[ListDLL Logo] Copyright © 1997 Mark Russinovich Last Updated September 1,1997, Version 2.0 ------------------------------------------------------------------------ Introduction A question that I often get asked is "Do you know of a utility that will show me which DLLs are loaded on NT?". The answer I gave up until recently was "no", until I discovered a tool in the Windows NT Resource Kit called tlist that does show this information. I decided to write a free-ware version, ListDLLs. Note: Version 2.0 shows loaded modules for Win32 services and full pathnames of all loaded modules. You can also get a GUI-based version of this program, HandleEx, here at NTInternals. Installation Just copy ListDLLs onto your executable path, and type "listdlls". ListDLLs has been tested on NT 3.51 and NT 4.0. Usage The default behavior of ListDLLs is to show all the DLLs that are currently loaded, dividing the display into processes. The information listed for each DLL includes the address at which it is loaded in a process, its size, and its version number if it has one. A process name can also be specified as a command-line argument to only list the DLLs loaded by that process. usage: listdlls [-p process] -p Instead of listing all the loaded DLLs process in the system, this parameter narrows ListDLLs' scan to those processes that begin with the name process. Thus: listdlls -p exp would dump the loaded DLLs for all processes that start with "exp", which would include Explorer. How it Works ListDLLs is actually quite simple. It uses NtQuerySystemInformation to ask NT to return a buffer filled with information about every process in the system. This information includes process names and process IDs. Then it calls an undocumented functions in NTDLL.DLL to enumerate the modules loaded for each process. The information returned includes the loaded address, size, and full path name of the modules. The undocumented Image Help library (imagehlp.dll) function EnumerateLoadedModules routine comes close to providing this same information, but does not return full path names. For every loaded moduled, ListDLLs calls GetFileVersionInfo to obtain the module's version number. More You can find documentation for other Image Help Information functions in MSDN. ------------------------------------------------------------------------ Download ListDLLs (27KB) [Image]