Static evidence on NarratorMCAT.dll for "Where Rust actually is in Windows 11" (hunterworks.software/teardowns/rust-in-windows-11) Question: how does Narrator reach the MathCAT DLL? Everything here is read from files and the registry on the same Windows 11 Home x64 25H2 machine (build 26200.9168), 2026-09-04. No program was run to observe a load. 1. The folder C:\Windows\System32\NarratorMCAT\ NarratorMCAT.dll 3,768,656 bytes (hard-linked to the WinSxS component amd64_microsoft-windows-a..bility-mathcat-main_..._10.0.26100.8972) NOTICE.txt 1,395,927 bytes (Microsoft third-party notices) REVISION.txt 32 bytes ("MathCAT 0.7.0 / MathCATForC 0.7.0") Rules\ definitions.yaml, intent.yaml, prefs.yaml; Intent\ (5 files); Braille\ ASCIIMath, ASCIIMath-fi, CMU, LaTeX, Nemeth, Swedish, UEB, Vietnam (4 files each) plus definitions.yaml; Languages\en\ (7 files: ClearSpeak_Rules, SimpleSpeak_Rules, navigate, overview, definitions, unicode, unicode-full), Languages\en\gb\ (1 file), Languages\en\SharedRules\ (5 files). Only English is shipped. 2. What the DLL says about itself (export directory, pefile) Export-directory DLL name: libmathcat_c-77bb253130fb3cac.dll That is the file name cargo gives the build output of the crate "mathcat_c" (MathCAT's C-API crate); the debug record names the matching symbol file libmathcat_c-77bb253130fb3cac.pdb. The file was renamed to NarratorMCAT.dll after the build. Version resource: none. 22 exports, all of them MathCAT's public C API: DoNavigateCommand, DoNavigateKeyPress, FreeMathCATString, FreeMathCATStringArray, GetBraille, GetError, GetMathCATVersion, GetNavigationBraille, GetNavigationLocation, GetNavigationLocationFromBraillePosition, GetNavigationMathML, GetNavigationMathMLId, GetNavigationMathMLOffset, GetPreference, GetSpokenText, GetSupportedBrailleCodes, GetSupportedLanguages, GetSupportedSpeechStyles, SetMathML, SetNavigationLocation, SetPreference, SetRulesDir Crate paths inside it: mathcat-0.7.0 and mathcat_c-0.7.0 under a cargo registry directory for the Azure Artifacts feed pkgs.dev.azure.com-1ecc47089112e37b, i.e. consumed as dependencies from Microsoft's mirror. No first-party crate path identified. (See crate-census.txt.) 3. Who names it: nobody, statically Byte scan for "NarratorMCAT", "MathCAT", "mathcat", "libmathcat" in ASCII and UTF-16LE: C:\Windows\System32, SysWOW64, SystemApps (*.dll, *.exe, *.mui): 13,153 files, 0 unreadable. Hits: only NarratorMCAT.dll itself. Same trees, scanning for the export names (SetRulesDir, SetMathML, GetSpokenText, ...) and "mathcat" case-insensitively: 14,370 files. Hits outside the DLL: 4, all "SetMathML" inside WinUIEdit.dll and Microsoft.UI.Text.winmd (RichEdit's own math API, unrelated to MathCAT). Other file types under the same trees (2,136 files): 0 hits. C:\Program Files\Microsoft Office (3,772 files): 3 hits, all the same RichEdit "SetMathML" in WinUIEdit.dll. Narrator.exe (1,187,840 bytes): no static import and no delay-load import of NarratorMCAT.dll; imports UIAutomationCore, DUI70, wincorlib and the usual API sets; delay-loads ext-ms-win-dxcore, mscms, UxTheme. Its English MUI carries no "math" string. SRH.dll (6,656,000 bytes, Narrator's engine: its manifest registers the NarratorMainWindow and NarratorDesktopMainWindow COM classes): no static or delay-load import of NarratorMCAT.dll (delay-loads include chakra.dll, icu.dll and ext-ms-win-uiacore). Zero occurrences of "MathCAT", "mathcat", "SetMathML" or "MathML" in ASCII or UTF-16. It does carry, as UTF-16 setting names, MathReadingEnabled, MathReadingVerbosity, MathReadingSpeechStyle, MathReadingPauseFactor and MathReadingSpeechRate, next to the string "WINWORD.EXE", and its English MUI has the strings "Math", ", Equation, " and ", Empty Equation, ". The Settings app registers matching handlers (SystemSettings_Accessibility_Narrator_MathReading*). Registry: HKCU\Software\Microsoft\Narrator holds only NoRoam\RunningState on this machine; no key or value anywhere under HKCU or HKLM contains "MathCAT" or "NarratorMCAT". Narrator's script packages (Get-AppxPackage; their folders under WindowsApps are readable by the installing user): MicrosoftWindows.NarratorExtension-Word 2.0.3.0 (target WINWORD.EXE, main.js 40,015 bytes), NarratorExtension-ppt 1.0.4.0, NarratorExtension-OutlookWebApp 1.0.2.0, NarratorScript.Outlook 2.0.3.0, NarratorScript.Excel 1.0.14.0, and the NarratorQuickStart app. Every file in all six (406 files) was scanned: none mentions MathCAT, NarratorMCAT or the C API. The Word script contains no math or equation handling at all; the PowerPoint script only announces "has equation" when a UI Automation annotation of type Mathematics is present. Maths reading is therefore not done in the scripts. 4. How Windows ships it (WinSxS component names) amd64_microsoft-windows-a..bility-mathcat-main 10.0.26100.7705 (DLL 4,382,296 bytes) and 10.0.26100.8972 (3,768,656 bytes, current) amd64_microsoft-windows-a..ility-mathcat-rules 10.0.26100.7309 (definitions.yaml, intent.yaml, prefs.yaml) amd64_microsoft-windows-a..ty-mathcat-rules-en 10.0.26100.7309 (the English rule set) amd64_microsoft-windows-a..mathcat-rules-en-gb 10.0.26100.7309 (unicode.yaml) amd64_microsoft-windows-a..-mathcat-deployment 10.0.26100.8246 and 10.0.26100.8972 (manifests only) The component family is named "accessibility-mathcat"; the rules arrived in the 7309 servicing build, the DLL in 7705. Reading: the DLL is MathCAT's own C library under a Windows name, shipped and serviced as a first-class Windows component with its rule files. Narrator's engine has the settings for maths reading and Word in view, but nothing on disk names the DLL, so the code that loads it gets the name some way this scan could not see: built at run time, read from data, or in a file this scan did not cover. The load itself was not observed. See symbols/narrator-symbols-math.txt and pdb-symbol-census.txt for what Microsoft's public symbols add.