3

In order to port a program (32 bit) from Win XP to Win 7/8/10 (64 bit), I have to list its dependencies ( all the dependency tree if possible). I've tried several tools that I'm aware of:

  • Dependency walker - doesn't see the Wow64 layer.
  • ProcessExplorer - gave another result and this time the Wow64 layer appears but not all the tree.

How could I list the exact list of dependency of my program ?

  • Why do you need to see the depandencies if you have the source file? In general, during development stage you need to take into account 64 bit target, so that the appropriate APIs and types are used. In addition, there are some peculiarities that must be taken care of when targeting the above OSs. You need to consult MSDN for this. As to the question, you do not need to see the whole tree as wow64 layer is sufficient to understand what APIs are used. Take into account that you will not see APIs that are resolved during runtime. – PhoeniX Jan 5 '15 at 8:38
  • This is an old program, i can't find every sources, some of them are lost, maybe with the IDE that were used to make this program. I need to see the dependencie tree in order to ensure that the program will work on future OSs and if not, We have to know were do we have to search – Florian GERARD Jan 5 '15 at 8:54
  • While it maybe doesn't anwser your question directly, I'd like to add that when everything else fails, you can try to use procmon to see what DLLs Windows tries to load. It's not offline method, and it doesn't show you any tree, but it has a great advantage that you can see what your application really tries to load and in what order. – cubuspl42 Nov 3 '18 at 2:01
4

You can use the following tools to inspect and try to recover information about PE file:

  • PEiD it has extensive pe file editing capabilities
  • Detect It Easy - another very useful tool for PE analysis
  • Viewing import table from windbg - if the above will not be very helpful, you can always use the debugger.
  • Dumbin - Microsoft utility to inspect PE file, among which is PE imports.

Those tools can show all the information about the imports that the program has.

  • Thank you, that helps me to understand why processExplorer hasn't the same result. – Florian GERARD Jan 13 '15 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.