参考自： 维基百科 https://en.wikipedia.org/wiki/Microsoft_Windows_library_files
Microsoft Windows library files
From Wikipedia, thefree encyclopedia
Jump to navigationJump to search
hideThis article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages)
|
The Microsoft Windows operatingsystem supports a form of shared libraries known as "dynamic-link libraries", which arecode libraries that can be used by multiple processes while only one copy isloaded into memory. This articleprovides an overview of the core libraries that are included with every modernWindows installation, on top of which most Windows applications are built.
Contents
[hide]
o 4.1MSVCRT.DLL,MSVCP*.DLL and CRTDLL.DLL
Internal components[edit]
HAL.DLL is a kernel-mode library file and it cannot be used by anyuser-mode program. NTDLL.DLL is only used by some programs, but it is adependency of most Win32 libraries used by programs.
Hal.dll[edit]
The Windows HardwareAbstraction Layer (HAL) is implemented in Hal.dll.[1] The HALimplements a number of functions that are implemented in different ways bydifferent hardware platforms, which in this context, refers mostly to the chipset. Other components inthe operating system can then callthese functions in the same way on all platforms, without regard for the actualimplementation.
For example, responding to an interrupt is quite different on a machinewith an AdvancedProgrammable Interrupt Controller (APIC) than on onewithout. The HAL provides a single function for this purpose that works withall kinds of interrupts by various chipsets, so that other components need notbe concerned with the differences.
The HAL is loaded into kernel address space and runs in kernel mode, soroutines in the HAL cannot be called directly by applications, and no user modeAPIs correspond directly to HAL routines. Instead, the HAL provides servicesprimarily to the Windows executive and kernel and to kernel mode devicedrivers. Although drivers for most hardware are contained in other files,commonly of file type .sys, a few core drivers are compiled into Hal.dll.
Kernel mode device drivers for devices on buses such as PCI and PCI Express directly callroutines in the HAL to access I/O ports and registersof their devices. The drivers use HAL routines because different platforms mayrequire different implementations of these operations. The HAL implements theoperations appropriately for each platform, so the same driver executable filecan be used on all platforms using the same CPU architecture,and the driver source file can be portable across all architectures.
On x86 systems, there are several different HAL fileson the installation media. The Windows installation procedure determines whichones are appropriate for the current platform and copies it to the hard drive,renaming it to Hal.dll if necessary. Among the criteria for this selection are:the presence of an ACPI-compatible BIOS,the presence of an APIC, and whether ornot multiple processors are present and enabled. (The multiple cores of a multi-core CPU, and even the"logical processors" implemented by a hyperthreading CPU, all countas "processors" for this purpose.) On x86-64 and Itanium platforms thereis just one possible Hal.dll for each CPU architecture.
NTDLL.DLL[edit]
NTDLL.DLL exports the Windows Native API. The Native API isthe interface used by user-mode components of the operating system that mustrun without support from Win32 or other APIsubsystems. Most of this API is implemented in NTDLL.DLL andat the upper edge of ntoskrnl.exe (and itsvariants), and the majority of exported symbols within these libraries areprefixed Nt, for example NtDisplayString. Native APIs arealso used to implement many of the "kernel APIs" or "baseAPIs" exported by KERNEL32.DLL.[2][3][4] The largemajority of Windows applications do not call NTDLL.DLL directly.[5]
Applications that are linked directlyagainst this library are known as native applications[dubious – discuss]; the primaryreason for their existence is to perform tasks that must run early in thesystem startup sequence before the Win32 subsystem is available. An obvious butimportant example is the creation of the Win32 subsystem process, csrss.exe. Before the csrss.exeprocess exists, no Win32 processes may be created, therefore the process thatcreates it (Smss.exe, the "session manager") must be a nativeapplication. csrss.exe itself is anative application.
Despite having an ".exe" file extension, native applicationscannot be executed by the user (or any program in the Win32 or othersubsystems). An example is the autochk.exe binary thatruns chkdsk during the systeminitialization "Blue Screen". Other prominent examples are theservices that implement the various subsystems, such as csrss.exe.
Unlike Win32 applications,native applications instantiate within the Kernel runtime code (ntoskrnl.exe) and so they musthave a different entry point (NtProcessStartup, rather than (w)(Win)MainCRTStartup asis found in a Win32 application),[3] obtain theircommand-line arguments via a pointer to an in-memory structure, manage theirown memory using the Rtl heap API, (which the Win32 heap APIsare just wrappers around—no real difference there) and return execution with acall to NtTerminateProcess (as opposed to ExitProcess).A common library linked with Native applications is nt.lib, which containsstartup code for Native applications, similar to how the C runtime providesstartup code for Win32 apps.[6]
Though most of the API is undocumented, Native Applications can be builtusing the Windows Driver Development Kit; many antivirus software and otherutility software vendors incorporate Native Applications within their products,usually to perform some boot-time task that cannot be carried out in userspace.[citation needed]
Win32 API[edit]
Further information: Windows API
The libraries in this section each implement various subsets of the Win32API.
KERNEL32.DLL[edit]
KERNEL32.DLL exposes to applications most of the Win32 base APIs, suchas memory management, input/output (I/O) operations, process and thread creation, andsynchronization functions. Many of these are implemented within KERNEL32.DLL bycalling corresponding functions in the native API, exposed byNTDLL.DLL.[7][not in citationgiven]
GDI32.DLL[edit]
GDI32.DLL exports Graphics DeviceInterface (GDI) functions that perform primitive drawingfunctions for output to video displays and printers. It is used, for example,in the XP version of Paint. Applications call GDI functions directly to performlow-level drawing (line, rectangle, ellipse), text output, font management, andsimilar functions.[7][8]
Initially, GDI supported 16 and 256 color EGA/VGA display cards and monochrome printers. Thefunctionality has expanded over the years, and now includes support for thingslike TrueType fonts, alpha channels, and multiple monitors.[9]
USER32.DLL[edit]
Further information: Windows USER
USER32.DLL implements the Windows USER component that createsand manipulates the standard elements of the Windows user interface, such asthe desktop, windows, and menus. It thus enables programs to implement a graphical userinterface (GUI) that matches the Windows look and feel.Programs call functions from Windows USER to perform operations such ascreating and managing windows, receiving window messages (which are mostly userinput such as mouse and keyboard events, but also notifications from theoperating system), displaying text in a window, and displaying message boxes.
Many of the functions in USER32.DLL call upon GDI functions exported byGDI32.DLL to do the actual rendering of the various elements of the userinterface. Some types of programs will also call GDI functions directly toperform lower-level drawing operations within a window previously created viaUSER32 functions.
COMCTL32.DLL[edit]
COMCTL32.DLL implements a wide variety of standard Windowscontrols, such as File Open, Save, and Save As dialogs, progress bars, and listviews. It calls functions from both USER32.DLL and GDI32.DLL to create andmanage the windows for these UI elements, place various graphic elements withinthem, and collect user input.
COMDLG32.DLL[edit]
COMDLG32.DLL, the Common Dialog Box Library, imlements a wide varietyof Windows dialog boxes intended to perform what Microsoft deeems 'commonapplication tasks'. Starting with the release of Windows Vista, Microsoftconsiders the "Open" and "Save as" dialog boxes provided bythis library as deprecated and replaced by the 'Common Item Dialog API'.[10]
WS2_32.DLL[edit]
WS2_32.DLL implements the Winsock API, whichprovides TCP/IP networking functions and provides partial, broken compatibilitywith other network APIs. wsock.dlland wsock32.dll areolder versions for Win3.11 and Win95 compatibility.
ADVAPI32.DLL[edit]
ADVAPI32.DLL provides security calls and functions formanipulating the registry.
NETAPI32.DLL[edit]
NETAPI32.DLL provides functions for querying and managingnetwork interfaces.
Other APIs[edit]
SHSCRAP.DLL[edit]
SHSCRAP.DLL is part of the Object Linkingand Embedding (OLE) mechanism. It implements support for shellscrap files, which are automatically created when you drag selected contentfrom an OLE-capable application into an Explorer window or desktop,[11] but you can alsouse the Object Packager to createthem. They can then be dragged into another OLE-capable application.
This functionality was removed from Windows Vista (and therefore laterversions) to improve security and rid the operating system of generally unusedfunctionality.[12] Scrap (.shs)files have been used by viruses because they can contain a wide variety offiles (including executable code), and the file extension is not shown evenwhen "Hide file extensions from known file types" is disabled.[13] Thefunctionality can be restored by copying registry entries and the DLL from a Windows XP system.[14]
WINMM.DLL[edit]
WINMM.DLL provides access to the original WinMM audioAPI.
Runtime libraries[edit]
MSVCRT.DLL, MSVCP*.DLLand CRTDLL.DLL[edit]
MSVCRT.DLL is the C standard library for the Visual C++ (MSVC) compiler fromversion 4.2 to 6.0. It provides programs compiled by these versions of MSVCwith most of the standard C library functions. These include stringmanipulation, memory allocation, C-style input/output calls, and others. MSVCP*.DLL isthe corresponding C++ library.
It has shipped with Windows versions since Windows 95 OSR2 for use by otherWindows components; earlier versions shipped with the CRTDLL.DLL libraryinstead. In older versions of Windows, programs which linked against MSVCRT.DLLwere expected to install a compatible copy in the System32 folder, but thiscontributed to DLL Hell because manyinstallers failed to check the library version against the installed versionbefore replacing it.
Versions of MSVC before 4.0 and from 7.0 to 13.0 used differently namedDLLs for each version (MSVCR20.DLL, MSVCR70.DLL, MSVCR71.DLL, MSVCP110.DLL,etc.). Applications are required to install the appropriate version,[15] and Microsoftoffers Visual C++ Redistributable packages for this purpose,though Windows typically comes with one version already installed.
With Version 14.0, most of the C/C++ runtime was moved into a new DLL,UCRTBASE.DLL. However, C/C++ programs using UCRTBASE.DLL are forced to linkagainst another new DLL, the VCRuntime, whose name continues to change witheach version of MSVC (e.g. VCRUNTIME140.DLL).
Source code for runtime libraries is included in Visual C++[16] for referenceand debugging (e.g. in C:\ProgramFiles\Microsoft Visual Studio 11.0\VC\crt\src).
This runtime library is used by programs written in Visual C++ and a fewother compilers (e.g. MinGW). Some compilershave their own runtime libraries.
Other runtime libraries[edit]
· ATL*.DLL – Active TemplateLibrary
· MFC*.DLL – MicrosoftFoundation Classes
· MSVBVM60.DLL – Visual Basic 6.0 Virtual Machine(Visual Basic.NET programsrequire .NET Framework instead)
· VCOMP*.DLL – Microsoft OpenMP runtime
· VCRUNTIME*.DLL – Microsoft VCRuntime, for MSVC 14.0+
· MSVCIRT.DLL – Microsoft C++ Library, contains thedeprecated C++ classes from <iostream.h> (note the fileextension!) for MS C 9 and 10 (MSVC 2.x, 4.x) (Back then, the draft C++Standard Library was integrated within MSVCRT.DLL. It was split up with therelease of Visual C++ 5.0)
.NET Framework libraries[edit]
Programs written in C#, Visual Basic.NET, C++/CLI and other .NETlanguages require the .NET Framework. It has manylibraries (one of them is mscorlib.dll – MultilanguageStandard Common Object Runtime Library, formerly Microsoft Common ObjectRuntime Library[17]) and so-calledassemblies (e.g. System.Windows.Forms.dll).
See also[edit]
· Listof Microsoft Windows components
References[edit]
1. Jump up^ Blunden, Bill (2009). The Rootkit Arsenal: Escape and Evasion in the DarkCorners of the System. Jones & Bartlett Learning.p. 101. ISBN 978-1-59822-061-2.
2. Jump up^ Eilam, Eldad (2011). Reversing: Secrets of Reverse Engineering. John Wiley &Sons. pp. 68–69. ISBN 978-1-118-07976-8.
3. ^ Jump up to:a b "Inside Native Windows Applications". Archived from the original on 2010-09-12.Retrieved 2011-12-14.
4. Jump up^ Russinovich, Mark A. & Solomon, David A.(2009). Windows® Internals. O'Reilly Media.p. 136. ISBN 978-0-7356-3796-2.
5. Jump up^ Marceau, Carla & Stillerman, Matt(2006). "Modular behavior profiles in systems with shared libraries".In Neng, Peng et al. Information and Communications Security: 8thInternational Conference, ICICS 2006 – Raleigh, NC, USA, December 4–7,2006 – proceedings. Springer. p. 371. ISBN 978-3-540-49496-6.
6. Jump up^ https://technet.microsoft.com/en-us/sysinternals/bb897447.aspx
7. ^ Jump up to:a b Visual Studio Developer Center: Identifying Functions inDLLs
8. Jump up^ See also, the documentation for the Wine implementation of GDI32.DLL: WineAPI: gdi32.dll
9. Jump up^ Yuan, Feng (2001). Windows graphics programming: Win32 GDI and DirectDraw. Prentice HallProfessional. p. 71. ISBN 978-0-13-086985-2.
10. Jump up^ "Common Dialog Box Library (Windows)". msdn.microsoft.com.Retrieved 2017-10-25.
11. Jump up^ "WD:What is a Scrap (.shs) file?". Microsoft Knowledge Base.
12. Jump up^ Raymond Chen. "Windows Confidential: Scrapping the Scraps".Retrieved 2011-12-14.
13. Jump up^ "VBS.Stages.A". symantec.com.
14. Jump up^ "How to open SHS files".Retrieved 2011-12-14.
15. Jump up^ "C Run-Time Libraries".Retrieved 2011-12-14.
16. Jump up^ http://msdn.microsoft.com/en-us/library/aa296413(v=vs.60).aspx
17. Jump up^ http://weblogs.asp.net/mreynolds/archive/2004/01/31/65551.aspx
External links[edit]
Wikibooks has a book on the topic of: Windows Programming/GDI and Drawing |
· API calls list (USER32.DLL) – Tips forusing the User API Client Library with Visual Basic
· API calls list (KERNEL32.DLL) – Tips forusing the Kernel API Client Library with Visual Basic
· Unofficial website that documents most of the Native APImethods
· Retrieving the KERNEL32.DLL base address
· Microsoft application programming interfaces
Navigation menu
· Notlogged in
· Talk
· Log in
· Article
· Talk
· Read
· Edit
Search
窗体顶端
窗体底端
· Contents
Interaction
· Help
Tools
Print/export
In other projects
Languages
· Español
· 한국어
· 中文
· This page was last edited on 11 June 2018, at12:19 (UTC).
· Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By usingthis site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademarkof the WikimediaFoundation, Inc., a non-profit organization.
109万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
