Tuesday, 4 September 2012

How to trace executable dependencies in Windows

Download

Either download Dependency Walker from here:
http://www.dependencywalker.com/
At the time of writing version 2.2 is the current/stable release.

Or

Download Process Monitor from here:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
At the time of writing version 3.03 is the current/stable release.

Dependency Walker

Start-up Dependencies
To trace the modules loaded when an executable is first started do the following:

  1. Extract the archive to a location of your choice eg. c:\depends.
  2. Navigate to c:\depends and double-click on c:\depends\depends.exeDependency Walker will start.
  3. From the Dependency Walker menu click File->Open. The Open dialog will appear.
  4. From the Open dialog navigate to the executable that you wish to trace, select it and click on the Open button. Dependency Walker will show a list of modules loading and indicate any issues/errors.
  5. See the Dependency Walker help to understand the icons used and error messages given. For a description of the icons navigate the menu and select Help->Help Topics and this Understanding the Module Session->Module List View.
Usage Scenario Dependencies
To trace the modules loaded given a specific usage of an executable, follow the Start-up Dependencies as listed above and then do the following:

  1. From the Dependency Walker menu click Profile->Start Profiling... and the Profile Module dialog will appear.
  2. From the Profile Module dialog click on the Browse button and navigation to the executable that you wish to trace (as previously). Add any program arguments and configure the options as required. Click on the OK button to trace and close the dialog.
  3. Dependency Walker will show a list of modules loading and indicate any issues/errors.

Process Monitor

Start-up/Usage Dependencies
On starting Process Monitor it will display a list of all current running processes. We will configure Process Monitor to be used as with Dependency Walker.

  1. Extract the archive to a location of your choice eg. c:\procmon.
  2. Navigate to c:\ procmon and double-click on c:\procmon\procmon.exeProcess Monitor will start.
  3. From the Process Monitor menu click Filter->Filter... and the Process Monitor Filter dialog will appear.
  4. From the Process Monitor Filter dialog select the combo-box current displaying Architecture and select Process Name.
  5. From the Process Monitor Filter dialog enter the process name of the executable you want to trace in the third (empty) combo-box right of the Process Name. Click the Add button.
  6. From the Process Monitor Filter dialog deselect all other items in the Column column with the exception of the Process whose Value you just added. Click on the OK button and  Process Monitor Filter dialog will close.
  7. From the Process Monitor menu click Edit->Clear Display.
  8. Now start your executable and observe the trace (profiling) output in the  Process Monitor window.
  9. To start/stop the trace click on the menu item File->Capture i.
  10. To view the modules/files accessed click on the menu item Tools->File Summary... and the File Summary dialog will appear - see the Path column.

References

http://www.dependencywalker.com/
http://technet.microsoft.com/en-us/sysinternals/


No comments:

Post a Comment