ListDlls is a free command line utility that lets you view the list of Windows DLL files (Dynamic Link Library) loaded. You can also use ListDlls to view DLL files used by a particular process or view the list of all processes using a particular DLL file. You can view the version information for the DLLs and also use filters to view only the unsigned DLL files currently loaded. This tool can be very useful while you’re trying to troubleshoot a particular application or any other issues with regards to the Windows DLL files.
What are DLLs?
DLL stands for Dynamic Link Library and are library files where applications and the operating system have their basic and commonly used functions saved. An application can always load a specific DLL file when in need and unload it when it’s done using it.
How to use ListDlls?
To use ListDlls, we would require to access command prompt. As this tool doesn’t have a graphical interface, it displays the output on to the console. You can open command prompt by pressing the Windows Key and “R” key. The “Run” box will popup on the screen where you can type in “cmd” and click on “OK” to get to the command prompt.
Once we’re in the Command Prompt, we can start using ListDlls and view the Windows DLLs and those from other applications.
You can pass on the information to ListDlls via the command line arguments. Arguments are just a way of providing the information to a program via the command line (though arguments are not restricted to command line applications only).
Arguments with ListDlls
View all DLLs loaded
To view all the DLL files currently loaded, you can use ListDlls without any arguments or parameters. Just by typing the name of the program and hitting the “Enter” key would get you all the Windows Dlls and the ones from other applications, displayed on the screen.
There could be hundreds of DLL files loaded so the list would skip your eyes quickly. To avoid this, you can use “| more” with ListDlls to display the output per page.
This is how we do it:
listdlls | more
Filter DLL files by process ID or Process Name
You can filter out the DLL files loaded by the Process ID of a process or its name. This would just show you the DLL files loaded for a particular process. You can simply type in the Process ID or the name of the process after Listdlls.
Ex:
listdlls foxit OR listdlls 4552
In the above command, we want ListDlls to list all the DLL files loaded by the “Foxit PDF reader”. You can specify the name of the process and you can even work with partial names. ListDlls will list the DLLs for the closest match. You can find out the process id of a process with software like Task Manager (with Windows), tasklist – the command line version of Task Manager or any other Task Manager software.
List unsigned DLL files
You might want to know the difference between a signed and unsigned DLL file. To put it simply, Signed DLL files are those from a trusted source whereas unsigned are those that may not be from a trusted source (though this does not mean that all unsigned DLLs are not from a trusted source). You can filter out all the unsigned DLL files loaded in the system. You can use this feature to track down any DLL file that is currently loaded and seems to be illegitimate. To list all the unsigned DLL files, use the ‘-u‘ option.
Ex:
listdlls -u OR listdlls -u | more
Searching for a specific DLL
You might want to confirm what all applications in your computer is using a particular DLL. You can co-relate this to what we talked about unsigned DLLs. It could be an unsigned DLL that you came across and want to verify if it’s being used by any of the software you use or if it’s some malicious software that got installed in your computer. You can use the ‘-d‘ option and specify the DLLs name.
Ex:
listdlls -d updater.dll
In the above command, we were looking for a DLL file named ‘updater.dll’ that could be a Windows DLL or from another application that I might use but I don’t know yet. When we check with ListDlls, it is clear that it is being used by “Skype” that I just forgot to sign-off.
Version information for a DLL
If you want to get more information about a DLL file then you can simple use the ‘-v‘ option to view the version information of a Windows DLL file or any other DLL file loaded. You can also combine this option with ‘-d‘ option to get the version information about a specific DLL file.
Ex:
listdlls -v OR listdlls -v -d updater.dll
Conclusion
ListDlls is simple and powerful tool with which you can view all the DLL file loaded in the system. ListDlls can display all the unsigned Windows DLLs and other DLLs in the system to give you a head start while you’re troubleshooting. As you can get the version information and the name of the application using a particular DLL, you can use it while you’re trying to track down a malicious program that got in to the system. Most common ones of this type is an adware. This is a must have tool in your arsenal of troubleshooting tools.
