Loading DLLs in Kernel Mode or User Mode: Windows CE 5.0 vs. Windows Embedded CE 6.0

1/6/2010

One DLL cannot simultaneously load into both kernel mode and user mode. When you run an executable file or a DLL, the code must be able to run at its specified address. For example, jumps within the code or references to global variables must be modified to refer to the hard-coded addresses. Because kernel DLLs load above 0x80000000 and user DLLs load below 0x80000000, it is impossible for a single copy of the DLL to be able to run in both locations at once.

In Windows Embedded CE 6.0, the OS bypasses this limitation by having two versions of some DLLs; one version to load in kernel mode and one version to load in user mode. The kernel has a new naming standard for DLLs that load in both kernel mode and user mode. The kernel-mode version of the DLL has a k. at the beginning of the name. For example, the user-mode version of coredll is coredll.dll whereas the kernel-mode version is k.coredll.dll. The kernel automatically translates kernel-mode accesses to user-mode DLLs into the proper kernel-mode version for this version. For example, if a DLL is linked to the user-mode coredll.dll, as almost all DLLs in the build system are, when that DLL is loaded into the kernel process, the DLL is importing from the kernel-mode k.coredll.dll, instead. There is no load error in this case because the imports are seamlessly redirected to the kernel DLL. Similarly, if code in the kernel process calls LoadLibrary on coredll.dll, it actually loads a reference to k.coredll.dll. Therefore, if it calls GetProcAddress and calls a function, it calls the proper kernel-mode function.

Ramifications of the DLL Loading Mechanism

In CE 6.0, if you implement DLLs, you do not need to change all coredll.dll references to k.coredll.dll references. In fact, that would destroy portability of your code to user mode. In the future, you may want to run your code in user mode, instead of inside the kernel.

OEMs may need to specify where their DLLs load with .bib file flags. The Z flag specifies Windows CE 5.0 and prior versions. Z cannot be combined with the compression flag C, whereas there are no such restrictions on K or Q. For more information, see Binary Image Builder File.

See Also

Other Resources

Kernel Functionality Modifications: Windows CE 5.0 vs. Windows Embedded CE 6.0
Kernel API Modifications: Windows CE 5.0 vs. Windows Embedded CE 6.0