Looking at the structure of an executable in a PE viewer, I see that it imports functions from comctl32.dll and nothing else. However, when I run this executable through a packer (UPX), the resulting executable suddenly depends on kernel32.dll as well. Can someone explain why this is, and what the new functions imported from kernel32.dll do?
Add a comment
|
Any dynamically-linked executable will need to import functionality from dynamically-loaded libraries. The executable you have needs some functions from comctl32.dll to accomplish whatever it does.
A packer like UPX is basically creating a completely new executable and compressing the original one into a "payload". The reason your packed executable now has extra dependencies is because the UPX decoder, which unpacks your original executable when it's run, has dependencies of its own. I'm guessing that it imports LoadLibrary and GetProcAddress from kernel32.dll. You can read more on MSDN, but to summarize, these functions allow the UPX unpacking stub to load additional libraries without explictly linking to them.
