 |
| Copyright © 1997-2000 Mark Russinovich |
Last Update June 12, 2000, Version 2.22
|
| Introduction |
A question that I
often get asked is "Do you know of a utility that will show me which DLLs
are loaded on Windows 9x or NT?". The answer I gave up until recently was
"no", until I discovered a tool in the Windows NT Resource Kit
called tlist that does show this information. I decided to write a free-ware
version, ListDLLs. Unlike tlist, however, ListDLLs is able to
show you the full path names of loaded modules - not just their base names. In
addition, ListDLLs will flag loaded DLLs that have different version numbers
than their corresponding on-disk files (which occurs when the file is updated
after a program loads the DLL), and can tell you which DLLs were relocated
because they are not loaded at their base address. You can also get HandleEx or DLLView, a GUI
version for Windows 9x
|
| Installation |
Just copy
ListDLLs onto your executable path, and type "listdlls".
ListDLLs works on Windows 9x, NT 3.51, NT 4.0, and Win2K. |
| Usage |
The default
behavior of ListDLLs is to show all the DLLs that are currently loaded,
dividing the display into processes. The information listed for each DLL
includes the address at which it is loaded in a process, its size, and its
version number if it has one. A process name can also be specified as a
command-line argument to only list the DLLs loaded by that process.
ListDLLs queries a module's
file on disk for version information, but if the file has been updated since a
program loaded it then the version information displayed by ListDLLs
will not accurately reflect the version loaded by the application. In such
cases ListDLLs flags the difference and displays the build timestamps of
both the on-disk and in-memory versions of the module.
usage: listdlls [-r] [process
name | process id]
listdlls [-r] [-d dllname] |
| |
process name |
Instead of listing
all the loaded DLLs in the system, this parameter narrows ListDLLs' scan
to those processes that begin with the name process. Thus:
listdlls exp
would dump the loaded DLLs for all processes that start with
"exp", which would include Explorer. |
| |
process id |
Instead of listing
all the loaded DLLs in the system, this parameter narrows ListDLLs' scan
to tthe process that has the specified PID. Thus:
listdlls 53
would dump the loaded DLLs for the process with the PID 53. |
| |
dll name |
Instead of listing
all the loaded DLLs in the system, this parameter narrows ListDLLs' scan
to those processes that have the specified dll loaded. Thus:
listdlls -d mpr.dll
would dump information for processes that have mpr.dll loaded and only
present information for the mpr.dll module in those processes. |
| |
-r |
If you specify
this option ListDLLs flags DLLs that are loaded at an address different from
their base address. These DLLs require relocation, which can increase the
startup time of an application. |
| How it Works |
ListDLLs is
actually quite simple. On NT/Win2K it uses NtQuerySystemInformation to
ask NT to return a buffer filled with information about every process in the
system. This information includes process names and process IDs. Then it calls
an undocumented function in NTDLL.DLL to enumerate the modules loaded for each
process. The information returned includes the loaded address, size, and full
path name of the modules. The undocumented Image Help library (imagehlp.dll)
function EnumerateLoadedModules routine comes close to providing this
same information, but does not return full path names. For every loaded
moduled, ListDLLs calls GetFileVersionInfo to obtain the module's
version number.
On Windows 9x ListDLLs uses
the ToolHelp32 API. |
| More Information |
You can find
documentation for Image Help and ToolHelp32 functions in MSDN. |
Download ListDLLs (x86 - 45KB)
Download ListDLLs (Alpha - 38KB)
|
 |