{
	"id": "52996f6e-ac22-44f3-8086-efc0c9b0c12b",
	"created_at": "2026-04-06T00:19:29.812069Z",
	"updated_at": "2026-04-10T03:20:29.329978Z",
	"deleted_at": null,
	"sha1_hash": "00e2326d2d2311cce46399ea721b1258dfc0ba26",
	"title": "Dynamic-link library search order - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 83577,
	"plain_text": "Dynamic-link library search order - Win32 apps\r\nBy stevewhims\r\nArchived: 2026-04-05 17:05:49 UTC\r\nIt's common for multiple versions of the same dynamic-link library (DLL) to exist in different file system\r\nlocations within an operating system (OS). You can control the specific location from which any given DLL is\r\nloaded by specifying a full path. But if you don't use that method, then the system searches for the DLL at load\r\ntime as described in this topic. The DLL loader is the part of the operating system (OS) that loads DLLs and/or\r\nresolves references to DLLs.\r\nFactors that affect searching\r\nHere are some special search factors that are discussed in this topic—you can consider them to be part of the DLL\r\nsearch order. Later sections in this topic list these factors in the appropriate search order for certain app types,\r\ntogether with other search locations. This section is just to introduce the concepts, and to give them names that\r\nwe'll use to refer to them later in the topic.\r\nDLL redirection. For details, see Dynamic-link library redirection.\r\nAPI sets. For details, see Windows API sets.\r\nSide-by-side (SxS) manifest redirection—desktop apps only (not UWP apps). You can redirect by using\r\nan application manifest (also known as a side-by-side application manifest, or a fusion manifest). For\r\ndetails, see Manifests.\r\nLoaded-module list. The system can check to see whether a DLL with the same module name is already\r\nloaded into memory (no matter which folder it was loaded from).\r\nKnown DLLs. If the DLL is on the list of known DLLs for the version of Windows on which the\r\napplication is running, then the system uses its copy of the known DLL (and the known DLL's dependent\r\nDLLs, if any). For a list of known DLLs on the current system, see the registry key\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\KnownDLLs .\r\nIf a DLL has dependencies, then the system searches for the dependent DLLs as if they were loaded by using only\r\ntheir module names. That's true even if the first DLL was loaded by specifying a full path.\r\nSearch order for packaged apps\r\nWhen a packaged app loads a packaged module (specifically, a library module—a .dll file) by calling the\r\nLoadPackagedLibrary function, the DLL must be in the package dependency graph of the process. For more\r\ninformation, see LoadPackagedLibrary. When a packaged app loads a module by other means, and doesn't\r\nspecify a full path, the system searches for the DLL and its dependencies at load time as described in this section.\r\nWhen the system searches for a module or its dependencies, it always uses the search order for packaged apps;\r\neven if a dependency is not packaged app code.\r\nhttps://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN\r\nPage 1 of 5\n\nStandard search order for packaged apps\r\nThe system searches in this order:\r\n1. DLL redirection.\r\n2. API sets.\r\n3. Desktop apps only (not UWP apps). SxS manifest redirection.\r\n4. Loaded-module list.\r\n5. Known DLLs.\r\n6. The package dependency graph of the process. This is the application's package plus any dependencies\r\nspecified as \u003cPackageDependency\u003e in the \u003cDependencies\u003e section of the application's package manifest.\r\nDependencies are searched in the order they appear in the manifest.\r\n7. The folder the calling process was loaded from (the executable's folder).\r\n8. The system folder ( %SystemRoot%\\system32 ).\r\nIf a DLL has dependencies, then the system searches for the dependent DLLs as if they were loaded with just their\r\nmodule names (even if the first DLL was loaded by specifying a full path).\r\nAlternate search order for packaged apps\r\nIf a module changes the standard search order by calling the LoadLibraryEx function with\r\nLOAD_WITH_ALTERED_SEARCH_PATH, then the search order is the same as the standard search order\r\nexcept that in step 7 the system searches the folder that the specified module was loaded from (the top-loading\r\nmodule's folder) instead of the executable's folder.\r\nSearch order for unpackaged apps\r\nWhen an unpackaged app loads a module and doesn't specify a full path, the system searches for the DLL at load\r\ntime as described in this section.\r\nImportant\r\nIf an attacker gains control of one of the directories that's searched, then it can place a malicious copy of the DLL\r\nin that folder. For ways to help prevent such attacks, see Dynamic-link library security.\r\nStandard search order for unpackaged apps\r\nThe standard DLL search order used by the system depends on whether or not safe DLL search mode is enabled.\r\nSafe DLL search mode (which is enabled by default) moves the user's current folder later in the search order. To\r\ndisable safe DLL search mode, create the HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session\r\nManager\\SafeDllSearchMode registry value, and set it to 0. Calling the SetDllDirectory function effectively\r\ndisables safe DLL search mode (while the specified folder is in the search path), and changes the search order as\r\ndescribed in this topic.\r\nIf safe DLL search mode is enabled, then the search order is as follows:\r\nhttps://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN\r\nPage 2 of 5\n\n1. DLL Redirection.\r\n2. API sets.\r\n3. SxS manifest redirection.\r\n4. Loaded-module list.\r\n5. Known DLLs.\r\n6. Windows 11, version 21H2 (10.0; Build 22000), and later. The package dependency graph of the\r\nprocess. This is the application's package plus any dependencies specified as \u003cPackageDependency\u003e in the\r\n\u003cDependencies\u003e section of the application's package manifest. Dependencies are searched in the order\r\nthey appear in the manifest.\r\n7. The folder from which the application loaded.\r\n8. The system folder. Use the GetSystemDirectory function to retrieve the path of this folder.\r\n9. The 16-bit system folder. There's no function that obtains the path of this folder, but it is searched.\r\n10. The Windows folder. Use the GetWindowsDirectory function to get the path of this folder.\r\n11. The current folder.\r\n12. The directories that are listed in the PATH environment variable. This doesn't include the per-application\r\npath specified by the App Paths registry key. The App Paths key isn't used when computing the DLL\r\nsearch path.\r\nIf safe DLL search mode is disabled, then the search order is the same except that the current folder moves from\r\nposition 11 to position 8 in the sequence (immediately after step 7. The folder from which the application loaded).\r\nAlternate search order for unpackaged apps\r\nTo change the standard search order used by the system, you can call the LoadLibraryEx function with\r\nLOAD_WITH_ALTERED_SEARCH_PATH. You can also change the standard search order by calling the\r\nSetDllDirectory function.\r\nNote\r\nThe standard search order of the process will also be affected by calling the SetDllDirectory function in the\r\nparent process before the start of the current process.\r\nIf you specify an alternate search strategy, then its behavior continues until all associated executable modules have\r\nbeen located. After the system starts processing DLL initialization routines, the system reverts to the standard\r\nsearch strategy.\r\nThe LoadLibraryEx function supports an alternate search order if the call specifies\r\nLOAD_WITH_ALTERED_SEARCH_PATH, and the lpFileName parameter specifies an absolute path.\r\nThe standard search strategy begins (after the initial steps) in the calling application's folder.\r\nThe alternate search strategy specified by LoadLibraryEx with\r\nLOAD_WITH_ALTERED_SEARCH_PATH begins (after the initial steps) in the folder of the\r\nexecutable module that LoadLibraryEx is loading.\r\nThat's the only way in which they differ.\r\nhttps://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN\r\nPage 3 of 5\n\nIf safe DLL search mode is enabled, then the alternate search order is as follows:\r\nSteps 1-6 are the same as the standard search order.\r\n7. The folder specified by lpFileName.\r\n8. The system folder. Use the GetSystemDirectory function to retrieve the path of this folder.\r\n9. The 16-bit system folder. There's no function that obtains the path of this folder, but it is searched.\r\n10. The Windows folder. Use the GetWindowsDirectory function to get the path of this folder.\r\n11. The current folder.\r\n12. The directories that are listed in the PATH environment variable. This doesn't include the per-application\r\npath specified by the App Paths registry key. The App Paths key isn't used when computing the DLL\r\nsearch path.\r\nIf safe DLL search mode is disabled, then the alternate search order is the same except that the current folder\r\nmoves from position 11 to position 8 in the sequence (immediately after step 7. The folder specified by\r\nlpFileName).\r\nThe SetDllDirectory function supports an alternate search order if the lpPathName parameter specifies a path.\r\nThe alternate search order is as follows:\r\nSteps 1-6 are the same as the standard search order.\r\n7. The folder from which the application loaded.\r\n8. The folder specified by the lpPathName parameter of SetDllDirectory.\r\n9. The system folder.\r\n10. The 16-bit system folder.\r\n11. The Windows folder.\r\n12. The directories listed in the PATH environment variable.\r\nIf the lpPathName parameter is an empty string, then the call removes the current folder from the search order.\r\nSetDllDirectory effectively disables safe DLL search mode while the specified folder is in the search path. To\r\nrestore safe DLL search mode based on the SafeDllSearchMode registry value, and restore the current folder to\r\nthe search order, call SetDllDirectory with lpPathName as NULL.\r\nSearch order using LOAD_LIBRARY_SEARCH flags\r\nYou can specify a search order by using one or more LOAD_LIBRARY_SEARCH flags with the\r\nLoadLibraryEx function. You can also use LOAD_LIBRARY_SEARCH flags with the\r\nSetDefaultDllDirectories function to establish a DLL search order for a process. You can specify additional\r\ndirectories for the process DLL search order by using the AddDllDirectory or SetDllDirectory functions.\r\nThe directories that are searched depend on the flags specified with SetDefaultDllDirectories or\r\nLoadLibraryEx. If you use more than one flag, then the corresponding directories are searched in this order:\r\n1. LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR. The folder that contains the DLL is searched. This\r\nfolder is searched only for dependencies of the DLL to be loaded.\r\nhttps://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN\r\nPage 4 of 5\n\n2. LOAD_LIBRARY_SEARCH_APPLICATION_DIR. The application folder is searched.\r\n3. LOAD_LIBRARY_SEARCH_USER_DIRS. Paths explicitly added with the AddDllDirectory function\r\nor the SetDllDirectory function are searched. If you add more than one path, then the order in which the\r\npaths are searched is unspecified.\r\n4. LOAD_LIBRARY_SEARCH_SYSTEM32. The System folder is searched.\r\nIf you call LoadLibraryEx with no LOAD_LIBRARY_SEARCH flags, or you establish a DLL search order for\r\nthe process, then the system searches for DLLs using either the standard search order or the alternate search order.\r\nApplication registration\r\nDynamic-link library redirection\r\nDynamic-link library security\r\nSide-by-side components\r\nAddDllDirectory\r\nLoadLibrary\r\nLoadLibraryEx\r\nLoadPackagedLibrary\r\nSetDefaultDllDirectories\r\nSetDllDirectory\r\nSource: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN\r\nhttps://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN"
	],
	"report_names": [
		"dynamic-link-library-search-order?redirectedfrom=MSDN"
	],
	"threat_actors": [],
	"ts_created_at": 1775434769,
	"ts_updated_at": 1775791229,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/00e2326d2d2311cce46399ea721b1258dfc0ba26.pdf",
		"text": "https://archive.orkl.eu/00e2326d2d2311cce46399ea721b1258dfc0ba26.txt",
		"img": "https://archive.orkl.eu/00e2326d2d2311cce46399ea721b1258dfc0ba26.jpg"
	}
}