View source for Dynamic-link library

{{Infobox file format
| name          = Dynamic-link library
| icon          = Windows 11 DLL icon.svg
| extension     = <code>.dll</code>
| mime          = <code>application/vnd.microsoft.portable-executable</code>
| type code     = 
| uniform type  = <code>com.microsoft.windows-dynamic-link-library</code>
| magic         = <code>4D 5A</code> (<code>MZ</code> in [[ASCII]])
| owner         = [[Company:Microsoft|Microsoft]]
| genre         = 
| container for = [[Shared library]]
| contained by  = 
| extended from = 
| extended to   = 
| standard      = 
| url           = 
}}

A '''dynamic-link library''' ('''DLL''') is a [[Shared library|shared library]] in the [[Company:Microsoft|Microsoft]] [[Software:Microsoft Windows|Windows]] or OS/2 [[Operating system|operating system]]. A DLL can contain executable code (functions), [[Data (computing)|data]], and resources.

A DLL file often has file extension <code>.dll</code> even though this is not required. The extension is sometimes used to describe the content of the file. For example, <code>.ocx</code> is a common extension for an [[Software:ActiveX|ActiveX]] control and <code>.drv</code> for a legacy (16-bit) [[Device driver|device driver]].

A DLL that contains only resources can be called a ''resource DLL''. Examples include an [[Icon (computing)|icon]] library, with common extension <code>.icl</code>, and a [[Typeface|font]] library with common extensions <code>.fon</code> and <code>.fot</code>.<ref>
{{cite web
|url=https://msdn.microsoft.com/en-US/library/24b2tcy0.aspx
|title=Creating a Resource-Only DLL
|work=Microsoft Developer Network Library
|author=Microsoft Corporation
|date=3 August 2021
}}</ref>

The [[File format|file format]] of a DLL is the same as for an [[Executable|executable]] (a.k.a. EXE). The main difference between a DLL file and an EXE file is that a DLL cannot be run directly since the operating system requires an [[Entry point|entry point]] to start execution. Windows provides a utility program (RUNDLL.EXE/RUNDLL32.EXE) to execute a function exposed by a DLL. Since they have the same format, an EXE can be used as a DLL. Consuming code can load an EXE via the same mechanism as loading a DLL.

==Background==
The first versions of [[Software:Microsoft Windows|Microsoft Windows]] ran programs together in a single [[Address space|address space]]. Every program was meant to co-operate by yielding the CPU to other programs so that the [[Graphical user interface|graphical user interface]] (GUI) could multitask and be maximally responsive. All operating-system level operations were provided by the underlying operating system: [[Software:MS-DOS|MS-DOS]]. All higher-level services were provided by Windows Libraries "Dynamic Link Library". The Drawing [[Application programming interface|API]], [[Software:Graphics Device Interface|Graphics Device Interface]] (GDI), was implemented in a DLL called <code>GDI.EXE</code>, the user interface in <code>USER.EXE</code>. These extra layers on top of DOS had to be shared across all running Windows programs, not just to enable Windows to work in a machine with less than a megabyte of RAM, but to enable the programs to co-operate with each other. The code in GDI needed to translate drawing commands to operations on specific devices. On the display, it had to manipulate pixels in the frame buffer. When drawing to a printer, the API calls had to be transformed into requests to a printer. Although it could have been possible to provide hard-coded support for a limited set of devices (like the [[Color Graphics Adapter]] display, the HP LaserJet [[Software:Printer Command Language|Printer Command Language]]), Microsoft chose a different approach. GDI would work by loading different pieces of code, called "[[Device driver|device driver]]s", to work with different output devices.

The same architectural concept that allowed GDI to load different device drivers also allowed the [[Software:Windows shell|Windows shell]] to load different Windows programs, and for these programs to invoke API calls from the shared USER and GDI libraries. That concept was "dynamic linking".

In a conventional non-shared [[Static library|static library]], sections of code are simply added to the calling program when its executable is built at the "linking" phase; if two programs call the same routine, the routine is included in both the programs during the linking stage of the two. With dynamic linking, shared code is placed into a single, separate file. The programs that call this file are connected to it at run time, with the operating system (or, in the case of early versions of Windows, the OS-extension), performing the binding.

For those early versions of Windows (1.0 to 3.11), the DLLs were the foundation for the entire GUI. As such, display drivers were merely DLLs with a .DRV extension that provided custom implementations of the same drawing API through a unified [[Device driver|device driver]] interface (DDI), and the Drawing (GDI) and GUI (USER) APIs were merely the function calls exported by the GDI and USER, system DLLs with .EXE extension.

This notion of building up the operating system from a collection of dynamically loaded libraries is a core concept of Windows that persists {{as of | 2015 | lc = on}}.
DLLs provide the standard benefits of [[Shared library#Shared libraries|shared libraries]], such as modularity. Modularity allows changes to be made to code and data in a single self-contained DLL shared by several applications without any change to the applications themselves.

Another benefit of modularity is the use of generic interfaces for plug-ins. A single interface may be developed which allows old as well as new modules to be integrated seamlessly at run-time into pre-existing applications, without any modification to the application itself. This concept of dynamic extensibility is taken to the extreme with the [[Component Object Model]], the underpinnings of [[Software:ActiveX|ActiveX]].

In Windows 1.x, 2.x and 3.x, all Windows applications shared the same address space as well as the same memory. A DLL was only loaded once into this address space; from then on, all programs using the library accessed it. The library's data was shared across all the programs. This could be used as an indirect form of [[Inter-process communication|inter-process communication]], or it could accidentally corrupt the different programs. With the introduction of [[32-bit computing|32-bit]] libraries in [[Software:Windows 95|Windows 95]], every process ran in its own address space. While the DLL code may be shared, the data is private except where shared data is explicitly requested by the library. That said, large swathes of [[Software:Windows 95|Windows 95]], [[Software:Windows 98|Windows 98]] and [[Software:Windows Me|Windows Me]] were built from 16-bit libraries, which limited the performance of the [[Engineering:Pentium Pro|Pentium Pro]] microprocessor when launched, and ultimately limited the stability and scalability of the DOS-based versions of Windows.

==Limitations==

Although the DLL technology is core to the Windows architecture, it has drawbacks.

=== DLL hell ===

[[DLL hell]] describes the bad behavior of an application when the wrong version of a DLL is consumed.<ref name=DLL_Hell>{{cite web
 | title = The End of DLL Hell
 | publisher = Microsoft Corporation
 | url = https://msdn.microsoft.com/en-us/library/ms811694.aspx
 | access-date = 2009-07-11 |archive-url = https://web.archive.org/web/20080506103746/http://msdn.microsoft.com/en-us/library/ms811694.aspx |archive-date = 2008-05-06}}
</ref> Mitigation strategies include:
* [[.NET Framework|.NET Framework]]
* Virtualization-based solutions such as Microsoft Virtual PC and Microsoft Application Virtualization because they offer isolation between applications
* [[Software:Side-by-side assembly|Side-by-side assembly]]

=== Shared memory space ===

The executable code of a DLL runs in the memory space of the calling process and with the same access permissions, which means there is little overhead in their use, but also that there is no protection for the calling program if the DLL has any sort of bug.

==Features==

=== Upgradability ===
The DLL technology allows for an application to be modified without requiring consuming components to be re-compiled or re-linked. A DLL can be replaced so that the next time the application runs it uses the new DLL version. To work correctly, the DLL changes must maintain [[Backward compatibility|backward compatibility]].

Even the operating system can be upgraded since it is exposed to the applications via DLLs. System DLLs can be replaced so that the next time the applications run, they use the new system DLLs.

=== Memory management ===
In [[Software:Windows API|Windows API]], DLL files are organized into ''[[Memory segmentation|sections]]''. Each section has its own set of attributes, such as being writable or read-only, executable (for code) or non-executable (for data), and so on.

The code in a DLL is usually shared among all the processes that use the DLL; that is, they occupy a single place in physical memory, and do not take up space in the page file. Windows does not use [[Position-independent code|position-independent code]] for its DLLs; instead, the code undergoes [[Relocation (computing)|relocation]] as it is loaded, fixing addresses for all its entry points at locations which are free in the memory space of the first process to load the DLL. In older versions of Windows, in which all running processes occupied a single common address space, a single copy of the DLL's code would always be sufficient for all the processes. However, in newer versions of Windows which use separate address spaces for each program, it is only possible to use the same relocated copy of the DLL in multiple programs if each program has the same virtual addresses free to accommodate the DLL's code. If some programs (or their combination of already-loaded DLLs) do not have those addresses free, then an additional physical copy of the DLL's code will need to be created, using a different set of relocated entry points. If the physical memory occupied by a code section is to be reclaimed, its contents are discarded, and later reloaded directly from the DLL file as necessary. 

In contrast to code sections, the data sections of a DLL are usually private; that is, each process using the DLL has its own copy of all the DLL's data. Optionally, data sections can be made shared, allowing [[Inter-process communication|inter-process communication]] via this shared memory area. However, because user restrictions do not apply to the use of shared DLL memory, this creates a security hole; namely, one process can corrupt the shared data, which will likely cause all other sharing processes to behave undesirably. For example, a process running under a guest account can in this way corrupt another process running under a privileged account. This is an important reason to avoid the use of shared sections in DLLs.

If a DLL is compressed by certain executable packers (e.g. [[Software:UPX|UPX]]), all of its code sections are marked as read and write, and will be unshared. Read-and-write code sections, much like private data sections, are private to each process. Thus DLLs with shared data sections should not be compressed if they are intended to be used simultaneously by multiple programs, since each program instance would have to carry its own copy of the DLL, resulting in increased memory consumption.

===Import libraries===
Like static libraries, import libraries for DLLs are noted by the <code>.lib</code> file extension. For example, kernel32.dll, the primary dynamic library for Windows's base functions such as file creation and memory management, is linked via <code>kernel32.lib</code>. The usual way to tell an import library from a proper static library is by size: the import library is much smaller as it only contains symbols referring to the actual DLL, to be processed at link-time. Both nevertheless are Unix [[Software:Ar (Unix)|ar]] format files.

Linking to dynamic libraries is usually handled by linking to an import library when building or linking to create an executable file. The created executable then contains an import address table (IAT) by which all DLL function calls are referenced (each referenced DLL function contains its own entry in the IAT). At run-time, the IAT is filled with appropriate addresses that point directly to a function in the separately loaded DLL.<ref>{{cite web |title=Understanding the Import Address Table |url=http://sandsprite.com/CodeStuff/Understanding_imports.html |url-status=live |archive-url=https://web.archive.org/web/20231107162249/http://sandsprite.com/CodeStuff/Understanding_imports.html |archive-date=November 7, 2023 |access-date=November 7, 2023 |website=Sandsprite.com}}</ref>

In Cygwin/MSYS and MinGW, import libraries are conventionally given the suffix <code>.dll.a</code>, combining both the Windows DLL suffix and the Unix ar suffix. The file format is similar, but the symbols used to mark the imports are different (<code>_head_foo_dll</code> vs <code>__IMPORT_DESCRIPTOR_foo</code>).<ref>{{cite web |title=Building and Using DLLs |url=https://cygwin.com/cygwin-ug-net/dll.htm |quote=The import library is a regular UNIX-like .a library, but it only contains the tiny bit of information needed to tell the OS how the program interacts with ("imports") the dll. This information is linked into .exe. }} </ref> Although its [[Software:GNU Binutils|GNU Binutils]] toolchain can generate import libraries and link to them, it is faster to link to the DLL directly.<ref>{{cite web |title=ld and WIN32 |url=https://sourceware.org/binutils/docs/ld/WIN32.html |website=ld documentation}}</ref> An experimental tool in MinGW called genlib can be used to generate import libs with MSVC-style symbols.

===Symbol resolution and binding===  
Each function exported by a DLL is identified by a numeric ordinal and optionally a name. Likewise, functions can be imported from a DLL either by ordinal or by name. The ordinal represents the position of the function's address pointer in the DLL Export Address table.  It is common for internal functions to be exported by ordinal only. For most Windows API functions only the names are preserved across different Windows releases; the ordinals are subject to change. Thus, one cannot reliably import Windows API functions by their ordinals.

Importing functions by ordinal provides only slightly better performance than importing them by name: export tables of DLLs are ordered by name, so a [[Binary search|binary search]] can be used to find a function. The index of the found name is then used to look up the ordinal in the Export Ordinal table. In 16-bit Windows, the name table was not sorted, so the name lookup overhead was much more noticeable.

It is also possible to ''bind'' an executable to a specific version of a DLL, that is, to resolve the addresses of imported functions at compile-time. For bound imports, the [[Linker (computing)|linker]] saves the timestamp and checksum of the DLL to which the import is bound. At run-time, Windows checks to see if the same version of library is being used, and if so, Windows bypasses processing the imports. Otherwise, if the library is different from the one which was bound to, Windows processes the imports in a normal way.

Bound executables load somewhat faster if they are run in the same environment that they were compiled for, and exactly the same time if they are run in a different environment, so there is no drawback for binding the imports. For example, all the standard Windows applications are bound to the system DLLs of their respective Windows release. A good opportunity to bind an application's imports to its target environment is during the application's installation. This keeps the libraries "bound" until the next OS update. It does, however, change the checksum of the executable, so it is not something that can be done with signed programs, or programs that are managed by a configuration management tool that uses checksums (such as [[MD5]] checksums) to manage file versions. As more recent Windows versions have moved away from having fixed addresses for every loaded library (for security reasons), the opportunity and value of binding an executable is decreasing.

===Explicit run-time linking===
<!-- TODO: mention ref-counting here.
For each DLL, Windows maintains one global ref-count, and one more per each process using it.
LoadLibrary and FreeLibrary affect the per-process ref-count; load-time linking has no effect on it.
Thus, it's impossible to force unloading a DLL from memory by calling FreeLibrary many times. A process can at most unmap it from its own VAS.
-->

DLL files may be explicitly loaded at run-time, a process referred to simply as ''run-time dynamic linking'' by Microsoft, by using the <code>LoadLibrary</code> (or <code>LoadLibraryEx</code>) API function. The <code>GetProcAddress</code> API function is used to look up exported symbols by name, and <code>FreeLibrary</code> – to unload the DLL. These functions are analogous to <code>dlopen</code>, <code>dlsym</code>, and <code>dlclose</code> in the [[POSIX]] standard API.

The procedure for explicit run-time linking is the same in any language that supports [[Function pointer|pointers to functions]], since it depends on the [[Software:Windows API|Windows API]] rather than language constructs.

===Delayed loading===
Normally, an application that is linked against a DLL’s import library will fail to start if the DLL cannot be found, because Windows will not run the application unless it can find all of the DLLs that the application may need. However an application may be linked against an import library to allow delayed loading of the dynamic library.<ref>
{{cite web
  | title = Linker Support for Delay-Loaded DLLs
  | publisher=Microsoft Corporation
  | url = https://msdn.microsoft.com/en-us/library/151kt790.aspx
  | access-date = 2009-07-11}}</ref>
In this case, the operating system will not try to find or load the DLL when the application starts; instead, a stub is included in the application by the linker which will try to find and load the DLL through <code>LoadLibrary</code> and <code>GetProcAddress</code> when one of its functions is called. If the DLL cannot be found or loaded, or the called function does not exist, the application will generate an [[Exception handling|exception]], which may be caught and handled appropriately. If the application does not handle the exception, it will be caught by the operating system, which will terminate the program with an error message.

The delayed loading mechanism also provides notification [[Hooking|hooks]], allowing the application to perform additional processing or error handling when the DLL is loaded and/or any DLL function is called.

==Compiler and language considerations==

=== Delphi    ===
In a source file, the keyword <code>library</code> is used instead of <code>program</code>. At the end of the file, the functions to be exported are listed in <code>exports</code> clause.

[[Delphi (IDE)|Delphi]] does not need <code>LIB</code> files to import functions from DLLs; to link to a DLL, the <code>external</code> keyword is used in the function declaration to signal the DLL name, followed by <code>name</code> to name the symbol (if different) or <code>index</code> to identify the index.

===Microsoft Visual Basic===
In [[Visual Basic]] (VB), only run-time linking is supported; but in addition to using <code>LoadLibrary</code> and <code>GetProcAddress</code> API functions, ''declarations'' of imported functions are allowed.

When importing DLL functions through declarations, VB will generate a run-time error if the <code>DLL</code> file cannot be found. The developer can catch the error and handle it appropriately.

When creating DLLs in VB, the IDE will only allow creation of ActiveX DLLs, however methods have been created<ref>{{cite web
  | last = Petrusha
  | first = Ron
  | title = Creating a Windows DLL with Visual Basic
  | publisher = O'Reilly Media
  | date = 2005-04-26
  | url = http://www.windowsdevcenter.com/pub/a/windows/2005/04/26/create_dll.html?page=1
  | access-date = 2009-07-11}}</ref> to allow the user to explicitly tell the linker to include a .DEF file which defines the ordinal position and name of each exported function. This allows the user to create a standard Windows DLL using Visual Basic (Version 6 or lower) which can be referenced through a "Declare" statement.

===C and C++===
Microsoft Visual C++ (MSVC) provides several extensions to standard [[C++]] which allow functions to be specified as imported or exported directly in the C++ code; these have been adopted by other Windows [[C (programming language)|C]] and C++ compilers, including Windows versions of [[Software:GNU Compiler Collection|GCC]]. These extensions use the attribute <code>__declspec</code> before a function declaration. Note that when C functions are accessed from C++, they must also be declared as <code>extern "C"</code> in C++ code, to inform the compiler that the C linkage should be used.<ref>[https://msdn.microsoft.com/en-us/library/0603949d.aspx MSDN], Using extern to Specify Linkage</ref>

Besides specifying imported or exported functions using <code>__declspec</code> attributes, they may be listed in IMPORT or EXPORTS section of the <code>DEF</code> file used by the project. The <code>DEF</code> file is processed by the linker, rather than the compiler, and thus it is not specific to C++.

DLL compilation will produce both <code>DLL</code> and <code>LIB</code> files. The <code>LIB</code> file (import library) is used to link against a DLL at compile-time; it is not necessary for run-time linking. Unless the DLL is a [[Component Object Model]] (COM) server, the <code>DLL</code> file must be placed in one of the directories listed in the PATH environment variable, in the default system directory, or in the same directory as the program using it. COM server DLLs are registered using regsvr32.exe, which places the DLL's location and its globally unique ID (GUID) in the registry. Programs can then use the DLL by looking up its GUID in the [[Software:Windows Registry|registry]] to find its location or create an instance of the COM object indirectly using its class identifier and interface identifier.

==Programming examples==

===Using DLL imports===
The following examples show how to use language-specific bindings to import symbols for linking against a DLL at compile-time.

====Delphi====

<syntaxhighlight lang="delphi">
{$APPTYPE CONSOLE}

program Example;

// import function that adds two numbers
function AddNumbers(a, b : Double): Double; StdCall; external 'Example.dll';

// main program
var
   R: Double;

begin
  R := AddNumbers(1, 2);
  Writeln('The result was: ', R);
end.
</syntaxhighlight>

====C====

{{mono|Example.lib}} file must be included (assuming that {{mono|Example.dll}} is generated) in the project<!--(Add Existing Item option for Project!)--> before static linking. The file {{mono|Example.lib}} is automatically generated by the compiler when compiling the DLL. Not executing the above statement would cause linking error as the linker would not know where to find the definition of <code>AddNumbers</code>. The DLL file {{mono|Example.dll}} may also have to be copied to the location where the executable would be generated by the following code:
<syntaxhighlight lang="c">
#include <stdio.h>
#include <windows.h>

// Import function that adds two numbers
extern "C" __declspec(dllimport) 
double AddNumbers(double a, double b);

int main(int argc, char* argv[]) {
    double result = AddNumbers(1, 2);
    printf("The result was: %f\n", result);
    return 0;
}
</syntaxhighlight>

===Using explicit run-time linking===
The following examples show how to use the run-time loading and linking facilities using language-specific Windows API bindings.

Note that all of the four samples are vulnerable to DLL preloading attacks, since example.dll can be resolved to a place unintended by the author (unless explicitly excluded the application directory goes ''before'' system library locations, and without <CODE>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode</CODE><ref>{{cite web |title=Dynamic-link library search order |url=https://msdn.microsoft.com/en-us/library/ms682586.aspx |website=Microsoft Developer Network |date=9 February 2023 |access-date=9 February 2023}}</ref>  or <CODE>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\CWDIllegalInDLLSearch</CODE><ref>{{cite web |title=A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm |url=https://support.microsoft.com/en-us/kb/2264107 |website=Microsoft Support}}</ref> the current working directory is looked up before the system library directories), and thus to a malicious version of the library. See the reference for Microsoft's guidance on safe library loading: one should use {{code|SetDefaultDllDirectories}} in {{code|kernel32}} to remove both the application directory and the current working directory from the DLL search path, or use {{code|SetDllDirectoryW}} in {{code|kernel32}} to remove the current working directory from the DLL search path.<ref>{{cite web |title=Secure loading of libraries to prevent DLL preloading attacks |url=https://support.microsoft.com/en-us/help/2389418/secure-loading-of-libraries-to-prevent-dll-preloading-attacks |website=Microsoft Support |access-date=28 October 2019}}</ref>

====Microsoft Visual Basic====
<syntaxhighlight lang="vbnet">
Option Explicit
Declare Function AddNumbers Lib "Example.dll" _
(ByVal a As Double, ByVal b As Double) As Double

Sub Main()
	Dim Result As Double
	Result = AddNumbers(1, 2)
	Debug.Print "The result was: " & Result
End Sub
</syntaxhighlight>

====Delphi====
<syntaxhighlight lang="delphi">
program Example;
  {$APPTYPE CONSOLE}
  uses Windows;
  var
  AddNumbers:function (a, b: integer): Double; StdCall;
  LibHandle:HMODULE;
begin
  LibHandle := LoadLibrary('example.dll');
  if LibHandle <> 0 then
    AddNumbers := GetProcAddress(LibHandle, 'AddNumbers');
  if Assigned(AddNumbers) then
    Writeln( '1 + 2 = ', AddNumbers( 1, 2 ) );
  Readln;
end.
</syntaxhighlight>

====C====
<syntaxhighlight lang="c">

#include <stdio.h>
#include <windows.h>

// DLL function signature
typedef double (*ImportedFunction)(double, double);

int main(int argc, char* argv[]) {
	ImportedFunction addNumbers;
	double result;
	HINSTANCE hinstLib;

	// Load DLL file
	hinstLib = LoadLibrary(TEXT("Example.dll"));
	if (!hinstLib) {
		printf("ERROR: unable to load DLL\n");
		return 1;
	}

	// Get function pointer
	addNumbers = (ImportedFunction) GetProcAddress(hinstLib, "AddNumbers");
	if (!addNumbers) {
		printf("ERROR: unable to find DLL function\n");
		FreeLibrary(hinstLib);
		return 1;
	}

	// Call function.
	result = addNumbers(1, 3);

	// Unload DLL file
	FreeLibrary(hinstLib);

	// Display result
	printf("The result was: %f\n", result);

	return 0;
}
</syntaxhighlight>

====Python====
[[File:UML ffi.svg|thumb|The Python interpreter uses the {{Mono|ctypes}} module which provides a  [[foreign function interface]] (FFI) which allows calls to functions in shared libraries.]]
The Python ctypes binding will use POSIX API on POSIX systems.<ref>{{cite web |title=ctypes — A foreign function library for Python |url=https://docs.python.org/3/library/ctypes.html |website=Python documentation |access-date=9 July 2025 |language=en}}</ref>
<syntaxhighlight lang="python">
import ctypes

my_dll = ctypes.cdll.LoadLibrary("Example.dll")

# The following "restype" method specification is needed to make
# Python understand what type is returned by the function.
my_dll.AddNumbers.restype = ctypes.c_double

p = my_dll.AddNumbers(ctypes.c_double(1.0), ctypes.c_double(2.0))

print("The result was:", p)
</syntaxhighlight>

==Component Object Model==
The [[Component Object Model]] (COM) defines a binary standard to host the implementation of [[Object (computer science)|objects]] in DLL and EXE files. It provides mechanisms to locate and version those files as well as a language-independent and machine-readable description of the interface. Hosting COM objects in a DLL is more lightweight and allows them to share resources with the client process. This allows COM objects to implement powerful back-ends to simple GUI front ends such as Visual Basic and ASP.  They can also be programmed from scripting languages.<ref>{{cite web|url=https://msdn.microsoft.com/en-us/library/ms680573.aspx|title=Component Object Model (COM)|first=Michael|last=Satran|website=msdn.microsoft.com|date=21 August 2020 }}</ref>

==DLL hijacking==
Due to a [[Vulnerability (computing)|vulnerability]] commonly known as DLL hijacking, DLL spoofing, DLL preloading or binary planting, many programs will load and execute a malicious DLL contained in the same folder as a data file opened by these programs.<ref>{{Cite web |last1=Björklund |first1=Andreas |last2=Klövstedt |first2=Johan |last3=Westergren |first3=Sven |title=DLL Spoofing in Windows |url=https://www.it.uu.se/edu/course/homepage/sakdat/ht05/assignments/pm/programme/DLL_Spoofing_in_Windows.pdf |url-status=live |archive-url=https://web.archive.org/web/20231107162030/https://www.it.uu.se/edu/course/homepage/sakdat/ht05/assignments/pm/programme/DLL_Spoofing_in_Windows.pdf |archive-date=November 7, 2023 |access-date=November 7, 2023 |website=Information Technology Department, Uppsala University}}</ref><ref>{{cite web|url=http://blogs.msdn.com/b/david_leblanc/archive/2008/02/20/dll-preloading-attacks.aspx|title=DLL Preloading Attacks|website=msdn.com|access-date=25 March 2018}}</ref><ref>{{cite web|url=http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx|title=More information about the DLL Preloading remote attack vector|website=technet.com|access-date=25 March 2018}}</ref><ref>{{cite web|url=http://blogs.technet.com/b/srd/archive/2010/08/31/an-update-on-the-dll-preloading-remote-attack-vector.aspx|title=An update on the DLL-preloading remote attack vector|website=technet.com|access-date=25 March 2018}}</ref> The vulnerability was discovered by Georgi Guninski in 2000.<ref>{{cite web|url=http://www.guninski.com/officedll.html|title=Double clicking on MS Office documents from Windows Explorer may execute arbitrary programs in some cases|website=www.guninski.com|access-date=25 March 2018}}</ref>
In August 2010 it gained worldwide publicity after ACROS Security rediscovered it and many hundreds of programs were found vulnerable.<ref>{{cite web|url=http://www.binaryplanting.com/|title=Binary Planting - The Official Web Site of a Forgotten Vulnerability . ACROS Security|website=www.binaryplanting.com|access-date=25 March 2018}}</ref>
Programs that are run from unsafe locations, i.e. user-writable folders like the ''Downloads'' or the ''Temp'' directory, are almost always susceptible to this vulnerability.<ref>{{Cite web |last=Dormann |first=Will |date=September 4, 2008 |title=Carpet Bombing and Directory Poisoning |url=https://insights.sei.cmu.edu/blog/carpet-bombing-and-directory-poisoning/ |url-status=live |archive-url=https://web.archive.org/web/20231107161710/https://insights.sei.cmu.edu/blog/carpet-bombing-and-directory-poisoning/ |archive-date=November 7, 2023 |access-date=November 7, 2023 |website=Carnegie Mellon University - SEI Blog}}</ref><ref>{{cite web|url=https://www.theregister.co.uk/2015/11/03/dev_to_mozilla_please_dump_ancient_windows_install_processes/|title=Dev to Mozilla: Please dump ancient Windows install processes|website=theregister.co.uk|access-date=25 March 2018}}</ref><ref>{{cite web|url=https://www.gpg4win.org/news-20151125.html|title=Gpg4win - Security Advisory Gpg4win 2015-11-25|website=www.gpg4win.org|access-date=25 March 2018}}</ref><ref>{{cite web|url=https://service.mcafee.com/FAQDocument.aspx?lc=1033&id=TS102462|title=McAfee KB - McAfee Security Bulletin: Security patch for several McAfee installers and uninstallers (CVE-2015-8991, CVE-2015-8992, and CVE-2015-8993) (TS102462)|website=service.mcafee.com|access-date=25 March 2018}}</ref><ref>{{cite web|url=https://www.f-secure.com/en/web/labs_global/fsc-2015-4|title=fsc-2015-4 - F-Secure Labs|website=www.f-secure.com|access-date=25 March 2018|archive-url=https://web.archive.org/web/20170731055540/https://www.f-secure.com/en/web/labs_global/fsc-2015-4|archive-date=31 July 2017|url-status=dead}}</ref><ref>{{cite web|url=https://community.rapid7.com/community/infosec/blog/2015/12/21/scannow-dll-search-order-hijacking-vulnerability-and-deprecation|title=ScanNow DLL Search Order Hijacking Vulnerability and Deprecation|date=21 December 2015|website=rapid7.com|access-date=25 March 2018}}</ref><ref>{{cite web|url=http://seclists.org/oss-sec/2016/q1/58|title=oss-sec: CVE-2016-1281: TrueCrypt and VeraCrypt Windows installers allow arbitrary code execution with elevation of privilege|first=VeraCrypt|last=Team|website=seclists.org|access-date=25 March 2018}}</ref>

==See also==
* [[Software:Dependency Walker|Dependency Walker]] {{endash}} utility which displays exported and imported functions of DLL and EXE files
* {{Annotated link|Dynamic library}}
* {{Annotated link|Library (computing)}}
* {{Annotated link|Linker (computing)}}
* {{Annotated link|Loadable kernel module}}
* {{Annotated link|Loader (computing)}}
* {{Annotated link|Moricons.dll}}
* {{Annotated link|Shared library}}
* {{Annotated link|.exe}}

==References==
{{Reflist}}
* Hart, Johnson. ''Windows System Programming Third Edition''. Addison-Wesley, 2005. {{ISBN|0-321-25619-0}}.
* Rector, Brent et al. ''Win32 Programming''. Addison-Wesley Developers Press, 1997. {{ISBN|0-201-63492-9}}.

==External links==
* [https://msdn.microsoft.com/en-us/library/3y1sfaz2.aspx dllexport, dllimport] on MSDN
* [https://msdn.microsoft.com/en-us/library/ms682589.aspx Dynamic-Link Libraries] on MSDN
* [https://msdn.microsoft.com/en-us/library/ff919712.aspx Dynamic-Link Library Security] on MSDN
* [https://msdn.microsoft.com/en-us/library/ms682586.aspx Dynamic-Link Library Search Order] on MSDN
* [https://support.microsoft.com/en-us/kb/2533623 Microsoft Security Advisory: Insecure library loading could allow remote code execution]
* [https://support.microsoft.com/en-us/kb/815065 What is a DLL?] on Microsoft support site
* [https://msdn.microsoft.com/en-us/library/ms682599.aspx Dynamic-Link Library Functions] on MSDN
* [http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx Microsoft Portable Executable and Common Object File Format Specification]
* [https://web.archive.org/web/20120215074145/http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/pecoff_v8.docx Microsoft specification for dll files]
* [https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html Carpet Bombing and Directory Poisoning]
* [http://blogs.technet.com/b/srd/archive/2009/04/14/ms09-014-addressing-the-safari-carpet-bomb-vulnerability.aspx MS09-014: Addressing the Safari Carpet Bomb vulnerability]
* [http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx More information about the DLL Preloading remote attack vector]
* [http://blogs.technet.com/b/srd/archive/2010/08/31/an-update-on-the-dll-preloading-remote-attack-vector.aspx An update on the DLL-preloading remote attack vector]
* [http://blogs.technet.com/b/srd/archive/2014/05/13/load-library-safely.aspx Load Library Safely]

{{Windows Components}}

{{DEFAULTSORT:Dynamic-Link Library}}
[[Category:Computer file formats]]
[[Category:Computer libraries]]
[[Category:Windows administration]]
[[Category:Articles with example C code]]

{{Sourceattribution|Dynamic-link library}}