Utility for viewing which files/dlls are loaded by an executable image

20.8k views Asked by At

I know there is a utility for this because I used to use it...just can't remember the name. I'm looking for a Windows (Windows-7) utility that will allow me to select an executable image running and have it tell me what files/dlls that program has loaded and from what directory. I am writing software in Visual Studio and would like to verify at runtime which dlls my program is loading.

4

There are 4 answers

3
RoboAlex On BEST ANSWER
0
Hans Passant On

Visual Studio does it well. Use Tools > Attach to Process, Debug > Break All. Then Debug > Windows > Modules. For VS2015+ start that with Debug > Attach to Process.

0
Heelara On

Instead of installing any third-party tools, we could use Microsoft's tasklist. E.g., to display the loaded DLLs for a program using its name, do this:

C:\>tasklist /m /fi "imagename eq PacketAnalyzerPlus.exe"

Image Name                     PID Modules
========================= ======== ============================================
PacketAnalyzerPlus.exe        3904 ntdll.dll, wow64.dll, wow64win.dll,
                                   wow64cpu.dll

where the specified options are as below:

/m <module> - Lists all tasks with DLL modules loaded that match the given pattern name. If the module name is not specified, this option displays all modules loaded by each task.

/fi <filter> - Specifies the types of processes to include in or exclude from the query. You can use more than one filter or use the wildcard character () to specify all tasks or image names.

If it is a Windows service, use filter services. E.g. to find all DLLs for service Winmgmt, use this:

C:\>tasklist /m /fi "services eq Winmgmt"

Image Name                     PID Modules
========================= ======== ============================================
svchost.exe                    872 ntdll.dll, kernel32.dll, KERNELBASE.dll,
                                   msvcrt.dll, sechost.dll, RPCRT4.dll,
                                   ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
                                   USP10.dll, IMM32.DLL, MSCTF.dll,...
1
chappjc On

The command line route is ListDLLs from Sysinternals.

It can list DLLs loaded by a process, or list processes that loaded a given DLL.