Log DLLs loaded by a process

Question

I'd like to add logging to our unit tests that records the DLLs they use, and where they're loaded from.

I can get the information I need from Sysinternals ListDLLs, but I'd need to run that while the test process is running, and I'd end up with race conditions: for instance, ListDLLs could run too early, and miss a DLL that's loaded half-way through the test run; or ListDLLs could run too late, after the test process exits.

Similarly, I can get the information I need from the Visual Studio debugger's Output and Modules windows, but I'd like to automate this on our build server.

Is there any command line tool that can run an arbitrary EXE, track the DLLs it uses, and log the information to a file?

Answer 1

You may write your own tool, which will use "debugging" features. This tool must

1. Start new process suspended
2. Attach to created process as debugger
3. Process debugging events, as I remember, you need LOAD_DLL_DEBUG_EVENT

http://msdn.microsoft.com/en-us/library/windows/desktop/ms679302(v=vs.85).aspx

Answer 2

The good news: it's not too hard to write it yourself using Detours. Hook the LoadLibraryA/W functions and log DLL names to a file (using GetModuleFileName against the value that the real LoadLibrary returns). Also hook CreateProcess, so that you can log DLLs loaded by child processes.

The bad news: I'd like to be able to post the source code that I used, but it's an internal tool that I won't be able to share.

Edit: I'm not convinced that this tool's Detours hooks are completely reliable, as during my testing, it's missed a few DLLs. Here's an alternative tool using the debugger API: https://github.com/timrobinson/logdlls

Answer 3

Note that SysInternals (now MSFT: http://technet.microsoft.com/en-US/sysinternals ) has a great tools for tracking all sorts of events happening when loading your application: Process Monitor. You will have to filter out anything that is not related to the application you are examining. Also, you may want to set Operation="Load Image" filter.

Tried Tim Robinson's tool, but it seems it will only track Windows related dll's so not useful in my case.