{"id":23593,"date":"2008-02-04T10:00:00","date_gmt":"2008-02-04T10:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2008\/02\/04\/dll-forwarding-is-not-the-same-as-delay-loading\/"},"modified":"2008-02-04T10:00:00","modified_gmt":"2008-02-04T10:00:00","slug":"dll-forwarding-is-not-the-same-as-delay-loading","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20080204-00\/?p=23593","title":{"rendered":"DLL forwarding is not the same as delay-loading"},"content":{"rendered":"

\nAs I noted earlier,\n\nwhen you\ncreate a forwarder entry in an export table,\nthe corresponding target DLL is not loaded until somebody\nlinks to the forwarder entry<\/a>.\nIt looks like\n\nsome people misread this statement to suggest some sort of\ndelay-loading<\/a>\nso I’m going to state it again with an example in mind in the\nhopes of clearing up any confusion\n(and risking creating more confusion than I clear up).\n<\/p>\n

\nSuppose that you have a DLL called A.DLL<\/code> that has a forwarder\nentry to B.DLL<\/code>:\n<\/p>\n

\n; A.DEF\nEXPORTS\n  Dial = B.Call\n  Pour\n  Refill\n<\/pre>\n
\nThis specifies that if somebody wants the function Dial<\/code>\nfrom A.DLL<\/code>, they will actually get the function\nCall<\/code> from B.DLL<\/code>.\nThe delay-load-like behavior is that B.DLL<\/code> is not\nloaded until somebody asks for the Dial<\/code> function.\n<\/p>\n
\nI will use the notation DLLNAME!FunctionName<\/code> to mean\n“the function FunctionName<\/code> from the DLL named\nDLLNAME<\/code>.”\nThis is the notation used by the ntsd<\/code> debugger.\n<\/p>\n
\nConsider this program:\n<\/p>\n
\nPOURME.EXE\n Imports from A.DLL\n  Pour\n  Refill\n<\/pre>\n
\nThe POURME<\/code> program will not result in B.DLL<\/code>\nbeing loaded since it never links to A!Dial<\/code>.\nOf course A.DLL<\/code> will get loaded because the program\nwants the functions A!Pour<\/code> and A!Refill<\/code>.\nThis is the “delay-load-like behavior” I mentioned in the original\nentry:\nIf you don’t call a function that forwards to B.DLL<\/code>,\nthen B.DLL<\/code> won’t get loaded.\n<\/p>\n
\nAlternative, you could have used this method to do the forwarding:\n<\/p>\n
\n; A2.DEF\nEXPORTS\n Dial\n Pour\n Refill\n\/* a2.c *\/\n\/\/ Forward Dial to B!Call\nHRESULT Dial()\n{\n return Call();\n}\n<\/pre>\n
\nThis pseudo-forwarder is not a forwarder in the linker sense;\nit is an attempt to emulate linker forwarding in code.\nNow let’s look at the corresponding alternate POURME<\/code> program:\n<\/p>\n
\nPOURME2.EXE\n Imports from A2.DLL\n  Pour\n  Refill\n<\/pre>\n
\nEven though POURME2<\/code> doesn’t call A2!Dial<\/code>,\nthe file B.DLL<\/code> will nevertheless be loaded when\nPOURME2<\/code> runs because A2.DLL<\/code> contains\na dependency on B.DLL<\/code> in its own import table:\n<\/p>\n
\n; dump of headers of A2.DLL\n Imports from B.DLL\n  Call\n<\/pre>\n
\nLoading A2.DLL<\/code> will cause B.DLL<\/code> to be\nloaded since B.DLL<\/code> is listed as one of A2<\/code>‘s\ndependencies.\n<\/p>\n
\nCommenter bruteforce got off on the wrong foot by calling the above\nmechanism a delay-loading feature.\n<\/p>\n
\nI tried to take advantage of the delay-loading feature\ndescribed above for the forwarder DLLs…\n<\/p><\/blockquote>\n
\nThe mechanism is not delay-loading and I never said that it was.\nThe quasi-delay-load behavior is that a forwarded-to DLL is not\nloaded until somebody links to it.\nThe term delay-loading typically is used to apply to delaying the\nload of a module until a function in that module is called.\nBut import resolution happens at load time, not run time.\n<\/p>\n
\nCommenter bruteforce tried to create a forwarder to a nonexistent\nfunction, and then tried to link to the forwarder DLL.\nAs we saw above, this triggers an attempt to resolve the forward\nby loading the forwarded-to DLL and looking for the function.\nIf this fails, then the original import request is declared to have\nfailed.\nThis all happens as part of the import resolution process.\nAnd as we saw many years ago,\n\nWin32 fails a module load if an import cannot be resolved<\/a>.\nSince the forwarder cannot be resolved, the load fails.\nImport forwarding functionality is completely unsuitable for\nfunctions whose presence you wish to detect and respond to at runtime.\nAs with all imports, an import failure is considered a fatal error.\nIf you want delay-loading, then you need to do delay-loading.\nForwarding is not delay-loading.<\/p>\n","protected":false},"excerpt":{"rendered":"
As I noted earlier, when you create a forwarder entry in an export table, the corresponding target DLL is not loaded until somebody links to the forwarder entry. It looks like some people misread this statement to suggest some sort of delay-loading so I’m going to state it again with an example in mind in […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-23593","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
As I noted earlier, when you create a forwarder entry in an export table, the corresponding target DLL is not loaded until somebody links to the forwarder entry. It looks like some people misread this statement to suggest some sort of delay-loading so I’m going to state it again with an example in mind in […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/23593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=23593"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/23593\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=23593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=23593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=23593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}