What a DLL actually is
A DLL is a Portable Executable file — the same container format as an .exe — that publishes an export table instead of being started directly. Everything confusing about DLLs follows from that one design decision.
Static and dynamic linking
A statically linked program carries a copy of every library routine it uses inside its own file. It is larger, and it cannot be broken by anything on the machine it runs on. A dynamically linked program instead records the *names* of the routines it needs and the libraries they should come from, and the operating system resolves those names at load time.
That trade buys shared memory across processes, security updates that reach every program at once, and plug-in architectures. It costs you the guarantee that the program you tested is the program that runs.
Imports and exports
A DLL's export table lists what it offers, by name and by ordinal. An executable's import table lists what it wants, and from which library. The loader's job is to match one to the other, and a missing-DLL error is simply that match failing.
What this page will cover in full
- The PE headers a loader reads, in the order it reads them
- Export by name versus export by ordinal, and why ordinal-only exports age badly
- The import address table, and what binding it means at runtime
- Delay-loaded imports, and why they turn a start-up failure into a mid-session one
- API sets: the redirection layer that makes many modern imports point at names with no file behind them