What HAL.Dll contains ???

Hello All ,

I am confused with some kernel mode and user mode…

As I know all Dll & Exe run as USer mode programs and .sys are kernel mode
executables…Then How come a .Sys file or a driver links it’s function
import table to Hal.Dll & ntoskernel.exe. Is Hal.Dll a kernel mode DLL.If
yes then whats a funda behind it.Or is it a dll like ntdll.dll ?

Thanks in advance.

The Dynamic linking technologies used in user mode DLLs work in the kernel also.
In fact, all .sys files really behave like DLLs. I believe the extension of files used in
the kernel is completely a convention, i.e., if you renamed serial.sys to serial.doc, and changed
the registry entry for the serial driver also, that it would work identically.

If you export symbols from a .sys file, you can import them in other drivers (but you have to
be careful about load order, because if you reference exported symbols before driver entry is
called, you’ll get into trouble. )

-DH
“TheDonx” wrote in message news:xxxxx@ntdev…
>
> Hello All ,
>
> I am confused with some kernel mode and user mode…
>
> As I know all Dll & Exe run as USer mode programs and .sys are kernel mode
> executables…Then How come a .Sys file or a driver links it’s function
> import table to Hal.Dll & ntoskernel.exe. Is Hal.Dll a kernel mode DLL.If
> yes then whats a funda behind it.Or is it a dll like ntdll.dll ?
>
> Thanks in advance.
>
>

The build program ensures that there is a DriverEntry entry point for a .SYS
file. I think there are other checks as well.

“Dave Harvey” wrote in message
news:xxxxx@ntdev…
>
> The Dynamic linking technologies used in user mode DLLs work in the kernel
also.
> In fact, all .sys files really behave like DLLs. I believe the extension
of files used in
> the kernel is completely a convention, i.e., if you renamed serial.sys to
serial.doc, and changed
> the registry entry for the serial driver also, that it would work
identically.
>
> If you export symbols from a .sys file, you can import them in other
drivers (but you have to
> be careful about load order, because if you reference exported symbols
before driver entry is
> called, you’ll get into trouble. )
>
> -DH
> “TheDonx” wrote in message news:xxxxx@ntdev…
> >
> > Hello All ,
> >
> > I am confused with some kernel mode and user mode…
> >
> > As I know all Dll & Exe run as USer mode programs and .sys are kernel
mode
> > executables…Then How come a .Sys file or a driver links it’s function
> > import table to Hal.Dll & ntoskernel.exe. Is Hal.Dll a kernel mode
DLL.If
> > yes then whats a funda behind it.Or is it a dll like ntdll.dll ?
> >
> > Thanks in advance.
> >
> >
>
>
>
>

> import table to Hal.Dll & ntoskernel.exe. Is Hal.Dll a kernel mode
DLL.

Surely yes.

yes then whats a funda behind it.Or is it a dll like ntdll.dll ?

No. NTDLL is the lowest user-mode layer below KERNEL32, it talks
directly to the kernel by syscalls, and also contains LoadLibrary and
HeapAlloc implementation.

Max

Thanks to all.