|
|
 |
 |
 |
 |
|
|
All Dlls Dependencies is a static analyzer for Dlls dependencies.
It is a clone of Depends supporting Windows 7 and Windows 10 stub dlls.
Like Dependency Walker, it can analyze modules to find missing imported dlls or functions
Notice: For a dynamic analysis, use WinApiOverride with LoadedLib.txt or Loadedfunc.txt monitoring files.
| |
| Last Update |
November 28 2023 |
| Version |
1.6.2 |
| Software |
|
| Compatibility |
Windows (Xp, 7, 8, 10, 11) |
| License |
Freeware |
| Status |
|
|
|
|
 |
 |
 |
 |
|
|
|
|
|
| All Dlls Dependencies |
 |
All Dlls Dependencies
|
| Summary |
All Dlls Dependencies is a static analyzer for Dlls dependencies.
Notice: For a dynamic analysis, use WinApiOverride with LoadedLib.txt or Loadedfunc.txt monitoring files.
Due to latest Windows technologies (stubs, filesystem redirection,...) it is required to use the 64 bits version to analyse 64 bits binaries, and the 32 bits version to analyse 32 bits binaries.
All Dlls Dependencies is a Freeware
|
| Contents |
- Toolbar
- Dlls Tree
- Exports
- Parent Imports
- Imports
- Forward Exports
- Dlls List
- Unresolved Dlls List
- Unresolved Functions List
- Logs
- Disassembly
|
Toolbar
|
 |
Open file (Exe, Dll, Ocx,...) |
 |
Cancel current parsing |
 |
Include Delay imported libraries to parsing |
 |
Include Forwarded exports libraries to parsing |
 |
Display modules full path |
 |
Display c++ undecorated names (human readable format instead of their native decorated form).
Microsoft, Borland and Gcc format are supported |
 |
Display options dialog |
 |
Show help |
 |
Check for software update |
 |
Report Bug to author |
 |
Display about dialog |
 |
Make donation |
|
Dlls Tree
|
|
Modules Tree displays a hierarchical view of all the modules dependencies.
All Dlls Dependencies starts with the root module you chose to open and scans its import tables to build a list of required dependent modules.
All Dlls Dependencies then scans each of these dependent modules for their dependent modules.
This recursion continues until all modules and their dependent modules have been processed.
To prevent a bloated tree and possible infinite circular loops with dependent modules, All Dlls Dependencies stops processing a given branch of the tree when it reaches a module that it has already processed somewhere else in the tree.
Duplicate modules are marked with a small arrow in the middle of their accompanying image.
To determine what the branch would have looked like if All Dlls Dependencies had processed it, double click on the item to jump to the original instance of the module in the tree.
All Dlls Dependencies also scans each dependent module looking for forwarded function calls to other modules.
If a forwarded function is found and actually called by the parent module, then the module that the function is forwarded to is also pulled in and added to the dependency tree.
These forwarded modules are specially marked in the dependency tree with a small state image next to their accompanying image.
While processing the dependency tree, All Dlls Dependencies performs several validity checks along the way.
It scans import and export function tables looking for unresolved external functions.
It checks for circular dependencies, which are allowed, and for circular forwarded dependencies, which are not allowed.
Any errors that are encountered while processing the tree will be logged (trace can be found in the Logs Window).
Normal icon are the following, they are in yellow in case of warning and red in case of error.
Warnings can be due to unresolved delay loaded module, or unresolved delay loaded function, or unresolved forwarded export.
Errors can be due to missing functions in imported dll or misssing imported dll.
 |
Normal module with no errors |
 |
Duplicate module. This module has already been processed somewhere else in the tree. You can double click to jump to the original instance of the module in the tree |
|
Delay-load module. This module will be dynamically loaded if any of its exported functions are actually called at run-time |
|
Forwarded module. This module is a dependency because the parent module has forwarded one of its functions to this module |
Toolbar
 |
When checked, the text in search field is used for a regular expression search instead of a text search |
 |
Find first result |
 |
Find next result |
 |
Find previous result |
 |
Display module properties |
 |
Search module name on the Internet |
 |
Search module name in microsoft documentation |
 |
Expand all tree nodes |
 |
Collapse all tree nodes |
|
|
Exports
|
 |
The Export Functions List View displays the list of export functions for the currently selected module in the Modules Tree View.
Export functions are functions that a module exposes to other modules.
They can be thought of as the module's interface.
When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, RVA, Raw and Virtual Address are provided too, and for forwarded functions, the forwarded name is specified.
The Relative Virtual Address of export pointer is specified in the "Func Addr Ptr RVA" column.
Functions with red background are functions that are missing into the imported dll.
The exported functions icon meaning is the following
|
Export not used by any other modules |
 |
Export used by another module |
 |
Export used by the parent module |
|
Forwarded Export not used by any other modules |
 |
Forwarded Export used by another module |
 |
Forwarded Export used by the parent module |
Notice: When exported symbol is a variable (not a function) the line background is purple
Toolbar
|
Search function name on the Internet |
|
Search function name in microsoft documentation |
 |
Display function quick Disassembly |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Parent Imports
|
 |
The Parent Import Functions List View displays the list of parent import functions for the currently selected module in the Modules Tree View.
Parent import functions are functions that are actually called in the given module by the parent module.
It can help you to locate unnecessary modules in an application.
The fact that the parent module is calling functions in the selected module is what makes the selected module a dependency of the parent.
As a developer, if you can safely stop the parent module from calling all the functions listed in the parent import function list for a given module,
then that module will no longer be a dependent of the parent module.
When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, RVA, Raw and Virtual Address are provided too, and for forwarded functions, the forwarded name is specified.
The Relative Virtual Address of function pointer in IAT is specified into the column "Func Addr Ptr RVA".
Functions with red background are functions required by parent that are missing into the imported dll.
Toolbar
|
Search function name on the Internet |
|
Search function name in microsoft documentation |
|
Display function quick Disassembly |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Imports
|
 |
The Import Functions List View displays the list of import functions for the currently selected module in the Modules Tree View.
This list is reflecting the content of the "Import Table" and the "Delay Import Table"
Notice: the Imports list doesn't include Forwarded export.
To get the list of forwarded exports, go to the Forward Exports List View
The Relative Virtual Address of function pointer in IAT is specified into the column "Func Addr Ptr RVA"
When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, Raw and Virtual Address are provided too
Functions with red background are functions required by parent that are missing into the imported dll.
Toolbar
|
Search function name on the Internet |
|
Search function name in microsoft documentation |
|
Display function quick Disassembly |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Forward Exports
|
 |
The Forwarded Exports Functions List View displays the list of forwarded exported functions for the currently selected module in the Modules Tree View.
This list is reflecting the content of the forwarded functions of the "Export Table"
When resolved the function address is specified in "Function Address RVA" (address in the resolved module).
To avoid manual conversion, RVA, Raw and Virtual Address are provided too, and for forwarded functions, the forwarded name is specified.
The Relative Virtual Address of export pointer is specified in the "Func Addr Ptr RVA" column.
Functions with red background are functions required for forwarded export that are missing into the imported dll.
Toolbar
|
Search function name on the Internet |
|
Search function name in microsoft documentation |
|
Display function quick Disassembly |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Dlls List
|
 |
The Modules List View displays all the modules required by the root module.
It display the number of used functions for each module, the number and list of modules using this module.
It display general information to like version, size, link checksum, real checksum, Entry Point Address (DllMain or WinMain address), Virtual Size,...
The "Required" column can contain 2 different values
- "absolutely": the module has at least one link to root module with direct import (IAT)
- "potentially": the module is imported only through delay import or forwarded functions
Modules with red background are modules which are unresolved (stub) or missing
Modules with yellow background are modules for which the real checksum differ from the link checksum (the module has been modified after building)
Toolbar
|
Search module name on the Internet |
|
Search module name in microsoft documentation |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Unresolved Dlls List
|
 |
The Unresolved Modules List View displays the list of unresolved modules, with, for each unresolved module
- the failure reason
- the number of imported functions
- the number and list of the importing modules
- if module belongs in OS stub modules list
Toolbar
|
Search module name on the Internet |
|
Search module name in microsoft documentation |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Unresolved Functions List
|
 |
The Unresolved Functions List View displays the list of unresolved functions, with, for each unresolved function
- the failure reason
- the importing way
- the importing module
- if module belongs in OS stub modules list
- if failure is an export stub miss (the function is present in the redirected module but not in the export table of the stub module)
The "Required" column can contain 2 different values
- "absolutely": the function has at least one link to root module with direct import (IAT)
- "potentially": the function is imported only through delay import or forwarded functions
Toolbar
|
Search function name on the Internet |
|
Search function name in microsoft documentation |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Logs
|
 |
The Logs window displays all the logs emitted during the parsing. You may will find some more detailed infomration there.
Toolbar
 |
Copy the full content of logs |
 |
Save the full content of logs |
|
When checked, the text in search field is used for a regular expression search instead of a text search |
|
Find first result |
|
Find next result |
|
Find previous result |
|
Disassembly
|
 |
The Disassembly dialog displays a quick disassembly of function.
If visual studio debug information are available for the module being disasembled, these debug information will be used,
and the disassembly window can show you a "mixed" mode: asm opcode + source code
Toolbar
 |
html / raw text output |
 |
Mixed mode: include lines of source code, if available, into disasm output |
 |
When enable, display raw and virtual address to avoid manual translation |
 |
Manual refresh of asm output |
|
Save current output |
|
|
|
|
|
|
|
|
|
|
;)
