1

I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called during a program invocation.

Is there a way to accomplish this?

5

Dependency Walker is your friend.

Note that it's almost impossible to find out which libraries/entry points a program uses by static analysis alone, since the strings passed to LoadLibrary and GetProcAddress might be obfuscated, i.e. not visible in the binary. Dependency Walker catches those calls at runtime, which means a) you need to run the program - which may not be advisable if it's known malware - and b) it still might miss something if you don't execute that path of code. But within these restrictions, it's about the best you can get.

  • I really have to thank you, I didn't know that and I can finally inspect a list of calls that the application did (it seemed suspicious at first that the app didn't use any of the calls I thought it did). Thank you! – Marco A. Sep 5 '14 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.