This article needs attention from an expert in Microsoft Windows. Please add a reason or a talk parameter to this template to explain the issue with the article. |
Like most modern operating systems, Microsoft Windows supports shared libraries, collections of code which can be used by multiple processes while only being loaded once into memory. Windows terms its shared libraries Dynamic-link libraries (DLL's).
Most core Windows functionality is contained within Native Applications and a set of DLL's, which together provide the various subsystems in which code can run (Win32, POSIX, the virtual DOS machine, etc.).
Hal.dll
Hal.dll is the core of Windows' Hardware Abstraction Layer, which allows applications to access devices in the system without knowledge of the specific protocol used by any one device.
Although drivers for most hardware are contained in external files, core drivers (which are required to support the kernel) are compiled into Hal.dll. Different sets of drivers may be selected depending on whether the system uses multiple processors, the presence of ACPI or an APIC, etc. On earlier versions of Windows NT, the CPU's architecture was also considered.
Msvcrt.dll
Msvcrt.dll (the Microsoft Visual C++ Run-Time) provides basic services, such as string comparison, memory allocation, etc., to programs compiled with Visual C++, versions 4.2 to 6.
In older versions of Windows, programs which linked against Msvcrt.dll were expected to install a copy in the System32 folder, but this contributed to DLL Hell. Newer versions of the operating system include the file to circumvent this problem.
Ntdll.dll (Native API)
The Native API (with capitalized N) is the publicly mostly undocumented application programming interface used internally by the Windows NT family of operating systems produced by Microsoft, with only about 25 of its 250 functions described in the Windows NT Device Driver Kit.[1] Most of them are in ntdll.dll and ntoskrnl.exe (and its variants); the majority of exported symbols within these libraries are prefixed Nt, e.g. NtDisplayString.
Applications that are linked directly against this library are known as Native Applications; the primary reason for their existence is to perform low-level tasks such as direct disk I/O that cannot be achieved through the documented Windows API. An example is the autochk binary that runs chkdsk during the system initialisation "Blue Screen". Other prominent examples are the services that implement the respective subsystems, such as csrss.exe.
Unlike Win32 Applications, Native Applications instantiate within the Kernel runtime code (ntoskrnl.exe) and so must manage their own memory using the Rtl heap API, obtain their command-line arguments via a pointer to an in-memory structure, and return execution with a call to NtProcessTerminate (as opposed to ExitProcess). They also have a different entry point of NtProcessStartup as opposed to (w)(Win)MainCRTStartup to distinguish them from normal Windows binaries. Although native applications have a ".exe" file extension, they cannot be started from the Win32 or other subsystems.[1]
Despite their API being undocumented, Native Applications can be built using the Windows Driver Development Kit; many AntiVirus and other utility software vendors incorporate Native Applications within their products, usually to perform some boot-time task that cannot be carried out in Userspace.
Ordinary Windows applications are not linked directly against this library, but to one or more of the "client" libraries with well-documented APIs; This is to retain portability across Windows Platforms among other reasons.
Shscrap.dll
shscrap.dll implements support for shell scrap files. These are automatically created when you drag selected content from an OLE-capable application into an Explorer window (or onto the Desktop)[2], but you can also use the Object Packager to create them. They can then be dragged into another OLE-capable application. Scrap (.shs) files are sometimes used by viruses because they can contain a wide variety of files (including executable code), and the file extension is not shown even when "Hide file extensions from known file types" is disabled.[3]
User32.dll
user32.dll is a DLL that implements the Windows User API Client Library. It is a core file for several versions of the Microsoft Windows operating system. If this file is damaged or deleted, the operating system will not work.
Viruses
Because this file is a core Windows DLL, several viruses attempt to infect it. Some of these viruses are:
See also
Notes
- ^ a b Russinovich, M: Inside Native Windows Applications, SysInternals Information
- ^ WD: What is a Scrap (.shs) file? - Microsoft Knowledge Base
- ^ VBS.Stages.A - Symantec.com
External links
- API calls list - USER32.DLL - Tips for using the User API Client Library with Visual Basic
- Native API reference
- Unofficial website that documents most of the Native API methods