Windows loader's search order

When an executable file is invoked, the operating system loader creates the virtual address space for the process. then the loader maps the executable module into the process' address space. the loader examines the executable's import section and attempts to locate and map any required DLLs into the process' address space.

Because the import section contains just a DLL name without its pathname, the loader must search the user's disk drives for the DLL. Here is the loader's search order:

1. The directory containing the executable Image File

2. The Windows System directory returnedGetwindowsdirectory

3. The 16-bit system directory-that is,SystemSubfolder under the Windows directory

4. The Windows directory returnedGetsystemdirectory

5. The process 'current directory

6. The directories listed in the PATH environment variable

NoticeThat the application current directory is searched after the Windows directories. this change occurred in Windows XP SP2 to avoid having fake system DLLs be found and loaded from the application current directory instead of from their official location in the Windows directories. the msdn online help mentions howDWORDValue under HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager cocould change this search order, but you shoshould never set it if you don't want to allow malware to compromise your machine. be aware that other things can affect how the loader searches for a DLL. (See Chapter 20 for more information .)