How can I determine which Windows DLL is being used for a function call?

Question

I've been looking into _vsnprintf and have learnt that it is available in ntdll.dll and msvcrt.dll.

I can use GetModuleHandle and GetProcAddress to access _vsnprintf, for example:

static int(__cdecl *p__vsnprintf)(char *str, size_t count, const char *format, va_list valist);

static void init(const char *dll)
{
    HMODULE hmod = GetModuleHandleA(dll);
    if (hmod)
    {
        printf("*** Testing %s ***\n", dll);

        p__vsnprintf = (void *)GetProcAddress(hmod, "_vsnprintf");
        if (p__vsnprintf) test__vsnprintf();
        else printf("_vsnprintf not found in %s.\n", dll);
    }
    else printf("*** Unable to load %s ***\n", dll);

    printf("\n");
}

int main(void)
{
    init("ntdll.dll"); /* ntdll _vsnprintf */
    init("msvcrt.dll"); /* msvcrt _vsnprintf */

    printf("*** Testing normal function call ***\n");
    test_vsnprintf(); /* _vsnprintf in ??? */

    return 0;
}

For the generic call, how can I tell whether Windows is using _vsnprintf from ntdll.dll or msvcrt.dll?

Answer 1

dumpbin /imports will tell you. Also, the handy depends utility.