How to Install SciLexer.dll for Notepad++: A Comprehensive Guide

Notepad++, a popular text editor, relies on SciLexer.dll to function properly. This DLL (Dynamic Link Library) is responsible for providing the editing functionality of Scintilla, which is an open-source code library used by Notepad++. In this article, we will explore how to install SciLexer.dll and ensure its safe usage.

Statically Linked vs Dynamically Linked

One of the primary concerns when using SciLexer.dll is the risk of DLL hijacking. This occurs when a malicious actor replaces the legitimate DLL with a compromised version. To avoid this, Scintilla can be statically linked into your application, eliminating the need to load the DLL dynamically. However, this approach requires that you build and sign the SciLexer.dll yourself.

Using LoadLibrary and Related APIs

When loading SciLexer.dll dynamically, the LoadLibrary call is typically used. This function can be modified using flags (LoadLibraryEx) or related APIs like SetDefaultDllDirectories and SetDLLDirectory to control where the DLL is loaded from. It is essential to ensure that the DLL is located in a trusted directory to minimize the risk of hijacking.

Restricting Source Locations

To further secure your application, you can use Win32 APIs to restrict the source locations from which SciLexer.dll can be loaded. This eliminates the possibility of loading a hijacked DLL from an untrusted location.

Signed vs Unsigned SciLexer.dll

If you want a signed SciLexer.dll, you can build and sign it yourself. However, trusting an unsigned SciLexer.dll for your project means trusting that it has not been compromised. The Notepad++ authors currently do not sign their releases of SciLexer.dll, but they may do so in the future.

Notepad++ Distribution

The SciLexer.dll distributed with Notepad++ is built and signed by its authors. They will be releasing a new version with additional checks to further ensure the integrity of the DLL.

Almost All Clients Rely on Window Class Registration

Most clients rely on SciLexer.dll registering a window class, which they then create an instance of using Win32 APIs and send messages to it. This is because Scintilla_DirectFunction is a rarely used feature provided for some client code with unusual requirements.

WikiLeaks' Vault 7 Revelation

In the recent 'Vault 7' publication from Wikileaks, Notepad++ and SciLexer.dll were mentioned. Although this revelation may have raised concerns about the security of SciLexer.dll, it is essential to note that Scintilla can be statically linked into your application, eliminating the need for dynamic loading.

Installing SciLexer.dll requires careful consideration of the risks associated with DLL hijacking. By understanding how to use LoadLibrary and related APIs, restricting source locations, and ensuring a signed or trusted version of the DLL, you can minimize the risk of compromising your application's security. Remember that Notepad++ authors will be releasing new versions with additional checks, making it essential to stay up-to-date with the latest developments in this area.

Notepad++ install scilexer.dll