Dynamic Link Library
A DLL (Dynamic Link Library) is a shared library containing code and data used by multiple Windows programs simultaneously. FileDex offers reference information only — no DLLs are loaded or executed.
Compiled binary library. Format conversion requires recompilation.
Common questions
How do I view the functions exported by a DLL?
Use dumpbin /exports, Dependency Walker, or the free tool Dependencies (a modern Dependency Walker replacement) to list all exported symbols. These tools read the PE export table without loading the DLL into your process. For .NET DLLs, ILSpy or dotPeek can decompile the assembly to view types and methods.
What does the 'DLL not found' error mean and how do I fix it?
The error means Windows could not locate a required DLL in any directory in the search order. Check that the DLL exists in the application's directory or in System32. Installing the appropriate Visual C++ Redistributable package resolves most missing DLL errors for third-party applications.
Can a DLL contain a virus?
Yes. A DLL executes code within the process that loads it, with the same privilege level. Malicious DLLs can perform any action the host process is authorized to do, including accessing files, network resources, and the registry. Only load DLLs from verified, digitally signed sources.
What is the difference between a DLL and an EXE?
Both use the PE format, but a DLL cannot run independently — it must be loaded by a host process. The COFF header's Characteristics field has the IMAGE_FILE_DLL flag set in DLLs but not in EXEs. DLLs expose an export table for other programs to call, while EXEs typically have an empty export table and define only an entry point.
Does FileDex convert DLL files?
No. DLL files contain compiled code and cannot be meaningfully converted to other formats. FileDex provides technical reference information about the DLL format only, with no file uploads or server-side processing.
What makes .DLL special
Dynamic Link Libraries allow multiple running programs to share a single copy of compiled code in memory, reducing disk and RAM usage across the system. A DLL uses the same PE format as an EXE, distinguished by the IMAGE_FILE_DLL flag (0x2000) in the COFF header's Characteristics field. The entry point, when present, is a DllMain function called during process attach, detach, and thread events.
Continue reading — full technical deep dive
Loading and Search Order
When a process calls LoadLibrary or the loader resolves an import table entry, Windows follows a specific search order: KnownDLLs registry entries first, then the application directory, the System32 directory, the 16-bit system directory, the Windows directory, and finally each directory in the PATH environment variable. Windows maintains a KnownDLLs registry key listing approximately 50 system DLLs that are loaded exclusively from System32, making them immune to DLL search-order hijacking. This protection covers critical libraries like kernel32.dll, ntdll.dll, and user32.dll.
Export Mechanisms
DLLs expose functions through an export table that maps names or ordinal numbers to code addresses. Named exports are resolved by string lookup, while ordinal exports use a numeric index into the export address table. COM DLLs expose specific well-known exports — DllGetClassObject, DllRegisterServer, DllCanUnloadNow — that the COM runtime calls to manage object creation and lifetime. .NET assembly DLLs contain IL bytecode with a CLR header; the export table points to the mscoree.dll bootstrap shim.
DLL Hell and Side-by-Side Assemblies
Before Windows XP, applications sharing a common DLL in System32 could break when one installer replaced the shared version with an incompatible update. Microsoft solved this with SxS (Side-by-Side) assemblies stored in C:\Windows\WinSxS, where multiple versions coexist and application manifests declare exact version dependencies. The WinSxS directory often grows to several gigabytes because it holds every version of every SxS-managed component.
Delay-Load Imports
Delay-load imports let a program defer DLL loading until the first call to a function from that library. The linker generates a stub that calls __delayLoadHelper2 on first invocation, which loads the DLL and patches the import address table in place. If the DLL is never called, it is never loaded — useful for optional features or rarely used code paths.
Technical reference
- MIME Type
application/vnd.microsoft.portable-executable- Magic Bytes
4D 5AMZ DOS header (Mark Zbikowski initials).- Developer
- Microsoft
- Year Introduced
- 1985
- Open Standard
- No
MZ DOS header (Mark Zbikowski initials).
Binary Structure
Shares the PE format with EXE files: DOS MZ header (4D 5A), PE signature at e_lfanew offset, COFF header with IMAGE_FILE_DLL flag set (bit 13), optional header, and section table. The export directory in the optional header's data directories points to the export address table, name pointer table, and ordinal table.
Attack Vectors
- arbitrary code execution
- privilege escalation
- supply chain compromise
- DLL search-order hijacking by placing a malicious DLL in a higher-priority search path
- DLL proxying where a wrapper DLL forwards legitimate calls while injecting additional code
Mitigation: FileDex does not execute, load, or parse these files. Reference page only.