2

I need to validate that an executable's dependencies exist and if possible, the correct version of that dependency. Including the dependency's dependencies. Using dumpbin.exe, I am able to gather an exe or dll's dependencies. For example

C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\bin>dumpbin.exe /dependents  "C:\Program Files (x86)\Notepad++\notepad++.exe"
Microsoft (R) COFF/PE Dumper Version 14.00.24215.1
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file C:\Program Files (x86)\Notepad++\notepad++.exe

File Type: EXECUTABLE IMAGE

  Image has the following dependencies:

    COMCTL32.dll
    SHLWAPI.dll
    SHELL32.dll
    KERNEL32.dll
    USER32.dll
    GDI32.dll
    COMDLG32.dll
    ADVAPI32.dll
    ole32.dll

  Summary

       20000 .data
       52000 .rdata
       13000 .reloc
       86000 .rsrc
      10F000 .text

I am reading the output of dumpbin.exe via Process.Start() in C# and parsing the return data, no problem. I can also validate if a file exists, easy... However, it is entirely possible that more than one of a dependency's dependencies exist on a system. How would you validate the existence of the correct dependency or version of said dependency?? This becomes important as validating the dependency's dependencies also exist. It would be nice if there was a way to get above as 

"C:\Windows\System32\ole32.dll"

Any thoughts to this? Thanks in advance! (PS- if I have this completely wrong in terms of dll locations, like it can only live in the .exe's executing path or system32, please tell me, thanks)

Chris
  • 119
  • 1
  • 13
  • C# has a nice version system (assembly version info) but unfortunately a native DLL file does not have to have any version information at all. If a file has version info in it, you can get that info with this API function: https://learn.microsoft.com/en-us/windows/desktop/api/winver/nf-winver-getfileversioninfoa – Celal Ergün Mar 22 '19 at 19:31

1 Answers1

1

The load order for multiple libraries on the node you are testing affects which library.

Runtime methods are:

Use sysinternals procmon loaded dependencies.

Use windbg by launching the program from windbg to see loader messages.

un-CharlieH
  • 85
  • 7