Easy Desk Newsletters

Previous - Next - All Newsletters

What is a DLL, what is a Dependent?

After my last newsletter was sent out, a few local friends told me that I lost them after a paragraph or two. So I think I should explain what a DLL is and how everything works. On my site I have a page that goes into detail about a DLL , so I'll explain what Tables, Imports, and Dependencies are.

Let's say you want to start a new letter to your friend using Notepad, the executable file name is Notepad.exe. This file is the Dependent, as your children are your dependents, the children's parents are the dependencies.

Notepad.exe needs support from other files in order to run: Shell32.dll, Kernel32.dl, User32.dll, Gdi32.dll, Comdlg32.dll, and Advapi.dll. These DLLs are the Dependencies of Notepad.exe. Each of these files are Dependents of the Kernel32.dll.

The Kernel32.dll is the operating system, everything that happens on your computer must go through the Kernel, hence, all binary files are ultimately a Dependent of the Kernel. The need for the all those other DLLs is to make programming easier. These other DLLs have functions (routines) all done already, so why reinvent the wheel? Just ask one of them for the information you want.

So now what is a Table? A Table is a section in the header of a binary file that tells Notepad.exe what memory address (entry point) to find the function (routines) that it wants. These functions that a DLL can perform are called Exports, the Exports of a DLL are all listed in the DLL's Export Table. A DLL needs to ask at least one other DLL for information in order to perform the requested function. The Kernel32.dll will be the last DLL in the line to be asked for information. So each DLL, except the Kernel32.dll, will not only have an Export Table, but an Import Table. Kernel32.dll only has an Export Table.

An Import Table will list all the DLLs and functions that the DLL will need to ask another DLL to perform for it. Notepad.exe contains a Table of Imports only because as an exe file, it does not perform any functions for any DLLs.

Imports are the functions that a binary file needs to request, and Exports are the functions it is capable of performing.

Now let's start writing that letter to your friend. When you start Notepad, before it is visible on the screen it needs to know what settings you have selected since the last time you used Notepad. So it needs to look at the Windows Registry where it saved those settings. In order for this to happen Notepad is going to read the Registry, and it is going to need help from Advapi.dll.

Notepad is going to make the Call (request) "RegOpenKeyA" to Advapi.dll to find out if you want word wrap on. Notepad's Call is going to ask Advapi.dll to tell Notepad what the value is of a Key in the Registry. This Call must supply Advapi.dll with certain information, such as, what Key is to be read. Advapi.dll will also need to know what Hive (section) in the Registry that Notepad wants the information from. In order for this to happen Notepad must make the Call "LoadLibrary" to  Kernel32.dll to have it load Advapi.dll into memory. Then Notepad will read Advapi's Export Table to locate the Call "RegOpenKeyA". Notepad must now find the exact entry point (memory address) where this function is located. In return Advapi will have an Import Table containing all the Calls it needs to make to Kernel32.dll, so that Advapi.dll can perform the requested function for Notepad.exe.

At the bottom of the page is what all this looks like as an abbreviated example, and you can follow this in detail using System Sentry's "Find Dependencies"

All this just to get the value "1" or "0", true or false answer to find out if word wrap is on. But now you can see that if Notepad made a Call of RegOpenKey to Advapi.dll you would get the error message "Cannot find Entry Point...", because the Call is RegOpenKeyA not RegOpenKey. In this example the error may be due to Notepad.exe or Advapi.dll being corrupted. Another possibility is that Notepad.exe is making a Call to an newer version of Advapi.dll. This latter example is strictly for explanation purposes, as the Call has always been RegOpenKeyA and RegOpenKey has never existed as a Call. So in reality one of the two files would have to be corrupt, or from a different version of Windows.

The Notepad.exe file from Windows NT, XP, 2000, 2003, Vista will not run on Windows 9x or ME, and will error.

 

Notepad.exe Advapi.dll Kernel32.dll
Exports Imports >>> <<< Exports Imports >>> <<< Exports Imports
Does not exist LoadLibrary
FreeLibrary
RegOpenKeyA
RegCloseKeyA
RegQueryValueA
RegOpenKeyA
RegCloseKeyA
RegQueryValueA
MapViewFile
UnMapViewFile
SetFilePointer
ReadFile
LoadLibrary
FreeLibrary
MapViewFile
UnMapViewFile
SetFilePointer
ReadFile
Does not exists

go back

About Us | Privacy Policy | Contact Us | FAQ|Help Files |Humor|©2009 Easy Desk Software