I would like to get a list of used DLLs from application itself. My goal is to compare the list with hardcoded one to see if any DLL is injected. I can not find any examples in Google.
可以将文章内容翻译成中文,广告屏蔽插件可能会导致该功能失效(如失效,请关闭广告屏蔽插件后再试):
问题:
回答1:
You can use PSAPI for this. The function you need is EnumProcessModules
. There's some sample code on MSDN.
The main alternative is the Tool Help library. It goes like this:
- Call
CreateToolhelp32Snapshot
. - Start enumeration with
Module32First
. - Repeatedly call
Module32Next
. - When you are done call
CloseHandle
to destroy the snapshot.
Personally, I prefer Tool Help for this task. Here's a very simple example:
{$APPTYPE CONSOLE}
uses
SysUtils, Windows, TlHelp32;
var
Handle: THandle;
ModuleEntry: TModuleEntry32;
begin
Handle := CreateToolHelp32SnapShot(TH32CS_SNAPMODULE, 0);
Win32Check(Handle <> INVALID_HANDLE_VALUE);
try
ModuleEntry.dwSize := Sizeof(ModuleEntry);
Win32Check(Module32First(Handle, ModuleEntry));
repeat
Writeln(ModuleEntry.szModule);
until not Module32Next(Handle, ModuleEntry);
finally
CloseHandle(Handle);
end;
Readln;
end.
回答2:
Install Jedi Code Library (http://jcl.sf.net)
It has an exceptions reporting dialog which includes stack trace, Windows/hardware brief, and - the list of loaded DLLs and their versions. You can copy or call that part, generating this list, out of it.
回答3:
If you want a non-programmatic solution, just run the app under the Dependency Walker.
It will not only show static dependencies but will also trap and track dynamic loading of modules at runtime and let you know which module called LoadLibrary
.