• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 579
  • Last Modified:

Is program using a particular DLL

I need a way to programmatically find if a program (exe) is using a particular dll, named DINPUT8.dll.

I can do this easily by using Process Explorer, if you right-click on a process and choose Properties, and choose Threads tab, you can see if it is using it.
Now I would need a method to programmatically obtain such an information, and if possible such that would work both on 32 and 64bit systems.
  • 2
  • 2
3 Solutions
Try this, loops through all processes. (vb.net)

    Private Sub Form1_Load(ByVal sender As Object, ByVal e As EventArgs) Handles MyBase.Load
        Dim files As New List(Of String)()

        Dim procList As Process() = Process.GetProcesses()

        For i As Integer = 0 To procList.Length - 1

                'Get all modules inside the process
                Dim modulesList As Process() = Process.GetProcessesByName(procList(i).ProcessName)
                ' Populate the module collection.
                Dim modules As ProcessModuleCollection = modulesList(0).Modules

                ' Iterate through the module collection.

                For Each objModule As ProcessModule In modules

                    Dim modulePath = objModule.FileName.ToString()
                ' add error checking
            Catch generatedExceptionName As Exception

            End Try
    End Sub
You can use CreateToolhelp32Snapshot.
You may want to consider using VB.NET if you want to compatability with x64 systems...
" If the specified process is a 64-bit process and the caller is a 32-bit process, this function fails and the last error code is ERROR_PARTIAL_COPY (299)."

Option Explicit

Private Const TH32CS_SNAPMODULE As Long = &H8&
Private Const TH32CS_SNAPMODULE32 As Long = &H10&

Private Const INVALID_HANDLE_VALUE As Long = (-1)

dwSize As Long
th32ModuleID As Long
th32ProcessID As Long
GlblcntUsage As Long
ProccntUsage As Long
modBaseAddr As Byte
modBaseSize As Long
hModule As Long
szModule As String * 256
szExePath As String * 260
End Type

Private Declare Function CreateToolhelp32Snapshot Lib "kernel32.dll" ( _
  ByVal dwFlags As Long, _
  ByVal th32ProcessID As Long) As Long

Private Declare Function Module32FirstW Lib "kernel32.dll" ( _
  ByVal hSnapshot As Long, _
  ByVal lpme As Long) As Long

Private Declare Function Module32NextW Lib "kernel32.dll" ( _
  ByVal hSnapshot As Long, _
  ByVal lpme As Long) As Long
Private Declare Function CloseHandle Lib "kernel32.dll" ( _
  ByVal hObject As Long) As Long
Public Sub EnumModuleByProcessId(ByVal pid As Long)
  '// Note: Example doesn't remove null from the buffer.
  Dim hSnapshot     As Long
  Dim entry         As MODULEENTRY32W
  hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid)
  If hSnapshot = (-1) Then
    Debug.Print "Invalid handle"; Err.LastDllError
    Exit Sub
  End If
  entry.dwSize = LenB(entry)
  ' // first module
  If Module32FirstW(hSnapshot, VarPtr(entry)) Then
    Debug.Print entry.szModule
    Debug.Print entry.szExePath
    '// next module
    Do While Module32NextW(hSnapshot, VarPtr(entry)) <> 0
        Debug.Print entry.szModule
        Debug.Print entry.szExePath
    Loop ' or  ERROR_NO_MORE_FILES
  End If
  Debug.Print Err.LastDllError
  CloseHandle hSnapshot
End Sub

Open in new window

npaunAuthor Commented:
Hi, thanks, both examples work. Although, I would proffer to avoid use of separate .Net if possible. I realized that this may be easily achievable for both x64/x86 by using WMI, do you maybe know can it and how?
this example will show any process that has Kerne32 loaded , Change Check for to the dll you want.
dim checkFor
dim wmi
checkfor= "kernel32"
set wmi = getobject("winmgmts:")
set oProcesses = wmi.ExecQuery("select * from WIN32_Process")
for each oProcess in oProcesses
 set oFileAssociations = wmi.ReferencesTo(oProcess.Path_.path, "CIM_ProcessExecutable")
 for each oFileAssociation in oFileAssociations
  set oFile = wmi.Get(oFileAssociation.Antecedent)
  if oFile.FileName = checkfor and oFile.Extension = "dll" then
   wscript.echo oProcess.name + " has kernel32.dll loaded"
  end if
npaunAuthor Commented:
thanks. I accepted all three answers, as all of them have their use and limitations for me. Unfortunately, I have only 500 pts to split.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now