External Module Loading

Previous Top Next

Every program loaded by Windows will use some external DLLs. You can find a list of DLLs that were loaded into your process by running your application under a debugger such Microsoft Visual Studio. In the Debug Window for Visual Studio, you'll see output similar to the output below. Each of the DLLs listed below are loaded by the operating system rather than Thinstall. When a DLL is loaded by Thinstall it will not appear in the debug window of a debugger.

Loaded 'C:\thinstest\190\output\DatabaseApp.exe', no matching symbolic information found. Loaded 'ntdll.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\kernel32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\user32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\gdi32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\advapi32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\rpcrt4.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\imm32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\lpk.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\usp10.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\version.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\winspool.drv', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\msvcrt.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\shell32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\SHLWAPI.DLL', no matching symbolic information found. Loaded 'C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1515_x-ww_7bb98b8a\comctl32.dll' Loaded 'C:\WINDOWS\SYSTEM32\comctl32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\ole32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\riched32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\riched20.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\shfolder.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\mscoree.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\msvcr71.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\uxtheme.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\MSCTF.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\TabHook.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\rsaenh.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\imagehlp.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\imagehlp.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\WININET.DLL', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\crypt32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\msasn1.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\oleaut32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\secur32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\imagehlp.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\imagehlp.dll', no matching symbolic information found. Loaded 'C:\Program Files\j2 Messenger\Hspfcw32.dll', no matching symbolic information found. Loaded 'C:\Program Files\j2 Messenger\HotRes32.dll', no matching symbolic information found. Loaded 'C:\WINDOWS\SYSTEM32\MSIMTF.dll', no matching symbolic information found.

Why are external DLLs loaded into my process?

All programs must use some basic Operating system DLLs to talk to the operating system. These DLLs include Kernel32.dll, user32.dll, gdi32.dll, ntdll.dll, etc. These DLLs will typically have the string "Microsoft Windows Operating System" in their Version Product Name information field if you inspect them using the Shell.




DLLs that are marked "Microsoft Windows Operating System" should never be added to your Thinstall package or loaded directly by Thinstall. It is safe for Thinstall to modify operating system DLLs after they have been loaded by Windows (first tab the dialog above), however it is not safe for Thinstall to directly load operating system DLLs (second tab in the dialog above). You should never add operating system DLLs to your Thinstall project file.

Dlls loaded by Windows must be able to resolve all references externally. For example, if you have a DLL called A.DLL and has a reference to B.DLL, if A.DLL is loaded by the operating system, then B.DLL must be present on the hard drive in the DLL search path. If you wanted A.DLL to be able to use B.DLL without extracting B.DLL to disk, you should add A.DLL to the list of matching patterns for DLLs which Thinstall loads (second tab in above dialog). When the program tries to load A.DLL, Thinstall will load A.DLL from disk instead of the operating system and allow A.DLL to use B.DLL directly from the internal archive. In some cases you can run into potential problems if an external DLL later tries to use A.DLL. This external DLL will not be able to use the "virtual" version of A.DLL and will load A.DLL from disk, resulting in 2 copies of A.DLL being in memory. Some libraries may have trouble coping with 2 simutaneous copies in memory. If the op

Dlls that are loaded by Thinstall or modified after load will be able to reference virtual registry keys and virtual files. The main difference between a DLL being loaded by Thinstall, and the DLL being modified after load by the operating system, is the DLL will "invisible" to external DLLs in the sense that external DLLs will not be able to reference the

Improving Loading / Execution Speed
The fewer external DLLs that are modified or loaded by Thinstall, the less CPU cycles are used.

Improving Security
By not allowing external DLLs access to your internal files, you greatly improve security. For best security, no external DLLs should be loaded or modified.

Improve Compatibility
External DLLs modified or loaded by Thinstall can sometimes have compatibility problems. By reducing or eliminating external DLL loading, you can head off future problems that could be caused when your program loads DLLs out of your control through 3rd party APIs such as TWAIN and system wide DLLs.

When a DLL is loaded by your program it will be mapped into memory by Thinstall if the file is internal to your archive. If the DLL is external to your program (i.e. on the hard drive), Thinstall consults a list of "allowed" and "banned" DLLs. If the DLL matchs a pattern in the "allowed" list and not a pattern in the "banned" list, Thinstall modifies the DLL to allow it to access the Thinstall virtual machine.

If your program includes all of the runtimes it uses inside the archive, then there is typically no reason you need to modify external DLLs. For example, Visual Basic Programmers who include MSVBVM60.DLL in their archive will not not to load external DLLs. If you are using a pre-installed version of MSVBVM60.DLL, then Thinstall must be instructed to modify this DLL to allow it to see virtual files and virtual registry keys.

Patterns containing Thinstall filename macros will be expanded.

For most applications, you can replace the pattern "\" with one or more of the following file patterns:

Language	Pattern to Add	Description
.NET	%systemroot%\microsoft.net\framework\	DLLs in the Microsoft.net framework
.NET	\mscoree.dll	The entry DLL for .NET Framework
C++	\mvcrt	Dynamically loaded C Runtime Library (not needed if LIBC is statically linked)
C++	\mfc	Microsoft Foundation Classes
All	\ole32.dll	If virtual registry functions are used
All	\shell32.dll	If ShellExecute is used
DirectX	\d3dxof.dll	If DirectX is used to load data files for application.
DirectX	\d3drm.dll	If DirectX is used to load data files for application.