Questions about DLL load order

548 views Asked by At

As we know, for implicitly linked DLLs of an executable, at load time, they will be loaded into memory by the loader, and the loader will calls their entry point to initialize them as well. This is a linear process - they are loaded one by one, and be initialized one by one. So the most important thing is the order, the order affects a lot of things.

Q1: The initialize order can be different from the load order, is this true ?

Q2: The load order is affected by the import table, is this true ?

Q3: The initialize order of independent DLLs is affected by the import table - A DLL may be initialized first because it appears first, is this true ?

1

There are 1 answers

0
amanjiang On

"The process is created in a suspended state with the CREATE_SUSPENDED flag to CreateProcess. Detours then modifies the image of the application binary in the new process to include the specified DLL as its first import. Execution in the process is then resumed. When execution resumes, the Windows process loader will first load the target DLL and then any other DLLs in the application's import table, before calling the application entry point."

I found this important message on the document of Microsoft Detours. So for Q2 and Q3, yes, it's true. I will do more research on this topic.