How to get a list of used DLLs?

Question

I would like to get a list of used DLLs from application itself. My goal is to compare the list with hardcoded one to see if any DLL is injected. I can not find any examples in Google.

Answer 1

You can use PSAPI for this. The function you need is EnumProcessModules. There's some sample code on MSDN.

The main alternative is the Tool Help library. It goes like this:

• Call CreateToolhelp32Snapshot.
• Start enumeration with Module32First.
• Repeatedly call Module32Next.
• When you are done call CloseHandle to destroy the snapshot.

Personally, I prefer Tool Help for this task. Here's a very simple example:

{$APPTYPE CONSOLE}

uses
  SysUtils, Windows, TlHelp32;

var
  Handle: THandle;
  ModuleEntry: TModuleEntry32;
begin
  Handle := CreateToolHelp32SnapShot(TH32CS_SNAPMODULE, 0);
  Win32Check(Handle <> INVALID_HANDLE_VALUE);
  try
    ModuleEntry.dwSize := Sizeof(ModuleEntry);
    Win32Check(Module32First(Handle, ModuleEntry));
    repeat
      Writeln(ModuleEntry.szModule);
    until not Module32Next(Handle, ModuleEntry);
  finally
    CloseHandle(Handle);
  end;
  Readln;
end.

Answer 2

Install Jedi Code Library (http://jcl.sf.net)

It has an exceptions reporting dialog which includes stack trace, Windows/hardware brief, and - the list of loaded DLLs and their versions. You can copy or call that part, generating this list, out of it.

Answer 3

If you want a non-programmatic solution, just run the app under the Dependency Walker.

It will not only show static dependencies but will also trap and track dynamic loading of modules at runtime and let you know which module called LoadLibrary.