How to check if an Executable loaded certain Dll at runtime?

[Maya]

Good Morning,
Suppose we are monitoring the execution of "Test.exe" which loads "TestDll.dll" at runtime.

How to check if this Executable is already loaded this Dll?
and, how to get the "Module Handle" of this Dll?

Any help will be much appreciated.

[jacdelad]

Via command line:

Code: Select all

C:\>tasklist /m /fi "services eq Winmgmt"

Image Name                     PID Modules
========================= ======== ============================================
svchost.exe                    872 ntdll.dll, kernel32.dll, KERNELBASE.dll,
                                   msvcrt.dll, sechost.dll, RPCRT4.dll,
                                   ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
                                   USP10.dll, IMM32.DLL, MSCTF.dll,...

Include this call into your program.

[Maya]

Via command line:

Code: Select all

C:\>tasklist /m /fi "services eq Winmgmt"

Image Name                     PID Modules
========================= ======== ============================================
svchost.exe                    872 ntdll.dll, kernel32.dll, KERNELBASE.dll,
                                   msvcrt.dll, sechost.dll, RPCRT4.dll,
                                   ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
                                   USP10.dll, IMM32.DLL, MSCTF.dll,...

Include this call into your program.

I mean thru PureBasic!

[AZJIO]

Code: Select all

If OpenLibrary(#Library , Filename$)
	Debug "already loaded"
	Debug LibraryID(#Library)
EndIf

[Maya]

Code: Select all

If OpenLibrary(#Library , Filename$)
	Debug "already loaded"
	Debug LibraryID(#Library)
EndIf

Dear AZJIO:
YOU ARE MY HERO!
Thank you very much..

[jacdelad]

What?

Suppose we are monitoring the execution of "Test.exe" which loads "TestDll.dll" at runtime.

This sounds absolutely like your program monitors a different program and wants to know whether this different program has loaded a certain dll...

[PoorMan]

This sounds absolutely like your program monitors a different program and wants to know whether this different program has loaded a certain dll...

So what?

[DarkDragon]

This sounds absolutely like your program monitors a different program and wants to know whether this different program has loaded a certain dll...

So what?

OpenLibrary is inside the current process. Not in the monitored one as in the problem description. Also it is actively loading the DLL. It doesn't check whether the DLL has been loaded, it loads the DLL. If the process would never touch the DLL you wouldn't know because you loaded it.