0

I want to know which DLL is loaded/unloaded in which process (globally). The purpose is to find a process loading and unloading DLLs on the fly. I use following breakpoints in windbg (kd), but nothing found!

bp kernel32!LoadlibraryA "da poi(esp+4);g" bp kernel32!LoadlibraryW "du poi(esp+4);g"

any user/kernel mode ida?

Improve this question

1 Answer 1

Reset to default
2

You can enable FLG_SHOW_LDR_SNAPS in GFlags to get DLL loading and unloading notifications in WinDbg or DebugView for all processes on the system.

Improve this answer
3
  • It was useful thanx! when I set the flag and for example right click on task-bar, it doesn't show any loaded dll. but I'm sure that "browselc.dll" is loading each time I do it ( using break on loadlibrary )
    – diener_k
    May 5, 2015 at 6:07
  • 1
    That's because the DLL was already loaded before you right-clicked on the taskbar.
    – Jason Geffner
    May 5, 2015 at 14:08
  • Got it! So it meanse FLG_SHOW_LDR_SNAPS shows real loadings only and bp on Loadlibrary shows both load and get handle!
    – diener_k
    May 6, 2015 at 6:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.