Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

In what order are locations searched to load referenced DLLs?

Tags:

.net

dll

I know that the .NET framework looks for referenced DLLs in several locations

  • Global assembly cache (GAC)
  • Any private paths added to the AppDomain
  • The current directory of the executing assembly

What order are those locations searched? Is the search for a DLL ceased if a match is found or does it continue through all locations (and if so, how are conflicts resolved)?

Also, please confirm or deny those locations and provide any other locations I have failed to mention.

like image 919
Anthony Mastrean Avatar asked Sep 08 '08 15:09

Anthony Mastrean


People also ask

What is DLL search order?

dll , it'll search through the Program Files directory before looking elsewhere. Adversaries mostly abuse this search order process by moving legitimate system binaries into non-standard directories that include malicious DLLs that are named after legitimate ones.

How do I find the location of a DLL?

Dll files are located in C:\Windows\System32.

How are DLLs loaded?

DLL files may be explicitly loaded at run-time, a process referred to simply as run-time dynamic linking by Microsoft, by using the LoadLibrary (or LoadLibraryEx ) API function. The GetProcAddress API function is used to look up exported symbols by name, and FreeLibrary – to unload the DLL.

Where does an executable look for DLLs?

If no path is specified for the DLL and the DLL is not listed in the Windows registry, Windows searches for the DLL in the following locations in order: The .exe file directory. The current directory. The %SystemRoot%\SYSTEM32 directory.


2 Answers

Assembly loading is a rather elaborate process which depends on lots of different factors like configuration files, publisher policies, appdomain settings, CLR hosts, partial or full assembly names, etc.

The simple version is that the GAC is first, then the private paths. %PATH% is never used.

It is best to use Assembly Binding Log Viewer (Fuslogvw.exe) to debug any assembly loading problems.

EDIT http://msdn.microsoft.com/en-us/library/aa720133.aspx explains the process in more detail.

like image 85
Lars Truijens Avatar answered Sep 25 '22 06:09

Lars Truijens


I found an article referencing the MSDN article on DLL search order that says

For managed code dependencies, the Global Assembly Cache always prevails; the local assembly in application directory will not be picked up if there is an existing (or newer with policy) copy in the GAC.

Considering this, I guess the MSDN list is correct with one addition

0. Global assembly cache
like image 43
Anthony Mastrean Avatar answered Sep 26 '22 06:09

Anthony Mastrean