Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called during a program invocation.
Is there a way to accomplish this?
Dependency Walker is your friend.
Note that it's almost impossible to find out which libraries/entry points a program uses by static analysis alone, since the strings passed to LoadLibrary and GetProcAddress might be obfuscated, i.e. not visible in the binary. Dependency Walker catches those calls at runtime, which means a) you need to run the program - which may not be advisable if it's known malware - and b) it still might miss something if you don't execute that path of code. But within these restrictions, it's about the best you can get.
