Cardboard Iguana Security

Search

SearchSearch

Windows DLL search order

July 31, 20241 min read

The search order varies depending on the state of SafeDllSearchMode.

Windows DLL search order if SafeDllSearchMode is enabled:

  • The application directory
  • The system directory (as returned by GetSystemDirectory())
  • The 16-bit (!) system directory
  • The Windows directory (as returned by GetWindowsDirectory())
  • The current directory (!)
  • The system PATH (!)

Windows DLL search order if SafeDllSearchMode is disabled:

  • The application directory
  • The current directory (!)
  • The system directory (as returned by GetSystemDirectory())
  • The 16-bit (!) system directory
  • The Windows directory (as returned by GetWindowsDirectory())
  • The system PATH (!)

Note that it seems more-or-less impossible to determine what DLLs an application is searching for without having SYSTEM access already (so tools like ProcMon can be run).

Graph View

Backlinks