DLL

Dynamic link library

DLL overview

DLL is the abbreviation of Dynamic Link Library, meaning dynamic link library. In Windows, many applications are not a complete executable file, they are divided into some relatively independent dynamic link libraries, that is, DLL files, placed in the system. When we execute a certain program, the corresponding DLL file will be called. An application can have multiple DLL files, and a DLL file can also be shared by several applications. Such a DLL file is called a shared DLL file.

It allows programs to share the code and other resources necessary to perform special tasks. Larger applications are composed of many modules, these modules respectively complete relatively independent functions, and they cooperate with each other to complete the work of the entire software system. There may be some modules whose functions are more general and will still be used when constructing other software systems. When constructing a software system, if the source code of all modules is statically compiled into the entire application EXE file, there will be some problems: One disadvantage is that the size of the application is increased, it will occupy more disk space, the program runs It also consumes a large amount of memory space, resulting in a waste of system resources; another disadvantage is that when writing a large EXE program, you must adjust and compile all source code each time you modify and rebuild, increasing the complexity of the compilation process , Is also not conducive to periodic unit testing.

The Windows system platform provides a completely different and more effective programming and running environment. You can create independent program modules as smaller DLL files and compile and test them separately. At runtime, the system will only load these DLL modules into the memory space if they really want to call these DLL modules. This approach not only reduces the size of the EXE file and the need for memory space, but also allows these DLL modules to be used by multiple applications at the same time. Windows itself implements some major system functions in the form of DLL modules.

Generally speaking, DLL is a kind of disk file. It can be DLL with .dll, .DRV, .FON, .SYS and many system files with .EXE extension. It consists of global data, service functions, and resources. It is loaded into the virtual space of the calling process at runtime and becomes part of the calling process. If there is no conflict with other DLLs, the file is usually mapped to the same address in the process virtual space. The DLL module contains various exported functions for providing services to the outside world. A DLL can have its own data segment, but it does not have its own stack. It uses the same stack mode as the application that called it; a DLL has only one instance in memory; the DLL implements code encapsulation; DLL preparation and specific programming language It has nothing to do with the compiler.

In the Win32 environment, each process copies its own read/write global variables. If you want to share memory with other processes, you must use a memory-mapped file or declare a shared data segment. The stack memory required by the DLL module is allocated from the stack of the running process. Windows matches the process function call with the exported function of the DLL file when loading the DLL module. The operation of the Windows operating system on the DLL is simply to map the DLL into the virtual address space of the process that needs it. Any objects (including variables) created by the code in the DLL function are owned by the thread or process that called it.

Several calling methods

1. Static calling method: the compilation system completes the loading of the DLL and the encoding of the DLL unloading at the end of the application program (if there are other programs using the DLL, the Windows application record for the DLL is decremented by 1 until all related programs have finished the DLL It is only released when it is used, it is simple and practical, but it is not flexible enough to meet general requirements.

Implicit call: You need to add the .LIB file generated when the dynamic link library is generated to the application project. When you want to use the function in the DLL, you only need to explain. Implicit calls do not need to call LoadLibrary() and FreeLibrary(). When a programmer creates a DLL file, the linker will automatically generate a corresponding LIB import file. This file contains the symbolic name and optional identification number of each DLL exported function, but does not contain the actual code. LIB files are compiled into application projects as replacement files for DLLs.

When the programmer compiles and generates the application program through static linking, the calling function in the application program matches the exported symbols in the LIB file, and these symbols or identification numbers enter the generated EXE file. The corresponding DL L file name (but not the full path name) is also included in the LIB file, and the linker stores it inside the EXE file.

When the DLL file needs to be loaded while the application is running, Windows finds and loads the DLL based on this information, and then implements the dynamic link to the DLL function through the symbolic name or identification number. All DLL files called by the application will be loaded into the memory when the application EXE file is loaded. The executable program is linked to an input library file (.LIB file) that contains information about DLL output functions. The operating system loads the DLL when the executable program is loaded. The executable program directly calls the output function of the DLL through the function name, and the calling method is the same as other functions inside the program.

2. Dynamic calling method: It is the programmer who loads and unloads the DLL with API functions to achieve the purpose of calling the DLL. It is more complicated to use, but can use the memory more effectively. It is an important method when programming large applications.

Explicit call:

Refers to the use of LoadLibrary or AfxLoadLibrary provided by MFC in the application to explicitly call in the dynamic link library made by itself. The file name of the dynamic link library is the parameter of the above two functions, and then use GetProcAddress() to obtain the desired Introduced functions. Since then, you can call this imported function as if it were a function customized by this application. Before the application exits, you should use FreeLibrary or AfxFreeLibrary provided by MFC to release the dynamic link library. Directly call Win32's LoadLibary function, and specify the path of the DLL as a parameter. LoadLibary returns the HINSTANCE parameter, which the application uses when calling the GetProcAddress function. The GetProcAddress function converts the symbolic name or identification number to an internal address in the DLL. The programmer can decide when the DLL file is loaded or not, and the explicit link determines which DLL file to load at runtime. Programs that use DLLs must load (LoadLibrary) before use to load a DLL to obtain a handle to a DLL module, and then call the GetProcAddress function to obtain a pointer to the output function. The DLL (FreeLibrary) must be unloaded before exiting.

Because DLL has the characteristics of small memory, good editing and so on, many computer viruses are DLL format files. It cannot be run alone.

Dynamic link libraries usually cannot be run directly, nor can they receive messages. They are independent files that contain functions that can be called by executable programs or other DLLs to accomplish a certain task. It only works when other modules call functions in the dynamic link library.

Memory management

In Win32, DLL files are organized according to sections. Each fragment has its own attributes, such as writable or read-only, executable (code) or non-executable (data), etc.

DLL code segments are usually shared by processes that use this DLL; that is, they occupy a place in physical memory and do not appear in the page file. If the physical memory occupied by the code segment is reclaimed, its contents will be discarded, and then directly reloaded from the DLL file if necessary.

Unlike the code segment, the data segment of the DLL is usually private; that is, each process that uses the DLL has its own copy of the DLL data. Alternatively, the data segment can be set to share, allowing interprocess communication through this shared memory area. However, because user permissions cannot be applied to this shared DLL memory, this will create a security hole; that is, a process can destroy shared data, which will cause other shared processes to be abnormal. For example, a process using a guest account may destroy other processes running on privileged accounts in this way. This is an important reason to avoid using shared fragments in DLLs.

When a DLL is compressed by an executable packer such as UPX, all its code segments are marked as readable and writable and are not shared. Code segments that can be read and written, similar to private data segments, are private to each process and are backed up by the page file. In this way, compressed DLLs will increase both memory and disk space consumption, so shared DLLs should avoid using compressed DLLs.

Error when finding the DLL file address: C:\WINDOWS\system32\****.dll (**** is the file name you cannot find)

Start-Run-msconfig-Start-find an option similar to what you said ****-Uncheck-OK, then

1, start-run-input: regedit, and then press Enter

2. Select "My Computer", then click "File"-"Export"-just name "Save". The purpose of this is to back up the registry to avoid timely recovery after misuse. The recovery method is to find the file you just saved, double-click it, and then select "Allow Import".

3. Select "My Computer", press the F3 key, then enter "****", click "Find Next", after you find it, you must check whether it is the ****.dll file, because the file name you gave Incomplete, if confirmed, select "Delete" for the right key of the item. "At this time, you can enter ****.dll to search, and after the result comes out, you need to look at the numerical value behind, you can't just look at the file name, as long as there is a file with ****.dll on it, no matter whether it is written on the side or not (Such as: ****.dll, load), all must be deleted!"

4. Then press the F3 key-delete, until the prompt "No corresponding option found".

5. Restart the computer to see if the system has any problems.

Note, if there are other serious problems, please restore the registry.

Optimization system approach

Force DLL files to hand over memory resources

Many applications need to call certain DLL files at startup. These DLL files often occupy certain memory resources, but unfortunately, when the application is used and exits the system, the DLL files that have been called will not follow. The program closes and automatically surrenders the memory resources they occupy, which is easy to cause the waste of memory resources, and as more applications are running, the more system memory resources are consumed, which ultimately affects the overall operating efficiency of the system . Is there any way to force outdated DLL files to hand over the memory resources they occupy, so as to ensure that the system memory space is always in a "clean" state? The answer is yes, we can force the DLL file to hand over the memory resources as follows:

Click the "Start"/"Run" command in sequence. In the pop-up system operation dialog box, enter the string command "regedit" and click the "OK" button to open the system's registry editing interface;

In the registry editing interface, find the registry branch HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer in the window area on the right side of the corresponding "Explorer" subkey, check whether there is "AlwaysUnloadDLL" string key value Figure, if not, you can right-click the blank space in the right window area, and execute the "New" and "String Value" commands in order from the pop-up shortcut menu, and then the newly created string Set the value name to "AlwaysUnloadDLL", then double-click the "AlwaysUnloadDLL" key value with the mouse, directly enter the number "1" in the "Value Data" text box on the interface, and click the "OK" button, and finally refresh the system registration Table, so that those outdated DLL files can be forced to hand over the system memory resources they once occupied.

Force DLL files to hand over space resources

After frequently installing and uninstalling applications, some DLL files in the system will become useless junk files, but these junk files will still occupy the system's hard disk space resources, and more and more junk DLL files will grow over time Will consume more and more hard disk space resources. To this end, we can delete the useless garbage DLL files through the following steps:

Click the "Start"/"Run" command in sequence. In the pop-up system operation dialog box, enter the string command "regedit" and click the "OK" button to open the system's registry editing interface;

Use the mouse to expand the registry branches HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/SharedDlls one by one. In the right window area corresponding to the "SharedDlls" subkey, we can see all the DLL calls in the current system. If the data of a DLL file is displayed as "0", it means that no application uses the DLL file, then the DLL file is a useless garbage file, and record the names of these useless DLL files one by one;

Next, return to the Windows system desktop, and click the "Start" / "Search" / "File or Folder" command in sequence, and then in the pop-up system search file dialog box, enter the useless DLL file recorded earlier, and then click Click the "Search" button to find the specific location of the useless DLL file, and then temporarily transfer these found DLL files to another location, and let the system run for a few more days to see if the system can run normally, if the system can still run normally , Then we can really delete those useless DLL files from the hard disk, which can effectively save hard disk space resources.

Borrow DLL file to solve system running error

Since many application DLL files are shared, once an application is uninstalled, the shared DLL file may also be uninstalled with it. As a result, other applications cannot find the shared DLL when running File error. When unfortunately encounter such a fault phenomenon, we may wish to resolve various common system faults quickly and effectively by registering and uninstalling the DLL file.

WINXP/WIN2000 improves safety and performance by modifying DLL

In the system's group policy and registry, we can modify some key values to optimize our system and strengthen the security of the operating system. However, for functions such as restricting downloading and prohibiting file deletion, we cannot complete the above operations, which can only be achieved by modifying the system DLL file. At present, by modifying the DLL file of the system, we can realize the functions of prohibiting file deletion, prohibiting IE downloading, prohibiting IE save as, prohibiting file opening mode and so on.

Function of some DLL files in the system

1. The prototype of the library file DLL structure required by Browselc.dll IE is it

2. Shdoclc.dll system window and settings, such as deleting files, renaming

3. Shell32.dll system window and settings, such as deleting files, renaming

4. Cryptui.dll IE control download and prompt dialog program

How to modify DLL files

1. Download DLL file modification tool EXESCOPE6.0-6.3 or 6.4 tool

2. Obtain the link files of Browsec.dll, Shdoclc.dll, Shell32.dll, and Cryptui.dll. When looking for these files, it is best to mount the hard drives of other machines in this machine, and then start and copy these files with the operating system of this machine.

3. When modifying the DLL file, open the key value and disable the key value to be modified in the dialog box on the right. Do not delete it for future recovery.

DLL file modification cheats

1. Modification method to prohibit downloading: Open Shdoclc.dll to modify the resource-dialog box --4416, and disable the 4416 key value.

2. Prohibit adding web pages to favorites, open Shdoclc.dll to modify resources-dialog box-21400, just disable the key.

3. Prohibit malicious web page loading control, modify the Cryptui.dll file, you need to modify 5 places at the same time to completely prohibit resources - dialog - 130 resources - dialog - 230 resources - dialog - 4101 resources - -Dialog---4104 Resources--Dialog---4107 will be changed to disabled with the corresponding key values in each dialog.

4. It is forbidden for the system to delete the file to modify Shell32.dll. This file needs to be modified in 5 places to prohibit the system to delete the file. Resources--Dialog---1011 Resources--Dialog---1012 Resources--Dialog---1013 Resources--Dialog---1021 Resources--Dialog---1022 The above five addresses The key value is disabled!

5. It is forbidden to rename the file, modify shell32.dll, there are two places to modify the resource-dialog box--1018 resource-dialog box--1019, modify the corresponding key values of the above two places to disable it!

6. Prohibit running the menu, modify shell32.dll, set the resource-dialog box-1018 key value to disabled.

7. Prohibit the system file from being moved to modify shell32.dll, you need to modify 4 local resources--dialog box---1014 resource--dialog box---1015 resource--dialog box---1016 resource--dialog box--- 1017

8. Prohibit saving the target as, modify the Shdoclc.dll file, you need to modify 3 local resources--Menu--258---257 Resources--Menu--258---252 Resources--Menu--24641--2268 here During the modification, we will delete the corresponding key values. After opening the key value, there is a delete in the right-click menu. In the resource-menu-24641-2268, there are multiple key values, please delete them one by one.

9. Prohibit the custom folder option to modify the Shell32.dll file, you need to modify the following 4 local resources--Menu--215---28719 Resources--Menu--216---28719 Resources--Menu--217--- 28719 Resources--Menu--216---28719 Find the above four key values, you just need to delete them instead of disabling.

10. Prohibit the IE folder option, modify the Browsec.dll file, you need to modify 3 key-value resources - menu - 263 (please delete here if there are multiple) --- 41251 (delete) resources - menu - 266 (there are also many Please delete)---41329 (Delete) Resources--Menu--268---41251 (Delete) Among the above three key values, there are multiple individual key values, please delete them one by one.

11. Prohibit 98 file sharing controls, modify Msshrui.dll, you need to modify two local resources --- dialog box - 1 --- AutoRadioButton resource --- dialog box - 30 --- AutoRadioButton will be the above two places The key value can be disabled. Other options can be modified according to your needs. Find the corresponding function key value, disable the unnecessary functions.

12. Prohibit the way of opening the file, modify Url.dll, you need to modify two places 　 resources --- dialog box --- 7000 resources --- dialog box --- 7005 can disable the above two key values.

13. It is forbidden to change the system desktop, modify Shdoc401.dll, there are 2 places where resources need to be modified-dialog box-29952-PushButton: browse resources-dialog box-29952-PushButton: pattern will be above Key values in two places can be disabled.

14. Prohibit system folder customization, modify Shd401lc.dll, there are 2 places need to modify 　 resources --- dialog box --- 29957 resources --- dialog box --- 29958 Disable the above two key values.

15. Prohibit file saving path and open, modify Comdlg32.dll, there are two places need to modify 　 resources --- dialog box --- 1547 resources --- dialog box --- 1548 can disable the above two key values.