Can anybody please explain how windows api function calls are linked in an executable. what i mean is, when u call a windows api from an exe, how it is resolved to the correct memory address for that function code inside the OS. How it happens in unix is, when a system function is called, the index or name of the function is loaded into may be a register and the processor switched to kernel mode and to a specifiec address inside the OS code.The OS then picks the function identification from the registry and gets the parameters and executes the function and returns the result into the user stack and the application continues. But i want to know how it happens in windows. Also i think a 1GB partition of the virtual address space of a process is taken for the kernel code in windows. Please explain how it all fits in, so that i can sleep peacefully
The windows api is implemented by dlls (dynamic-link libraries). (ntdll.dll, kernel32.dll, gdi.dll, etc...) When a request to load a dll is made by a process to windows, windows maps the dll into the address space of the process. So that basically means that a one-to-one correspondence is established and mediated by windows between the virtual address space of the process and the address space where the dll resides. If another application attempts to load the same dll, windows manages the correspondence between that process's address space and the address space where the dll resides. Therefore, only one instance of the dll is kept open and the dll is shared among processes. Note: This is the gist. This is what I understand happens by experimentation and reference material. If someone could fill in the details, I would be abliged also.
