Questions regarding loading the DLL into the process address space

Question

Well, I read several Matt Pietrek articles on Portable Executable (PE) files, for example:

• In-Depth Look in Win32 Portable executable format, part 1 and part 2
• MSJ article on linkers
• MSJ COFF format article

In addition, I read several other sources on this subject. I either ignore some parts, or the questions there are not answered.

So here are the questions:

It is known that when loading EXE the Windows loader reads the list of imported DLLs from the table of import addresses (IAT) and loads them into the address space of the process.

• The process address space is virtual space. Perhaps the DLL is already loaded into some kind of physical space. This happens for DLLs such as KERNEL32.dllor USER32.dll. What is the relationship between physical and virtual address? Does the loader only load pages and copy DLLs or make links?

• If the DLL is not loaded, does Loader load the entire DLL or only the necessary functions? For example, if you used the function foo()from bar.dll, does the loader load everything bar.dllinto the address space of the process? Or does it just load the code foointo the process address space?

• , EXE MessageBox() USER32.dll, %WINDIR%\system32\user32.dll. USER32.dll, , EXE , , MessageBox MessageBox?

Answer 1

Re 1: , . , , . DLL , kernel32.dll. ( ).

Re 2: "" , , . DLL, . , Windows . , DLL .

Re 3: , . , user32. , Win32, . API- - , , Detours Microsoft Labs .

Windows Internals edition 5 - , .

Answer 2

1) NT PE . NT , DLL ( ).

2) Loader DLL .

3) , user32.dll , EXE. . . WinAPI, user32.dll, dll .