Guided path: Loader & runtime
Step 1 of 5
Executable loading & runtime
PE images, DLL loading, runtime data structures, and compatibility layers such as WOW64.
Official Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
This is the bridge between 'a process exists' and 'a Windows program actually starts running'. It explains what gets mapped, relocated, linked, and tracked.
Mental model
Windows does not run source files or raw bytes. It loads structured images, maps sections into memory, resolves imports, and builds runtime metadata for the process and its threads.
Windows building blocks
Names and paths you can look for in Task Manager, Explorer, or documentation.
- Filekernel32.dll
Win32 loader helpers (CreateProcess)
- Filentdll.dll
Ldr* native loader routines
Go one level deeper
Extra detail for readers who want more precision before opening a child topic.
- Known DLLs and the SxS manifest resolver affect which DLL version loads.
- ASLR, DEP, and CFG are enforced using PE flags and policy.
How it works
- 1An executable image is parsed according to the PE format and mapped into virtual memory.
- 2The loader resolves imports, applies relocations when needed, and brings in dependent DLLs.
- 3Runtime structures such as the PEB, TEB, and module lists help the process and tools understand its execution state.
Key terms
- PE
- Portable Executable, the image format used by Windows executables and DLLs.
- Import
- A dependency on a symbol exported by another module.
- PEB
- Process Environment Block, runtime process metadata maintained in user mode.
Double-clicking an app
What looks instant is actually a sequence of image mapping, dependency loading, initialization, and runtime structure setup before your code's useful work begins.
Common misconception
A process is not just an EXE in memory. It is an address space populated with images, heaps, stacks, module metadata, and runtime support structures.
Go deeper
PE format
Headers, sections, imports, relocations, and the on-disk structure of Windows images.
DLL loader, PEB, and module lists
How Windows loads shared libraries and tracks runtime module state.
WOW64 and cross-architecture compatibility
How 32-bit user-mode applications run on a 64-bit Windows system.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
PE format
Headers, sections, imports, relocations, and the on-disk structure of Windows images.
Next step in your guided path
intermediate
DLL loader, PEB, and module lists
How Windows loads shared libraries and tracks runtime module state.
Go deeper in this branch
expert
WOW64 and cross-architecture compatibility
How 32-bit user-mode applications run on a 64-bit Windows system.
Go deeper in this branch