Known DLLs

[Previous] [Next]

Certain operating system_supplied DLLs get special treatment. These are called known DLLs. They are just like any other DLL except that the operating system always looks for them in the same directory in order to load them. Inside the registry is the following key:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\KnownDLLs 

Here's what this subkey looks like on my machine using the RegEdit.exe utility.

As you can see, this key contains a set of value names that are the names of certain DLLs. Each of these value names has value data that happens to be identical to the value name with a .dll file extension. (This does not have to be the case, however, as I'll show you in an upcoming example.) When LoadLibrary or LoadLibraryEx is called, the functions first check to see whether you are passing a DLL name that includes the .dll extension. If you are not, they search for the DLL using the normal search rules.

If you do specify a .dll extension, these functions remove the extension and then search the KnownDLLs registry key to see whether it contains a value name that matches. If no matching name is found, the normal search rules are used. But if a matching value name is found, the system looks up the associated value data and attempts to load a DLL using the value data instead. The system also begins searching for the DLL in the directory indicated by the DllDirectory value's data in the registry. By default, the DllDirectory value's data is %SystemRoot%\System32 on Windows 2000.

To illustrate, suppose we add the following value to the KnownDLLs registry key:

 Value name: SomeLib Value data: SomeOtherLib.dll 

When we call the following function, the system uses the normal search rules to locate the file:

 LoadLibrary("SomeLib"); 

However, if we call the function below, the system sees that there is a matching value name. (Remember that the system removes the .dll extension when it checks the registry value names.)

 LoadLibrary("SomeLib.dll"); 

The system therefore attempts to load a library called SomeOtherLib.dll instead of SomeLib.dll. And it first looks for SomeOtherLib.dll in the %SystemRoot%\System32 directory. If it finds the file in this directory, it loads it. If the file is not in this directory, LoadLibrary(Ex) fails and returns NULL, and a call to GetLastError returns 2 (ERROR_FILE_NOT_FOUND).