HomeHome
Stats
border border All Dlls Dependencies border border
Screenshot All Dlls Dependencies is a static analyzer for Dlls dependencies.
It is a clone of Depends supporting Windows 7 and Windows 10 stub dlls.
Like Dependency Walker, it can analyze modules to find missing imported dlls or functions

Notice: For a dynamic analysis, use WinApiOverride with LoadedLib.txt or Loadedfunc.txt monitoring files.
 
Last Update :   October 20 2019
Version :   1.0.0
Binaries & Doc : 
Download  All Dlls Dependencies 6.27 Mb
Compatibility :   Windows
License :   Freeware
Status : 
 Maintained / Improvements if required Improvement Request 
border border border border

border border User Manual border border
All Dlls Dependencies

All Dlls Dependencies
Summary

All Dlls Dependencies is a static analyzer for Dlls dependencies.
Notice: For a dynamic analysis, use WinApiOverride with LoadedLib.txt or Loadedfunc.txt monitoring files.

Due to latest Windows technologies (stubs, filesystem redirection,...) it is required to use the 64 bits version to analyse 64 bits binaries, and the 32 bits version to analyse 32 bits binaries.

All Dlls Dependencies is a Freeware


Contents

   - Toolbar
   - Dlls Tree
   - Exports
   - Parent Imports
   - Imports
   - Forward Exports
   - Dlls List
   - Unresolved Dlls List
   - Unresolved Functions List
   - Logs
   - Disassembly

Toolbar
Open file (Exe, Dll, Ocx,...)
Cancel current parsing
Include Delay imported libraries to parsing
Include Forwarded exports libraries to parsing
Display modules full path
Display c++ undecorated names (human readable format instead of their native decorated form).
Microsoft, Borland and Gcc format are supported
Display options dialog
Show help
Check for software update
Report Bug to author
Display about dialog
Make donation



Dlls Tree
Modules Tree displays a hierarchical view of all the modules dependencies.
All Dlls Dependencies starts with the root module you chose to open and scans its import tables to build a list of required dependent modules.
All Dlls Dependencies then scans each of these dependent modules for their dependent modules. This recursion continues until all modules and their dependent modules have been processed.

To prevent a bloated tree and possible infinite circular loops with dependent modules, All Dlls Dependencies stops processing a given branch of the tree when it reaches a module that it has already processed somewhere else in the tree. Duplicate modules are marked with a small arrow in the middle of their accompanying image. To determine what the branch would have looked like if All Dlls Dependencies had processed it, double click on the item to jump to the original instance of the module in the tree.

All Dlls Dependencies also scans each dependent module looking for forwarded function calls to other modules. If a forwarded function is found and actually called by the parent module, then the module that the function is forwarded to is also pulled in and added to the dependency tree. These forwarded modules are specially marked in the dependency tree with a small state image next to their accompanying image.

While processing the dependency tree, All Dlls Dependencies performs several validity checks along the way. It scans import and export function tables looking for unresolved external functions. It checks for circular dependencies, which are allowed, and for circular forwarded dependencies, which are not allowed.

Any errors that are encountered while processing the tree will be logged (trace can be found in the Logs Window).

Normal icon are the following, they are in yellow in case of warning and red in case of error.
Warnings can be due to unresolved delay loaded module, or unresolved delay loaded function, or unresolved forwarded export.
Errors can be due to missing functions in imported dll or misssing imported dll.
Normal module with no errors
Duplicate module. This module has already been processed somewhere else in the tree. You can double click to jump to the original instance of the module in the tree
Delay-load module. This module will be dynamically loaded if any of its exported functions are actually called at run-time
Forwarded module. This module is a dependency because the parent module has forwarded one of its functions to this module

Toolbar
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result
Display module properties
Search module name on the Internet
Search module name in microsoft documentation
Expand all tree nodes
Collapse all tree nodes
Exports
The Export Functions List View displays the list of export functions for the currently selected module in the Modules Tree View.
Export functions are functions that a module exposes to other modules.
They can be thought of as the module's interface.

When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, RVA, Raw and Virtual Address are provided too, and for forwarded functions, the forwarded name is specified.
The Relative Virtual Address of export pointer is specified in the "Func Addr Ptr RVA" column.

Functions with red background are functions that are missing into the imported dll.

The exported functions icon meaning is the following
Export not used by any other modules
Export used by another module
Export used by the parent module
Forwarded Export not used by any other modules
Forwarded Export used by another module
Forwarded Export used by the parent module

Toolbar
Search function name on the Internet
Search function name in microsoft documentation
Display function quick Disassembly
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Parent Imports

The Parent Import Functions List View displays the list of parent import functions for the currently selected module in the Modules Tree View.
Parent import functions are functions that are actually called in the given module by the parent module.

It can help you to locate unnecessary modules in an application.
The fact that the parent module is calling functions in the selected module is what makes the selected module a dependency of the parent.
As a developer, if you can safely stop the parent module from calling all the functions listed in the parent import function list for a given module, then that module will no longer be a dependent of the parent module.

When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, RVA, Raw and Virtual Address are provided too, and for forwarded functions, the forwarded name is specified.
The Relative Virtual Address of function pointer in IAT is specified into the column "Func Addr Ptr RVA".

Functions with red background are functions required by parent that are missing into the imported dll.
Toolbar
Search function name on the Internet
Search function name in microsoft documentation
Display function quick Disassembly
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Imports

The Import Functions List View displays the list of import functions for the currently selected module in the Modules Tree View.
This list is reflecting the content of the "Import Table" and the "Delay Import Table"
Notice: the Imports list doesn't include Forwarded export.
To get the list of forwarded exports, go to the Forward Exports List View

The Relative Virtual Address of function pointer in IAT is specified into the column "Func Addr Ptr RVA"
When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, Raw and Virtual Address are provided too

Functions with red background are functions required by parent that are missing into the imported dll.

Toolbar
Search function name on the Internet
Search function name in microsoft documentation
Display function quick Disassembly
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Forward Exports

The Forwarded Exports Functions List View displays the list of forwarded exported functions for the currently selected module in the Modules Tree View.
This list is reflecting the content of the forwarded functions of the "Export Table"
When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, RVA, Raw and Virtual Address are provided too, and for forwarded functions, the forwarded name is specified.
The Relative Virtual Address of export pointer is specified in the "Func Addr Ptr RVA" column.

Functions with red background are functions required for forwarded export that are missing into the imported dll.
Toolbar
Search function name on the Internet
Search function name in microsoft documentation
Display function quick Disassembly
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Dlls List

The Modules List View displays all the modules required by the root module.
It display the number of used functions for each module, the number and list of modules using this module.
It display general information to like version, size, link checksum, real checksum, Entry Point Address (DllMain or WinMain address), Virtual Size,...
The "Required" column can contain 2 different values
   - "absolutely": the module has at least one link to root module with direct import (IAT)
   - "potentially": the module is imported only through delay import or forwarded functions

Modules with red background are modules which are unresolved (stub) or missing
Modules with yellow background are modules for which the real checksum differ from the link checksum (the module has been modified after building)

Toolbar
Search module name on the Internet
Search module name in microsoft documentation
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Unresolved Dlls List

The Unresolved Modules List View displays the list of unresolved modules, with, for each unresolved module
   - the failure reason
   - the number of imported functions
   - the number and list of the importing modules
   - if module belongs in OS stub modules list

Toolbar
Search module name on the Internet
Search module name in microsoft documentation
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Unresolved Functions List

The Unresolved Functions List View displays the list of unresolved functions, with, for each unresolved function
   - the failure reason
   - the importing way
   - the importing module
   - if module belongs in OS stub modules list
   - if failure is an export stub miss (the function is present in the redirected module but not in the export table of the stub module)

The "Required" column can contain 2 different values
   - "absolutely": the function has at least one link to root module with direct import (IAT)
   - "potentially": the function is imported only through delay import or forwarded functions

Toolbar
Search function name on the Internet
Search function name in microsoft documentation
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Logs

The Logs window displays all the logs emitted during the parsing. You may will find some more detailed infomration there.

Toolbar
Copy the full content of logs
Save the full content of logs
When checked, the text in search field is used for a regular expression search instead of a text search
Find first result
Find next result
Find previous result


Disassembly

The Disassembly dialog displays a quick disassembly of function.
If visual studio debug information are available for the module being disasembled, these debug information will be used,
and the disassembly window can show you a "mixed" mode: asm opcode + source code

Toolbar
html / raw text output
Mixed mode: include lines of source code, if available, into disasm output
When enable, display raw and virtual address to avoid manual translation
Manual refresh of asm output
Save current output
Top
border border border border

border border Known Troubles border border
Report new bug
  - None Yet
Top
border border border border
AllDllDeps All Dlls Dependencies : static analyzer for Dlls dependencies, Depends, Dependency WalkerAll Dlls Dependencies is a static analyzer for Dlls dependencies