{"id":30473,"date":"2006-07-19T10:00:24","date_gmt":"2006-07-19T10:00:24","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2006\/07\/19\/exported-functions-that-are-really-forwarders\/"},"modified":"2006-07-19T10:00:24","modified_gmt":"2006-07-19T10:00:24","slug":"exported-functions-that-are-really-forwarders","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20060719-24\/?p=30473","title":{"rendered":"Exported functions that are really forwarders"},"content":{"rendered":"<p>\nLast time, we saw how\n<a HREF=\"http:\/\/blogs.msdn.com\/oldnewthing\/archive\/2006\/07\/18\/669668.aspx\">\nthe way Win32 exports functions<\/a>\nis pretty\nmuch the same as the way 16-bit Windows exports functions,\nbut with a change in emphasis\nfrom ordinal-based exports to name-based exports.\nThis change in emphasis is not expressed anywhere in the file format;\nboth 16-bit and 32-bit DLLs can export either by name or by ordinal\n(or by both), but the designers of Win32 were biased in spirit\nin favor of name-only exports.\n<\/p>\n<p>\nBut there is a new type of exported function in Win32, known as a forwarder.\nA forwarder looks just like a regular exported function, except that\nthe entry in the ordinal export table says, &#8220;Oh, I&#8217;m not really a\nfunction in this DLL. I&#8217;m really a function in that DLL over there.&#8221;\nFor example,\nif you do a\n<code>link \/dump \/exports kernel32.dll<\/code>, you&#8217;ll see a line\nlike this:\n<\/p>\n<pre>\n151   EnterCriticalSection (forwarded to NTDLL.RtlEnterCriticalSection)\n<\/pre>\n<p>\nThis means that if a program links to\n<code>KERNEL32.EnterCriticalSection<\/code>,\nthe loader silently\nredirects it to <code>NTDLL.RtlEnterCriticalSection<\/code>.\nForwarders are a handy way to accommodate functionality moving from\none DLL to another.\nThe old DLL can continue to export the function but forward it to\nthe new DLL.\n<\/p>\n<p>\nThe forwarding trick is actually better than just having a stub\nfunction in the old DLL that calls the function in the new DLL,\nbecause the stub function creates a dependency between the old DLL and the\nnew one.\n(After all, the old DLL needs to be linked to the new DLL in order\nto call it!)\nWith a forwarder, however, the new DLL is not loaded unless somebody\nactually asks for the forwarded function from the old DLL.\nAs a result, you don&#8217;t pay for the new DLL until somebody actually wants it.\n<\/p>\n<p>\nOkay, we saw that with forwarders, Win32 has diverged from 16-bit Windows,\nbut when it comes to imports, it&#8217;s a whole new ball game.\nWe&#8217;ll pick up the story next time.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last time, we saw how the way Win32 exports functions is pretty much the same as the way 16-bit Windows exports functions, but with a change in emphasis from ordinal-based exports to name-based exports. This change in emphasis is not expressed anywhere in the file format; both 16-bit and 32-bit DLLs can export either by [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-30473","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>Last time, we saw how the way Win32 exports functions is pretty much the same as the way 16-bit Windows exports functions, but with a change in emphasis from ordinal-based exports to name-based exports. This change in emphasis is not expressed anywhere in the file format; both 16-bit and 32-bit DLLs can export either by [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/30473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=30473"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/30473\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=30473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=30473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=30473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}