2

I have very basic application which is console app dispaying message box. In Visual Studio I change following options: 

- C/C++ -> SecurityCheck -> Disable Security Check (/GS-)
- Linker -> Advanced -> Entry Point -> main
- Linker -> Input -> -> Ignore All Default Libraries -> Yes (/NODEFAULTLIB)

to remove from .exe all dependenies like vcruntime140.dll, api-ms-win-crt-locale.dll, etc.

Now, I have only one dependency in import table, which is user32.dll (required by messagebox).

Why kernel32.dll is missing? I thought that kernel32.dll is required for all .exe applications.

Even the kernel32.dll is missing, the app runs correctly.

Improve this question

1 Answer 1

Reset to default
2

If you are not using any APIs from kernel32 it will not be added to the import table, simple as that. You were misinformed about kernel32 being required for all applications. It is even possible to have an application without import table.

With regards to the vcruntime140 etc, you can just target Windows XP and use the /MP option to get rid of those. The api-ms*.dll are Windows Vista+ ways of importing things like kernel32.dll with shims, so if you don’t care about XP support those are not an issue.

Improve this answer
5
  • While it is true that kernel32 is not required in the import table, it is quite likely that it is still loaded into user space of all applications for the "console" or "windows" subsystem. It definitely is loaded by user32. So the statement that kernel32 is mapped in (at least nearly) each windows process still holds.
    – Michael Karcher
    Aug 24, 2018 at 17:40
  • The statement “I thought kernel32.dll is required for all .exe applications.” is what I addressed in my answer. I just explained that there is nothing special about kernel32.dll, it’s just a DLL like any other. There is also no magic related to the subsystem of the application. Nobody was stating that kernel32 isn’t loaded in most processes, I just explained the facts.
    – mrexodia
    Aug 24, 2018 at 17:51
  • I did not mean to claim a problem or inaccuracy in your answer. The intent of my comment was to show the original poster, that the statement "kernel32 is required" might still be true if you look at it from the context of which DLLs are mapped, which is important e.g. in exploitation.
    – Michael Karcher
    Aug 24, 2018 at 18:02
  • all processes will have kernel32 (and ntdll) loaded on Windows Vista and later. Windows XP and earlier had a bug where kernel32 could be omitted and then the process would crash on start because of a circular dependency.
    – peter ferrie
    Aug 27, 2018 at 22:23
  • You are correct. Today I created an executable without an import table and on Windows 8.1 the following DLLs are loaded when starting the executable under a debugger. x86 (wow64): apphelp.dll, kernel32.dll, kernelbase.dll, ntdll.dll. For x64: kernel32.dll, kernelbase.dll, ntdll.dll
    – mrexodia
    Sep 2, 2018 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.