Content deleted Content added
Guy Harris (talk | contribs) →NTDLL.DLL: Use {{cite conference}} for a conference paper. |
m →External links: HTTP to HTTPS for Blogspot |
||
| (10 intermediate revisions by 2 users not shown) | |||
Line 14:
=== NTDLL.DLL ===
NTDLL.DLL exports the Windows [[Native API]]. The Native API is the interface used by user-mode components of the operating system that must run without support from [[Win32]] or other API subsystems. Most of this API is implemented in '''NTDLL.DLL''' and at the upper edge of [[ntoskrnl.exe]] (and its variants), and the majority of exported symbols within these libraries are prefixed '''Nt''', for example '''NtDisplayString'''. Native APIs are also used to implement many of the "kernel APIs" or "base APIs" exported by KERNEL32.DLL.<ref name="Eldad-2011-pp68-69">{{cite book|author=Eilam, Eldad|title=Reversing: Secrets of Reverse Engineering|publisher=John Wiley & Sons|year=2011|isbn=978-1-118-07976-8|pages=68–69|url=https://books.google.com/books?id=_78HnPPRU_oC&pg=PT68}}</ref><ref name="nativeapplications">{{cite web|url=
Applications that are [[Linker (computing)|linked]] directly against this library are said to use the '''native subsystem'''; the primary reason for their existence is to perform tasks that must run early in the system startup sequence before the Win32 subsystem is available. An obvious but important example is the creation of the Win32 subsystem process, [[csrss.exe]]. Before the csrss.exe process exists, no Win32 processes may be created, therefore the process that creates it (Smss.exe, the "session manager") must use the native subsystem. [[csrss.exe]] itself is such an application.
Line 20:
Despite having an ".exe" file extension, native applications cannot be executed by the user (or any program in the Win32 or other subsystems). An example is the '''autochk.exe''' binary that runs '''[[chkdsk]]''' during the system initialization "Blue Screen"<!--do not link this to "Blue Screen of Death (BSOD)"! This is not it!-->. Other prominent examples are the services that implement the various subsystems, such as [[csrss.exe]].
Unlike [[Win32]] applications, native applications instantiate within the Kernel runtime code ([[ntoskrnl.exe]]) and so they must have a different entry point ('''NtProcessStartup''', rather than '''(w)(Win)MainCRTStartup''' as is found in a Win32 application),<ref name="nativeapplications"/> obtain their command-line arguments via a pointer to an in-memory structure, manage their own memory using the '''Rtl''' heap API, (which the Win32 heap APIs are just wrappers around—no real difference there) and return execution with a call to '''RtlExitUserProcess''' (as opposed to '''ExitProcess'''). A common library linked with Native applications is nt.lib, which contains startup code for Native applications, similar to how the C runtime provides startup code for Win32 apps.<ref
== Win32 API ==
Line 54:
=== COMDLG32.DLL ===
'''COMDLG32.DLL''', the Common Dialog Box Library, implements a wide variety of Windows dialog boxes intended to perform what Microsoft deems 'common application tasks'. Starting with the release of Windows Vista, Microsoft considers the "Open" and "Save as" dialog boxes provided by this library as deprecated and replaced by the 'Common Item Dialog API'.<ref>{{Cite web|url=https://
=== WS2_32.DLL ===
Line 70:
== Other APIs ==
=== SHSCRAP.DLL ===
'''SHSCRAP.DLL''' is part of the [[Object Linking and Embedding|Object Linking and Embedding (OLE)]] mechanism. It implements support for [[Shell Scrap Object File|shell scrap file]]s, which are automatically created when you drag selected content from an OLE-capable application into an Explorer window or desktop,<ref>{{cite web |url=https://support.microsoft.com/en-us/kb/138275/ |title=WD: What is a Scrap (.shs) file? |work=Microsoft Knowledge Base |url-status=dead |archive-date=2015-08-11 |archive-url=https://web.archive.org/web/20150811125202/https://support.microsoft.com/en-us/kb/138275/}}</ref> but you can also use the [[Object Packager]] to create them. They can then be dragged into another OLE-capable application.
This functionality was removed from Windows Vista (and therefore later versions) to improve security and rid the operating system of generally unused functionality.<ref name="scrap_the_scraps">{{cite web|url=https://
=== WINMM.DLL ===
Line 93:
=== UCRT ===
With Version 14.0 ([[Visual_Studio|Visual Studio 2015]]), most of the C/C++ runtime was moved into a new DLL, UCRTBASE.DLL, which conforms closely with C99.<ref name="upgrade your code">{{cite web | title=Upgrade your code to the Universal CRT | url=https://learn.microsoft.com/en-us/cpp/porting/upgrade-your-code-to-the-universal-crt?view=msvc-170 }}</ref> '''Universal C Run Time''' ('''UCRT''') from Windows 10 onwards become a component part of Windows,<ref name="upgrade your code" /> so every compiler (either non MS, like [[GNU_Compiler_Collection|GCC]] or [[Clang]]/[[LLVM]]) can link against UCRT.<ref>{{cite web | title=MSYS2 - Environments | url=https://www.msys2.org/docs/environments/ }}</ref> Additionally, C/C++ programs using UCRTBASE.DLL need to link against another new DLL, the Visual C++ Runtime. At Version 14.0, this was VCRUNTIME140.DLL.<ref>{{cite web | url=https://
Source code for runtime libraries is included in Visual C++<ref>{{cite web | url=
=== Other runtime libraries ===
Line 124:
* [https://web.archive.org/web/20060315213024/http://www.sysinternals.com/Information/NativeApi.html Native API reference]
* [http://undocumented.ntinternals.net/ Unofficial website that documents most of the Native API methods]
* [
{{Windows Components}}
| |||