title: How to securely dynamically load PathAllocCanonicalize at runtime
body: <p>I have a Windows desktop C++ application that currently uses <a href="https://docs.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-pathcanonicalizew" rel="nofollow noreferrer"><code>::PathCanonicalizeW</code></a>. As you can see from the documentation, it was introduced in Windows 2000 and is located in <code>shlwapi.dll</code>. In order to support long paths on Win 10+, I need to start using <a href="https://docs.microsoft.com/en-us/windows/win32/api/pathcch/nf-pathcch-pathalloccanonicalize" rel="nofollow noreferrer"><code>::PathAllocCanonicalize</code></a> (or one of it's friends - <code>::PathCchCanonicalize</code> or <code>::PathCchCanonicalizeEx</code>).</p>
  <p>This function was added in Windows 8, but I still need to support the older OS's. In order to support all OS's, I need to dynamically load <code>::PathAllocCanonicalize</code> by calling <code>::LoadLibrary</code> at runtime. The problem is that the documentation doesn't provide the DLL that includes this function.</p>
  <p>After doing some searching, I found <a href="https://docs.microsoft.com/en-us/uwp/win32-and-com/win32-apis" rel="nofollow noreferrer">this documentation</a> that includes all 3 of the new PathCanonicalize functions and it claims that they are in <code>api-ms-win-core-path-l1-1-0.dll</code>. After more searching, it appears that this is not a traditional DLL because there is no file anywhere in the OS with that name. This application has always loaded system libraries using the full path to the file in the system directory (typically <code>C:\Windows\system32</code>) to make sure that it's not loading malicious DLLs, but for this it will be impossible without a physical file to point to.</p>
  <p>I have been able to test that calling <code>::LoadLibrary(&quot;api-ms-win-core-path-l1-1-0.dll&quot;)</code> does work, but the fact that that documentation mentions UWP worries me. Is there any documentation for the supported way to dynamically load these kinds of functions at runtime in a desktop app? Is there a more secure way to load this DLL?</p>
  <p>P.S. This app cannot be deployed with that DLL, and even if it were possible there's no point since any OS that doesn't have that function wouldn't have full support for long paths anyway. Using the documented <code>pathcch.lib</code> would require upgrading the target Windows version. Dropping support for the older OS's is also completely out of the question. The function must be manually dynamically loaded at runtime.</p>