Is there a good place to search information about known DLLs?

Question

I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be documentation pages for common DLLs, or at least all of Microsoft's DLLs, but mostly when I Google for information about DLLs there are a lot of How to fix your missing VCRUNTIME140.dll or such.

Is there really no great way of getting information about DLLs asides from looking at them yourself or happening to find answers or references at various places online?

Answer 1

I'm sorry to have to correct you, but VCRUNTIME140.dll is for example no known DLL (checked on Windows 7). "Known DLLs" is in fact a term that refers to a well-defined subset and the NT object manager is exactly the way to find out about which ones are known DLLs.

But that's likely not what you're asking. Instead you might want to try out the Dependency Walker or a similar tool to find out what functions are exported by certain DLLs. Then look up these functions on MSDN to find out what they're doing.

But if that is seriously where you are coming from, you may want to start by grabbing a book on Win32 API programming or read some tutorials. Either way reverse engineering should follow the engineering part. Which is to say that the engineering expertise is a prerequisite. In your case that means intimate knowledge of lots of aspects of Windows already as a prerequisite.

Anyway, DLLs have gotten messy/orderly depending on whom you ask. There are so-called API sets which Windows uses since Windows 7 (IIRC) to group functions.

Check out these two resources regarding API sets:

• Windows 7 Kernel Architecture Changes - api-ms-win-core files ... the title is a misnomer and seems to refer more to kernel32.dll than to the actual Windows kernel.
• The API set schema

Hope this helps a bit to get you started, but quite honestly if you don't already have an excellent working knowledge of Windows programming and architecture you might want to postpone picking up Windows targets for reverse engineering.

---

Actual known DLLs on a Windows 7. You can see (and export) such a list yourself using a tool like this one.

\KnownDlls [Directory]
    advapi32.dll [Section]
    api-ms-win-downlevel-advapi32-l1-1-0.dll [Section]
    api-ms-win-downlevel-normaliz-l1-1-0.dll [Section]
    api-ms-win-downlevel-ole32-l1-1-0.dll [Section]
    api-ms-win-downlevel-shlwapi-l1-1-0.dll [Section]
    api-ms-win-downlevel-user32-l1-1-0.dll [Section]
    api-ms-win-downlevel-version-l1-1-0.dll [Section]
    CFGMGR32.dll [Section]
    clbcatq.dll [Section]
    COMCTL32.dll [Section]
    COMDLG32.dll [Section]
    CRYPT32.dll [Section]
    DEVOBJ.dll [Section]
    difxapi.dll [Section]
    gdi32.dll [Section]
    IERTUTIL.dll [Section]
    IMAGEHLP.dll [Section]
    IMM32.dll [Section]
    kernel32.dll [Section]
    KERNELBASE.dll [Section]
    KnownDllPath [SymbolicLink] -> C:\Windows\system32
    LPK.dll [Section]
    MSASN1.dll [Section]
    MSCTF.dll [Section]
    MSVCRT.dll [Section]
    NORMALIZ.dll [Section]
    NSI.dll [Section]
    ntdll.dll [Section]
    ole32.dll [Section]
    OLEAUT32.dll [Section]
    profapi.dll [Section]
    PSAPI.DLL [Section]
    rpcrt4.dll [Section]
    sechost.dll [Section]
    Setupapi.dll [Section]
    SHELL32.dll [Section]
    SHLWAPI.dll [Section]
    URLMON.dll [Section]
    user32.dll [Section]
    USERENV.dll [Section]
    USP10.dll [Section]
    WININET.dll [Section]
    WINTRUST.dll [Section]
    WLDAP32.dll [Section]
    WS2_32.dll [Section]
\KnownDlls32 [Directory]
    advapi32.dll [Section]
    api-ms-win-downlevel-advapi32-l1-1-0.dll [Section]
    api-ms-win-downlevel-normaliz-l1-1-0.dll [Section]
    api-ms-win-downlevel-ole32-l1-1-0.dll [Section]
    api-ms-win-downlevel-shlwapi-l1-1-0.dll [Section]
    api-ms-win-downlevel-user32-l1-1-0.dll [Section]
    api-ms-win-downlevel-version-l1-1-0.dll [Section]
    CFGMGR32.dll [Section]
    clbcatq.dll [Section]
    COMCTL32.dll [Section]
    COMDLG32.dll [Section]
    CRYPT32.dll [Section]
    CRYPTBASE.dll [Section]
    DEVOBJ.dll [Section]
    difxapi.dll [Section]
    gdi32.dll [Section]
    IERTUTIL.dll [Section]
    IMAGEHLP.dll [Section]
    IMM32.dll [Section]
    kernel32.dll [Section]
    KERNELBASE.dll [Section]
    KnownDllPath [SymbolicLink] -> C:\Windows\syswow64
    LPK.dll [Section]
    MSASN1.dll [Section]
    MSCTF.dll [Section]
    MSVCRT.dll [Section]
    NORMALIZ.dll [Section]
    NSI.dll [Section]
    ntdll.dll [Section]
    ole32.dll [Section]
    OLEAUT32.dll [Section]
    profapi.dll [Section]
    PSAPI.DLL [Section]
    rpcrt4.dll [Section]
    sechost.dll [Section]
    Setupapi.dll [Section]
    SHELL32.dll [Section]
    SHLWAPI.dll [Section]
    SspiCli.dll [Section]
    URLMON.dll [Section]
    user32.dll [Section]
    USERENV.dll [Section]
    USP10.dll [Section]
    WININET.dll [Section]
    WINTRUST.dll [Section]
    WLDAP32.dll [Section]
    WS2_32.dll [Section]

Answer 2

if they are Microsoft dlls you are interested to know about then ms normally provides a concise description of its dlls functionality in it FileVersion information

also other legitimate dlls do provide this information

(malware dlls or unknown authors dlls may not have it or may be faked up so it is just an indicator that can be trusted with a trusted base of dll not for arbitrary binaries )

you can right click the dll in question and look at the Details Tab

or you can script it to dump a bunch of dlls as shown below

contents of batch file

C:\>cat dlldesc.bat
@echo off
for /f %%i in ('dir /s /b c:\windows\system32\*.dll') do powershell -c "(((get-command "%%i).FileVersionInfo).FileDescri
ption)"

result on execution

C:\>dlldesc.bat
Anywhere access client
acadficn
Ease of access  control panel
Microsoft Internet Account Manager Resources
Access Control List Editor
Security Descriptor Editor
Compatibility Tab Shell Extension Library
Action Center
Action Center Control Panel
Unattend Action Queue Generator / Executor
ADs Router Layer DLL
ActiveX Interface Marshaling Library
ADAL.Native for x86
IEAK Global Policy Template Parser
Administrative Templates Extension
adprovider DLL
ADs LDAP Provider DLL
ADs LDAP Provider C DLL
ADs LDAP Provider DLL
ADs Windows NT Provider DLL
Security Audit Schema DLL
Terminate batch job (Y/N)? y

C:\>