How to get a list of used DLLs?

Question

I would like to get a list of used DLLs from application itself. My goal is to compare the list with hardcoded one to see if any DLL is injected. I can not find any examples in Google.

Answer 1

You can use PSAPI for this. The function you need is EnumProcessModules. There's some sample code on MSDN.

The main alternative is the Tool Help library. It goes like this:

• Call CreateToolhelp32Snapshot.
• Start enumeration with Module32First.
• Repeatedly call Module32Next.
• When you are done call CloseHandle to destroy the snapshot.

Personally, I prefer Tool Help for this task. Here's a very simple example:

{$APPTYPE CONSOLE}

uses
  SysUtils, Windows, TlHelp32;

var
  Handle: THandle;
  ModuleEntry: TModuleEntry32;
begin
  Handle := CreateToolHelp32SnapShot(TH32CS_SNAPMODULE, 0);
  Win32Check(Handle <> INVALID_HANDLE_VALUE);
  try
    ModuleEntry.dwSize := Sizeof(ModuleEntry);
    Win32Check(Module32First(Handle, ModuleEntry));
    repeat
      Writeln(ModuleEntry.szModule);
    until not Module32Next(Handle, ModuleEntry);
  finally
    CloseHandle(Handle);
  end;
  Readln;
end.