• Facebook
  • RSS Feed
  • Instagram
  • LinkedIn
  • Twitter
Jul 132010
 

I found a really useful ex-Sysinternals tool yesterday.  It is called ListDLL’s.  It lists ALLLLLLL the DLL’s loaded by the system, or you can do it for a specific process, which is probably more useful for the Enterprise Vault world.  Take for example the following from listdlls –r outlook.exe :

ListDLLs v2.25 – DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals – www.sysinternals.com

——————————————————————————
OUTLOOK.EXE pid: 940
Command line: “C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE”

Base        Size      Version            Path
0x2f1a0000  0xc5e000  12.00.6514.5000  C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE
0x77920000  0x13c000  6.01.7600.16559  C:WindowsSYSTEM32ntdll.dll
0x760f0000  0xd4000   6.01.7600.16481  C:Windowssystem32kernel32.dll
0x75cc0000  0x4a000   6.01.7600.16385  C:Windowssystem32KERNELBASE.dll
0x71130000  0x9b000   8.00.50727.4927  C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5MSVCR80.dll
0x75e10000  0xac000   7.00.7600.16385  C:Windowssystem32msvcrt.dll
0x76370000  0xa0000   6.01.7600.16385  C:Windowssystem32ADVAPI32.dll
0x77ab0000  0x19000   6.01.7600.16385  C:WindowsSYSTEM32sechost.dll
0x76880000  0xa1000   6.01.7600.16385  C:Windowssystem32RPCRT4.dll
0x760a0000  0x4e000   6.01.7600.16385  C:Windowssystem32GDI32.dll
0x76410000  0xc9000   6.01.7600.16385  C:Windowssystem32USER32.dll
0x77a80000  0xa000    6.01.7600.16385  C:Windowssystem32LPK.dll
0x76610000  0x9d000   1.626.7600.16385  C:Windowssystem32USP10.dll
0x77a90000  0x1f000   6.01.7600.16385  C:Windowssystem32IMM32.dll
0x77850000  0xcc000   6.01.7600.16385  C:Windowssystem32MSCTF.dll
0x75f40000  0x15c000  6.01.7600.16385  C:Windowssystem32ole32.dll
0x6bba0000  0x31000   6.01.7600.16385  C:Windowssystem32credui.dll
0x75a10000  0x4b000   6.01.7600.16481  C:Windowssystem32apphelp.dll
0x6d160000  0x7b000   6.01.7600.16385  C:WindowsAppPatchAcSpecfc.DLL
0x75950000  0x1a000   6.01.7600.16385  C:Windowssystem32SspiCli.dll
0x75c30000  0x84000   5.82.7600.16385  C:WindowsWinSxSx86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16385_none_ebf82fc36c758ad5COMCTL32.dll
0x6d0e0000  0x79000   6.01.7600.16385  C:Windowssystem32mscms.dll
0x750d0000  0x17000   6.01.7600.16385  C:Windowssystem32USERENV.dll
0x75a70000  0xb000    6.01.7600.16385  C:Windowssystem32profapi.dll
0x75d60000  0x57000   6.01.7600.16385  C:Windowssystem32SHLWAPI.dll
0x76a00000  0xc49000  6.01.7600.16532  C:Windowssystem32SHELL32.dll
0x74040000  0x32000   6.01.7600.16385  C:Windowssystem32WINMM.dll
0x6cff0000  0xe7000   6.01.7600.16385  C:Windowssystem32DDRAW.dll
0x6f340000  0x6000    6.01.7600.16385  C:Windowssystem32DCIMAN32.dll
0x761d0000  0x19d000  6.01.7600.16385  C:Windowssystem32SETUPAPI.dll
0x75d30000  0x27000   6.01.7600.16385  C:Windowssystem32CFGMGR32.dll
0x767f0000  0x8f000   6.01.7600.16385  C:Windowssystem32OLEAUT32.dll
0x75d10000  0x12000   6.01.7600.16385  C:Windowssystem32DEVOBJ.dll
0x74510000  0x13000   6.01.7600.16385  C:Windowssystem32dwmapi.dll
0x736c0000  0x12000   6.01.7600.16385  C:Windowssystem32MPR.dll
0x75ec0000  0x7b000   6.01.7600.16385  C:Windowssystem32COMDLG32.dll
0x76930000  0x35000   6.01.7600.16385  C:Windowssystem32WS2_32.dll
0x77ad0000  0x6000    6.01.7600.16385  C:Windowssystem32NSI.dll
0x6a290000  0x240000  5.00.7600.16385  C:Windowssystem32msi.dll
0x74b10000  0x19e000  6.10.7600.16385  C:WindowsWinSxSx86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfccomctl32.dll
0x5fd40000  0x1071000  12.00.6535.5002  C:Program FilesCommon FilesMicrosoft Sharedoffice12mso.dll
0x74840000  0x40000   6.01.7600.16385  C:Windowssystem32uxtheme.dll
0x62ce0000  0x2e6000  12.00.6514.5000  c:progra~1micros~2office12olmapi32.dll
0x74f70000  0x9000    6.01.7600.16385  C:Windowssystem32VERSION.dll
0x759a0000  0xc000    6.01.7600.16385  C:Windowssystem32CRYPTBASE.dll
0x76970000  0x83000   2001.12.8530.16385  C:Windowssystem32CLBCatQ.DLL
0x6f380000  0xb000    6.01.7600.16385  C:Windowssystem32msimtf.dll
0x61890000  0x5ad000  12.00.6421.1000  C:Program FilesMicrosoft OfficeOffice121033OUTLLIBR.DLL
0x61230000  0x655000  12.00.6425.1000  C:Program FilesCommon FilesMicrosoft SharedOFFICE12MSORES.DLL
0x6de20000  0x16000   6.01.7600.16385  C:Windowssystem32DavClnt.DLL
0x6f310000  0x8000    6.01.7600.16385  C:Windowssystem32DAVHLPR.dll
0x5f360000  0x9dd000  12.00.6425.1000  C:Program FilesCommon FilesMicrosoft Sharedoffice121033MSOINTL.DLL
0x713c0000  0x4a000   4.00.31106.0000  C:Windowssystem32mscoree.dll
0x712c0000  0x66000   4.00.30319.0001  C:WindowsMicrosoft.NETFrameworkv4.0.30319mscoreei.dll
0x631b0000  0x108000  12.00.6413.1000  C:Program FilesCommon FilesMicrosoft Sharedoffice12riched20.dll
0x63070000  0x131000  12.00.6415.1000  c:progra~1micros~2office121033mapir.dll
0x71710000  0x3000    6.01.7600.16385  C:Windowssystem32SFC.DLL
0x71700000  0xd000    6.01.7600.16385  C:Windowssystem32sfc_os.DLL
0x02ac0000  0x1140000  12.00.6535.5002  C:Program FilesMicrosoft OfficeOffice12wwlib.dll
0x5a950000  0xf50000  12.00.6425.1000  C:Program FilesMicrosoft OfficeOffice12oart.dll
0x74430000  0x5000    6.01.7600.16385  C:Windowssystem32MSIMG32.dll
0x6b740000  0x22000   12.00.6514.5000  c:progra~1micros~2office12contab32.dll
0x610b0000  0x173000  12.00.6509.5000  c:progra~1micros~2office12EMSMDB32.DLL
0x72840000  0x7000    6.01.7600.16385  C:Windowssystem32WSOCK32.dll
0x73e90000  0x10000   6.01.7600.16385  C:Windowssystem32NLAapi.dll
0x73460000  0x1c000   6.01.7600.16385  C:Windowssystem32IPHLPAPI.DLL
0x73450000  0x7000    6.01.7600.16385  C:Windowssystem32WINNSI.DLL
0x73000000  0x12000   6.01.7600.16385  C:Windowssystem32dhcpcsvc.DLL
0x72ff0000  0xd000    6.01.7600.16385  C:Windowssystem32dhcpcsvc6.DLL
0x71a60000  0x6000    6.01.7600.16385  C:Windowssystem32rasadhlp.dll
0x75ae0000  0x11c000  6.01.7600.16385  C:Windowssystem32CRYPT32.dll
0x77a60000  0xc000    6.01.7600.16415  C:Windowssystem32MSASN1.dll
0x60fa0000  0x110000  12.00.6514.5000  c:progra~1micros~2office12MSPST32.DLL
0x754d0000  0x16000   6.01.7600.16385  C:Windowssystem32CRYPTSP.dll
0x75270000  0x3b000   6.01.7600.16385  C:Windowssystem32rsaenh.dll
0x75a60000  0xe000    6.01.7600.16385  C:Windowssystem32RpcRtRemote.dll
0x74140000  0xc000    7.00.7600.16385  C:Windowssystem32mssprxy.dll
0x74080000  0x21000   6.01.7600.16385  C:Windowssystem32ntmarta.dll
0x75dc0000  0x45000   6.01.7600.16385  C:Windowssystem32WLDAP32.dll
0x10000000  0x3d0000  8.00.0003.0000  C:Program FilesEnterprise VaultEVClientValkyrie.dll
0x6bc50000  0x16000   1.00.2536.0000  C:Windowssystem32MAPI32.dll
0x764e0000  0xf4000   8.00.7600.16596  C:Windowssystem32WININET.dll
0x77b40000  0x3000    6.01.7600.16385  C:Windowssystem32Normaliz.dll
0x766b0000  0x135000  8.00.7600.16588  C:Windowssystem32urlmon.dll
0x77650000  0x1f9000  8.00.7600.16385  C:Windowssystem32iertutil.dll
0x74210000  0x11000   6.01.7600.16385  C:Windowssystem32NETAPI32.dll
0x74200000  0x9000    6.01.7600.16385  C:Windowssystem32netutils.dll
0x758c0000  0x19000   6.01.7600.16385  C:Windowssystem32srvcli.dll
0x741f0000  0xf000    6.01.7600.16385  C:Windowssystem32wkscli.dll
0x75930000  0x8000    6.01.7600.16385  C:Windowssystem32Secur32.dll
0x62fe0000  0x87000   8.00.50727.4927  C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5MSVCP80.dll
0x02960000  0x44000   8.00.0003.1845  C:Program FilesEnterprise VaultEVClientDesktopCommon.dll
0x6aa40000  0x7000    5.00.7600.16385  C:Windowssystem32msiltcfg.dll
0x759b0000  0x5f000   6.01.7600.16385  C:Windowssystem32SXS.DLL
0x6c7b0000  0xd000    12.00.6413.1000  C:Program FilesCommon FilesSYSTEMMSMAPI1033MSMAPI32.DLL
0x75350000  0x44000   6.01.7600.16385  C:Windowssystem32dnsapi.DLL
0x740e0000  0x52000   6.01.7600.16385  C:Windowssystem32RASAPI32.dll
0x740c0000  0x15000   6.01.7600.16385  C:Windowssystem32rasman.dll
0x740b0000  0xd000    6.01.7600.16385  C:Windowssystem32rtutils.dll
0x722d0000  0x6000    6.01.7600.16385  C:Windowssystem32sensapi.dll
0x75490000  0x3c000   6.01.7600.16385  C:WindowsSystem32mswsock.dll
0x718a0000  0x8000    6.01.7600.16385  C:WindowsSystem32winrnr.dll
0x71890000  0x10000   6.01.7600.16385  C:Windowssystem32napinsp.dll
0x71870000  0x12000   6.01.7600.16385  C:Windowssystem32pnrpnsp.dll
0x75000000  0x5000    6.01.7600.16385  C:WindowsSystem32wshtcpip.dll
0x75480000  0x6000    6.01.7600.16385  C:WindowsSystem32wship6.dll
0x730f0000  0x38000   6.01.7600.16385  C:WindowsSystem32fwpuclnt.dll
0x07750000  0x11f000  8.00.0003.1845  C:Program FilesEnterprise VaultEVClientDesktopClientCache.dll
0x05480000  0x40000   8.00.0003.1845  C:Program FilesEnterprise VaultEVClientEVRT.dll
0x6b9f0000  0x1b000   8.00.50727.4053  C:WindowsWinSxSx86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1ATL80.DLL
0x6a090000  0x3000    6.01.7600.16385  C:Windowssystem32security.dll
0x75170000  0x8000    6.01.7600.16385  C:Windowssystem32credssp.dll
0x72190000  0x132000  8.110.7600.16385  C:WindowsSystem32msxml3.dll
0x60e00000  0x196000  12.00.6509.5000  C:Program FilesCommon FilesMicrosoft SharedOFFICE12OGL.DLL
0x74b00000  0xd000    6.01.7600.16385  C:Windowssystem32WTSAPI32.DLL
0x75970000  0x29000   6.01.7600.16385  C:Windowssystem32WINSTA.dll
0x6b720000  0x11000   12.00.6413.1000  C:PROGRA~1MICROS~2Office12ADDINSCOLLEA~1.DLL
0x08b60000  0x87000   1.00.0000.0074  C:Program FilesEvernoteEvernote3.5enol.dll
0x62c30000  0xa2000   12.00.6510.5000  C:PROGRA~1MICROS~2Office12OMSMAIN.DLL
0x648a0000  0x32000   7.00.7600.16385  C:Windowssystem32mssphtb.dll
0x5d910000  0x6b000   12.00.4518.1014  C:PROGRA~1MICROS~2Office12ADDINSUMOUTL~1.DLL
0x6a250000  0x3c000   7.00.0000.0000  C:Windowssystem32OLEACC.dll
0x6bc80000  0xc000    12.00.4518.1014  C:Program FilesMicrosoft OfficeOffice121033UmOutlookStrings.dll
0x71dc0000  0x18000   6.01.7600.16385  C:Windowssystem32NTDSAPI.dll
0x75430000  0x42000   6.01.7600.16420  C:Windowssystem32msv1_0.DLL
0x75700000  0x11000   6.01.7600.16385  C:Windowssystem32cryptdll.dll
0x6c130000  0xc000    12.00.6500.5000  c:progra~1micros~2office12outlrpc.dll
0x651b0000  0x5e000   12.00.6504.5000  c:progra~1micros~2office12exsec32.dll
0x69e90000  0x58000   6.01.7600.16385  C:Program FilesCommon Filesmicrosoft sharedinktiptsf.dll
0x6ac90000  0xb000    6.01.7600.16385  C:Windowssystem32cscapi.dll
0x75c00000  0x2d000   6.01.7600.16493  C:Windowssystem32WINTRUST.dll
0x6f2c0000  0x2e000   6.01.7600.16385  C:Windowssystem32mlang.dll
0x63420000  0xd7000   12.00.6425.1000  C:Program FilesMicrosoft OfficeOffice121033wwintl.dll
0x63360000  0xba000   12.00.6421.1000  C:Program FilesCommon FilesMicrosoft SharedOFFICE12MSPTLS.DLL
0x74990000  0xf5000   7.00.7600.16385  C:Windowssystem32propsys.dll
0x78800000  0x15c000  5.20.1087.0000  C:Program FilesCommon FilesMicrosoft SharedOFFICE11msxml5.dll
0x6ba40000  0x14000   12.00.6414.1000  C:Program FilesMicrosoft OfficeOffice12MSOHEV.DLL
0x65250000  0x2b000   12.00.6500.5000  c:progra~1micros~2office12outlph.dll
0x74530000  0x39000   6.01.7600.16385  C:Windowssystem32MMDevAPI.DLL
0x73ee0000  0x30000   6.01.7600.16385  C:Windowssystem32wdmaud.drv
0x73ed0000  0x4000    6.01.7600.16385  C:Windowssystem32ksuser.dll
0x743a0000  0x7000    6.01.7600.16385  C:Windowssystem32AVRT.dll
0x73df0000  0x36000   6.01.7600.16385  C:Windowssystem32AUDIOSES.DLL
0x73d00000  0x8000    6.01.7600.16385  C:Windowssystem32msacm32.drv
0x73ce0000  0x14000   6.01.7600.16385  C:Windowssystem32MSACM32.dll
0x73cd0000  0x7000    6.01.7600.16385  C:Windowssystem32midimap.dll
0x63520000  0x5c000   7.00.7600.16385  C:WindowsSystem32StructuredQuery.dll
0x6bc70000  0x8000    12.00.4518.1014  C:PROGRA~1MICROS~2Office12OUTLACCT.DLL
0x6b950000  0x10000   6.01.7600.16385  C:Windowssystem32msident.dll
0x6b940000  0xd000    6.01.7600.16385  C:Windowssystem32PSTOREC.DLL
0x73e40000  0x14000   3.05.2284.0000  C:Windowssystem32ATL.DLL
0x63730000  0x56000   6.01.7600.16385  C:Windowssystem32msdrm.dll
0x6f6a0000  0x2b000   8.00.7600.16588  C:Program FilesInternet Explorerieproxy.dll
0x6b6c0000  0x51000   6.01.7600.16385  C:Windowssystem32Winspool.DRV
0x34f00000  0x73000   12.00.5324.0000  C:Program FilesMicrosoft OfficeOffice12OUTLFLTR.DLL
0x6bc90000  0xb000    6.01.7600.16385  C:Windowssystem32idndl.dll
0x61e70000  0x65000   12.00.6501.5000  c:progra~1micros~2office12rtfhtml.dll
0x5b930000  0x38000   6.01.7600.16385  C:Windowssystem32msoeacct.dll
0x6df10000  0x1c000   6.01.7600.16385  C:Windowssystem32MSOERT2.dll
0x6cea0000  0xb9000   6.01.7600.16543  C:Windowssystem32INETCOMM.dll
0x6dd90000  0x16000   6.01.7600.16385  C:Windowssystem32inetres.dll
0x63510000  0xb000    6.01.7600.16385  C:Windowssystem32acctres.dll
0x62fd0000  0x8000    6.01.7600.16385  C:Windowssystem32msadp32.acm
0x72d80000  0x23000   6.01.7600.16385  C:Windowssystem32WinSCard.dll
0x637c0000  0xb7000   6.00.6415.1000  C:Program FilesMicrosoft OfficeOffice12msproof6.dll
0x6a1c0000  0xd000    6.01.7600.16385  C:Windowssystem32fxsext32.dll
0x6f1a0000  0x3a000   6.01.7600.16385  C:Windowssystem32FXSAPI.dll
0x6c950000  0xe3000   6.01.7600.16385  C:Windowssystem32FXSRESM.DLL
0x637a0000  0x18000   6.01.7600.16385  C:Windowssystem32HLINK.DLL
0x554f0000  0x174c000  6.00.6413.1000  C:Program FilesMicrosoft OfficeOFFICE12NLSDATA0009.DLL
0x552d0000  0x21b000  6.00.6415.1000  C:Program FilesMicrosoft OfficeOFFICE12NLSLEXICONS0009_SP.dll
0x54cd0000  0x5f8000  6.00.6413.1000  C:Program FilesMicrosoft OfficeOFFICE12NLSMODELS0009.dll
0x742a0000  0xfb000   6.01.7600.16385  C:Windowssystem32WindowsCodecs.dll
0x05e50000  0x17000   1.00.0000.0013  C:Usersrobert_wilcoxAppDataRoamingDropboxbinDropboxExt.13.dll
0x73a30000  0xeb000   6.01.7600.16385  C:Windowssystem32dbghelp.dll
0x7c3a0000  0x7b000   7.10.3077.0000  C:Usersrobert_wilcoxAppDataRoamingDropboxbinMSVCP71.dll
0x7c340000  0x56000   7.10.3052.0004  C:Usersrobert_wilcoxAppDataRoamingDropboxbinMSVCR71.dll
0x6ad20000  0x31000   6.01.7600.16385  C:Windowssystem32EhStorShell.dll
0x6acb0000  0x6a000   6.01.7600.16385  C:WindowsSystem32cscui.dll
0x6aca0000  0x9000    6.01.7600.16385  C:WindowsSystem32CSCDLL.dll
0x6ac20000  0x6f000   6.01.7600.16385  C:Windowssystem32ntshrui.dll
0x73d10000  0xa000    6.01.7600.16385  C:Windowssystem32slc.dll
0x62890000  0xc6000   6.01.7600.16385  C:WindowsSystem32NaturalLanguage6.dll
0x5dd70000  0x4ac000  6.01.7600.16385  C:WindowsSystem32NLSData0009.dll
0x5dae0000  0x283000  6.01.7600.16385  C:WindowsSystem32NLSLexicons0009.dll
0x6fde0000  0x17e000  7.00.7600.16385  C:Windowssystem32tquery.dll
0x73d50000  0xe000    12.00.6501.5000  C:PROGRA~1MICROS~2Office12ADDINSOUTLVBA.DLL
0x114a0000  0x27b000  6.05.0010.0053  C:PROGRA~1COMMON~1MICROS~1VBAVBA6VBE6.DLL
0x65300000  0x26000   6.05.0010.0040  C:PROGRA~1COMMON~1MICROS~1VBAVBA61033VBE6INTL.DLL
0x74400000  0xf000    12.00.6500.5000  C:Program FilesMicrosoft OfficeOffice12OUTLVBS.DLL
0x6b980000  0x6b000   5.08.7600.16546  C:Windowssystem32vbscript.dll

You can spot a couple of good references in here :

EV Outlook Add-in :

0x10000000  0x3d0000  8.00.0003.0000  C:Program FilesEnterprise VaultEVClientValkyrie.dll

And Evernote :

0x08b60000  0x87000   1.00.0000.0074  C:Program FilesEvernoteEvernote3.5enol.dll

It is definitely something that I will keep in my arsenal of tools to use.

Remember when trying to run it on Windows Vista, Windows 7, Windows 2008 etc, you have to run with an elevated command prompt, or you get this :

C:temp>listdlls outlook.exe

ListDLLs v2.25 – DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals – www.sysinternals.com

You do not have the DEBUG privilege, which is required to run this program

Here is a link to the tool : http://technet.microsoft.com/en-us/sysinternals/bb896656.aspx

If you enjoyed this post, please consider leaving a comment or subscribing to the RSS feed to have future articles delivered to your feed reader.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)