
• Windows directory. You can call the getwindowsdirectory function to obtain the directory path.
• Current Directory
• Path: the path specified by the environment variable. Note that this does not include the application path specified in the Registry key for each application. The key value of the registry entry in the Application Path is not used as the DLL search path.

 

Disable Security DLL Search Mode

If the security DLL search mode is disabled, the search order is as follows:

• Application Path
• Current Directory
• Windows System directory. You can call the getsystemdirectory function to obtain the directory path.
• 16-bit system directory. No function can obtain the path of this directory, but it will be searched.
• Windows directory. You can call the getwindowsdirectory function to obtain the directory path.
• Path: the path specified by the environment variable. Note that this does not include the application path specified in the Registry key for each application. The key value of the registry entry in the Application Path is not used as the DLL search path.

In fact, the simplest way is to place executable files and DLL in a folder, such as the installed folder of beyond compare3: