DLL is a complete PE file that includes all the headers, sections, and most importantly, the export table.
The export table includes all the functions that this library exports. Not all library functions are exported as some of them are for internal use. But the functions that are exported can be accessed through its name or its ordinal number (index number), and they are called Application Programming Interfaces (APIs).
Windows provides lots of libraries for Windows programmers to access its functionality, and some of these libraries are as follows:
- kernel32.dll: This library includes the basic and core functionality for all programs, including reading a file and writing a file.
- ntdll.dll: This library exports Windows native APIs; kernel32.dll uses this library as a backend for its own functionality. Some malware writers try to access undocumented APIs inside this library to make it harder for reverse engineers to understand the malware functionality, such as...
