A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.

Overview

Dependencies - An open-source modern Dependency Walker

Build status

Download here

(If you're running an AV, use this download instead)

NB : due to limitations on /clr compilation, Dependencies needs Visual C++ Redistributable installed to run properly.

Usage Exemple

Overview

Dependencies is a rewrite of the legacy software Dependency Walker which was shipped along Windows SDKs, but whose development stopped around 2006. Dependencies can help Windows developers troubleshooting their dll load dependencies issues.

Releases

  • v1.11 :
    • lots of bugfixes and incremental improvements
    • covid pandemic
  • v1.10 :
    • lots of bugfixes and incremental improvements
    • support of Windows 8.1 apisets parsing
  • v1.9 :
    • Display imports and exports the way Depends.exe does.
    • Added user customization for search folders and working directory
    • Added LLVM demangler to availables symbol demangling
    • Fixed Wow64 FsRedirection bugs
    • F5 can now refresh the analysis
    • Added CLR assembly dependencies enumeration
    • Added a packaging option without Peview.exe (which triggers some AV).
  • v1.8 :
    • Add x86/x64 variants for Dependencies
  • v1.7 :
    • Add CLI tool "dependencies.exe"
  • v1.6 :
    • Add appx packaging
  • v1.5 :
    • Support of Sxs parsing
    • Support of api set schema parsing
    • API and Modules list can be filtered
  • v1.0 -- Initial release

Installation and Usage

Dependencies is currently shipped as two binaries (no installer present) : Dependencies.exe as a CLI tool and DependenciesGui.exe for its GUI counterpart (see screenshot). Just click on one of the release numbers above (preferably the latest), download and uncompress the archive and run DependenciesGui.exe. Since the binary is not signed, SmartScreen might scream at runtime. Dependencies also bundle ClrPhTester.exe, a dumpbin-like executable used to test for non-regressions.

Dependencies currently does not recursively resolve child imports when parsing a new PE since it can be really memory-hungry to do so ( it can over a GB even for "simple" PEs ). This behavior can be overridden (app-wide) via a property located in "Options->Properties->Tree build behaviour".

User options

Tree build behaviours available :

  • ChildOnly (default) : only process PE child imports and nothing beyond.
  • RecursiveOnlyOnDirectImports : do not process delayload dlls.
  • Recursive : Full recursive analysis. You better have time and RAM on your hands if you activate this setting :

Yes that's 7 GB of RAM being consumed. I'm impressed the application didn't even crash

Limitations

At the moment, Dependencies recreates features and "features" of depends.exe, which means :

  • Only direct, forwarded and delay load dependencies are supported. Dynamic loading via LoadLibrary are not supported (and probably won't ever be).
  • Support of api set schema redirection since 1.5
  • Checks between Api Imports and Exports.
  • Minimal support of sxs private manifests search only.

Building

Building is pretty straightforward. The only caveat is you need to select the "Debug" or "Release" configuration and "x64" or "x86" platform which may not be the default.

Credits and licensing

Special thanks to :

Comments
  • do I need to build the .exe files, and if so how?

    do I need to build the .exe files, and if so how?

    On windows10 I have unzipped the repo but there are no Dependencies.exe files to be found. do I need to build them? I have ms VisualStudio but no idea what to do.

    opened by nickums 9
  • msvsmon.exe fault

    msvsmon.exe fault

    On the Windows x64 machine, if you open the following file:

    C:\Program Files (x86)\Microsoft Visual Studio\2019\Common7\IDE\Remote Debugger\x86\msvsmon.exe

    An error occurs at this location.

    DependenciesGui\DependencyWindow.xaml.cs:627 AssemblyDefinition PeAssembly = AssemblyDefinition.ReadAssembly(newPe.Filepath);

    Maybe when you open a file that's not a dotnet assembly, you get a fault.

    I've revised it. Please review it.

    opened by sj6219 8
  • Ordinals and hints shall be 16bit numbers

    Ordinals and hints shall be 16bit numbers

    Ordinals and hints shall be unsigned 16bit numbers, but Dependencies displays them as signed 32bit numbers. Tested on 64bit Windows 7 with 64bit Dependencies v1.10.0.0 inspecting a 64bit version of API Monitor (https://www.rohitab.com/apimonitor).

    Best regards, Marek Knápek

    16vs32a

    16vs32b

    opened by MarekKnapek 7
  • Ability to sort output in command line

    Ability to sort output in command line

    Hi,

    First of all, this tool has been a lifesaver for me! I use it to ensure that no new API functions are used unless reviewed for compatibility (such as software designed to support Windows 7 starts using something available from Windows 8 only).

    I wonder if "dependencies.exe -imports" output can be optionally sorted by name? The issue here is every time the exe dependencies are changed, the order of imports changes too. Which makes it difficult to DIFF during our reviews. If these are sorted, DIFF would work just fine.

    I could try to post-process it via command line sort utilities, but it's not an easy solution because the output is structured by module name and line-level sorting breaks this structure.

    Thanks!

    opened by mikewa1 6
  • Depends style import list option

    Depends style import list option

    Something that initially threw me off when I tried this utility out was that the import list (top right) behaves differently than the original Depends utility.

    In the original Depends, when you select a module from the tree view (left), the import list shows those functions that are imported from the selected module by its parent in the tree. Modules would also be shaded red if any of the functions expected to be imported from them were missing.

    In this Dependencies utility, when you select a module from the tree view or from the module list, the import list shows those functions that are imported by (i.e. exported to) the selected module from its child dependencies in the tree.

    I actually prefer the old Depends behavior. From the tree view I can easily see the module dependencies of a particular parent. And from the import list I can easily see the parent's function dependencies from a particular module. In this Dependencies utility I have to select a parent, sort its imports by module, and search through the list to find out what it imports from a particular module.

    I'd like to see a user setting to enable the old Depends behavior. In this mode, the Module and Delayed columns of the Import list might be removed, and selecting a module from the module list (bottom) would have no effect on the import/export lists.

    opened by dlil 6
  • dependencies gui dbghelp.dll _o_memset

    dependencies gui dbghelp.dll _o_memset

    I downloaded version 1.10 and I use Windows 8, but I got this when opening a dll:

    image

    What is this dbghelp.dll he is looking for?

    Is this related to https://github.com/lucasg/Dependencies/issues/108 Crash in undecorator ? When would a new version be released with that fix?

    opened by evandrocoan 5
  • Wrong identification of known DLL

    Wrong identification of known DLL

    In Windows 7 64bit there is rpcrt4.dll listed as known DLL. In its 32bit variant rpcrt4.dll statically depends on sspicli.dll which statically depends on cryptbase.dll. But 64bit variant of rpcrt4.dll depends on sspicli.dll only as delay loaded and sspicli.dll depends on cryptbase.dll also only as delay loaded. So this means that both 32bit variants of sspicli.dll and cryptbase.dll are considered as known DLLs and both 64bit variants of sspicli.dll and cryptbase.dll are not considered as known DLLs. Yes, it is that crazy. You can check this by using winobj.exe program from http://sysinternals.com/, there are two "folders", one called KnownDlls and other called KnownDlls32.

    Now, I create DLL named cryptbase.dll and an EXE which statically depends on it and compile them both as both 32bit and 64bit. What happens is that 32bit EXE loads cryptbase.dll from system directory (because it is a known DLL) and 64bit EXE loads cryptbase.dll from application directory (because it is not a known DLL). You can check this by Process Hacker (https://processhacker.sourceforge.io/).

    Both Dependency Walker and Dependencies report cryptbase.dll dependency in 32bit variant wrong.

    Best regards, Marek Knápek

    opened by MarekKnapek 5
  • Crash in undecorator

    Crash in undecorator

    Steps to reproduce:

    • Download and unzip v1.10.
    • Run release version for x86 on Windows 7 x64.
    • Main menu -> File -> Open.
    • Open itself (DependenciesGui.exe).
    • Click on first DLL (C:\Windows\SysWOW64\mscoree.dll).
    • CRASH!

    I tried to attach an debugger after program startup and before crash and I observed a few things:

    • The crash happens in file ref.c, in function PhDereferenceObject, on line 243, variable objectHeader has address of 0xFFFFFFF8.
    • That is probably because function sooner on call stack named UndecorateSymbolDemangleName failed to undecorate name in file demangle.cpp on line 221 and is passing a NULL variable into PhDereferenceObject on line 228.
    • I think, the program failed to demangle "_CorExeMain" function name.
    • Probably because UnDecorateSymbolNameW function was not found.
    • Because dbghelp.dll was not loaded.
    • Because you tried to load x64 version of that DLL into x86 process in file UnmanagedSymPrv.cpp, on line 70.
    • This failed and you tried to load dbghelp.dll from current directory.
    • But this failed because some dependency was not satisfied.
    • dbghelp.dll depends on _o_memset function from api-ms-win-crt-private-l1-1-0.dll library.
    • But that export is not found in that DLL.

    So, I think you brought in modern dbghelp.dll (version 10) but not all its dependencies.

    I think you should load x86 DLL into x86 process from Windows SDK first. If it fails you should use system version of dbghelp.dll (version 6.1 on Windows 7) and not distribute your own, I don't think it is worth the hassle. If you want to distribute your own version, test if it works correctly first please.

    Also, I think you should not dereference NULL object in demangle.cpp file on line 228.

    Best Regards, Marek

    opened by MarekKnapek 5
  • How to list missing dependencies via CLI?

    How to list missing dependencies via CLI?

    dependencies.exe my_exe.exe
    

    prints nothing at all (but I think that might be intentional). I can run dependencies.exe my_exe.exe -knowndll to see all the known DLLs and dependencies.exe my_exe.exe -imports to see all listed imports, and manually crossreference them, but there has to be a way to just get the missing ones.

    Running dependencies.exe my_exe.exe -modules and dependencies.exe my_exe.exe -chain throw

    Unhandled Exception: System.NullReferenceException: Object reference not set to an instance of an object.
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 294
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.PeDependencyItem.ResolveDependencies() in C:\projects\dependencies\Dependencies\Program.cs:line 309
       at Dependencies.Program.DumpModules(PE Pe, Action`1 Printer) in C:\projects\dependencies\Dependencies\Program.cs:line 503
       at Dependencies.Program.Main(String[] args) in C:\projects\dependencies\Dependencies\Program.cs:line 591
    

    But this isn't about that, so please let me know what the way to list the missing DLLs, if possible.

    opened by tankorsmash 5
  • Running Dependencies in a Docker container

    Running Dependencies in a Docker container

    I have been attempting to run Dependencies on a Windows image-based Docker container, and I get the following error:

    Unhandled Exception: System.BadImageFormatException: Could not load file or assembly 'ClrPhlib.dll' or one of its dependencies. is not a valid Win32 application. (Exception from HRESULT: 0x800700C1)

    I'd already added the Visual C++ redistributable to my container, which is the solution provided in https://github.com/lucasg/Dependencies/issues/24. The missing assembly is in the same folder as Dependencies.exe

    Here's my Dockerfile:

    FROM mcr.microsoft.com/dotnet/framework/runtime:4.8
    ARG source
    
    ADD https://download.visualstudio.microsoft.com/download/pr/9e04d214-5a9d-4515-9960-3d71398d98c3/1e1e62ab57bbb4bf5199e8ce88f040be/vc_redist.x64.exe /vc_redist.x64.exe
    RUN powershell.exe -Command "C:/vc_redist.x64.exe" -ArgumentList '/install', '/passive', '/norestart' -NoNewWindow -Wait
    
    ADD https://github.com/lucasg/Dependencies/releases/download/v1.9/Dependencies_x64_Debug.zip /dependencies.zip
    RUN powershell.exe -NoP -NonI -Command "Expand-Archive 'C:\\dependencies.zip' 'C:\\Dependencies'" 
    
    WORKDIR /app
    COPY ${source:-obj/Docker/publish} .
    ENTRYPOINT ["C:\\app\\ConsoleApp1.exe"]
    

    As you can see, it's nice and simple (it's a test app that I'm using to try to work out why an asp.net app can't find a C++ DLL, ironically enough).

    I'm building the Docker image on the command line:

    docker build . --no-cache -t consoleapp1:testing

    and entering it using:

    docker run -it --entrypoint="cmd.exe"

    Any idea what I've done wrong here? I've also tried it with the 4.7.2 version of the dotnet framework image.

    opened by manzanotti 5
  • Report vcruntime140.dll as installed while actually missing.

    Report vcruntime140.dll as installed while actually missing.

    This is because Dependencies resolves vcruntime140.dll in its own directory. Please link with static runtime or avoid resolving Dlls in the directory of Dependencies(Gui).exe.

    opened by szmcdull 5
  • Crash in DependenciesGui when clicking on executable name in TreeView

    Crash in DependenciesGui when clicking on executable name in TreeView

    When clicking on the executable in the treeview image DependenciesGui crashes with the stack trace shown below image

    It's a 100% repeatable event for me, so hopefully would be easy to identify. I suspect it should just not do anything if this is selected.

    This is on a Windows 11 x64 22H2 install with v1.11.1.0 release of Dependencies

    opened by bevanweiss 0
  • Consider migrating to .NET 6

    Consider migrating to .NET 6

    Currently, this project uses .NET Framework 4.6.1 which has been unsupported as of earlier this year. While the easiest fix would be to simply target .NET Framework 4.6.2 (or a newer version of .NET Framework), it may make sense to use this opportunity to migrate to the modern .NET. The current version, .NET 6, is a Long Term Support (LTS) version, making it a good candidate for a significant upgrade. And while it would definitely require more testing and validation, there are numerous advantages:

    • .NET 6 is much faster than .NET Framework. This blog post lists some of the performance improvements in .NET 6 over previous versions of .NET Core (that already had improvements over Framework). You will also have new ways of publishing the application including using AOT compilation and bundling the framework with the app, so users don't need to install a runtime.
    • Migrating sets up Dependencies for success with modern technologies and platforms including native Windows Arm64 support.
    • All currently supported Windows versions (including Windows 7 SP1 ESU) are supported by .NET 6, so you won't be removing OS support for many potential users.

    Here are some dependencies I've identified with their current status:

    • Dragablz: It appears that the repo contains a .NET Framework 4.5 version of this component as a build dependency. I'm not sure what the reason is behind this but if the component is unmodified from the original, this may no longer be necessary. Dragablz is available as a NuGet package that supports .NET 6. A simple drop-in replacement seems to work at first glance for me.
    • Mono.Cecil: This NuGet package is also supported on .NET 6.
    • NDesk.Options: This package appears to be deprecated but there's NDesk.Options.Core which supports .NET 6 and the app builds just fine using it (no extensive testing done).
    • Newtonsoft.Json: Supported on .NET 6.

    Based on a preliminary attempt to port, this shouldn't be too hard. In fact, I've got a basic proof of concept working.

    A demonstration of Dependencies running on .NET 6 and the current version side by side

    @lucasg If you approve of this change, I can formalize the work and create a PR, though I'll need help with testing and validation.

    opened by prayaas-a 1
  • ESC key terminates (crashes?) application

    ESC key terminates (crashes?) application

    Opening a context menu in a view e. g. with the right mouse button, and then leaving it by pressing the ESC key, the application will be terminated by the next press of the ESC key. All views besides the files view (top,left) are concerned. It seems to be a crash, because it takes a little bit longer (hourglass) and the list of recent files didn't get updated.

    opened by rauschm 0
  • F10 key does not toggle

    F10 key does not toggle "Undecorate C++ Functions"

    In the view menu and the context menu of the import and export view F10 should toggle "Undecorate C++ Functions". But it doesn't. It just activates the menu bar.

    opened by rauschm 0
  • Releases 1.11 and 1.11.1 don't include peview.exe.

    Releases 1.11 and 1.11.1 don't include peview.exe.

    Releases 1.11 and 1.11.1 don't include peview.exe. Specifically:

    1.11\Dependencies_x64_Debug.zip 1.11\Dependencies_x64_Release.zip 1.11\Dependencies_x86_Debug.zip 1.11\Dependencies_x86_Release.zip

    1.11.1\Dependencies_x64_Debug.zip 1.11.1\Dependencies_x64_Release.zip 1.11.1\Dependencies_x86_Debug.zip 1.11.1\Dependencies_x86_Release.zip

    opened by praeceptum 0
Releases(v1.11.1)
Owner
null
Simple one file header for hijacking windows version.dll for desired executable to do 3rd party modifying without dll injection.

Version-Hijack Simple one file header for hijacking windows version.dll for desired executable to do 3rd party modifying without dll injection. Usage

sneakyevil 6 Oct 19, 2022
RudeWindowFixer: fix Windows taskbar always-on-top issues

RudeWindowFixer: fix Windows taskbar always-on-top issues Brought to you by Etienne Dechamps - GitHub If you are looking for executables, see the GitH

Etienne Dechamps 38 Dec 28, 2022
A 10 weeks Data Structures And Algorithms Coding Challenge organized by Devs' Street.

10-Weeks-DSA-Challenge A 10 weeks Data Structures And Algorithms Challenge organized by Devs' Street. How can I Participate? Takeaways? Tons of Free l

Devs' Street 10 Nov 1, 2022
Implements a Windows service (in a DLL) that removes the rounded corners for windows in Windows 11

ep_dwm Implements a Windows service that removes the rounded corners for windows in Windows 11. Tested on Windows 11 build 22000.434. Pre-compiled bin

Valentin-Gabriel Radu 24 Dec 29, 2022
Repository for the taproot-based rewrite of our 2021 development platform

taproot-mdev2021 This is a blank project fully configured for use of Taproot. It is designed to be a starting point for your own RoboMaster software p

TAMU Robomasters 27 Dec 28, 2022
Collection of DLL function export forwards for DLL export function proxying

dll-exports Collection of DLL function export forwards for DLL export function proxying. Typical usecase is for backdooring applications for persisten

Magnus Stubman 58 Dec 6, 2022
A method from GH on how to stream a dll without touching disk, TAGS: fortnite cheat fortnite injector dll injector

dll-encryptor People who make pay hacks typically have down syndrome and are incapable of using their brains in any fashion, and yet these bath salt s

Micca 2 Nov 24, 2021
Shared to msvcrt.dll or ucrtbase.dll and optimize the C/C++ application file size.

VC-LTL - An elegant way to compile lighter binaries. 简体中文 I would like to turn into a stone bridge, go through 500 years of wind, 500 years of Sun, ra

Chuyu Team 266 Jan 1, 2023
DLL Hooker using DLL Redirection

DLLHooker DLL Hooker using DLL Redirection. Development Environment IDE: Visual Studio 2019 Demonstration References [1] https://www.exploit-db.com/do

Jack Ren 1 Jan 21, 2022
Fix for various issues in the PC port of Ace Attorney Chronicles.

Hackfix for a few issues in the PC port - Animation framerate can now be set to arbitrary rate. (defaults to 60 but can be freely adjusted in the ini

Admiral H. Curtiss 82 Nov 28, 2022
The old Windows NT OpenGL samples/SDK from an MSDN CD.

The OpenGL API is supported on a variety of graphics hardware; the software in this release provides support for graphics hardware including basic emulation on any video adapter that is supported with the operating system, and accelerated graphics hardware that is supported by an OpenGL mini-client driver (MCD) or an OpenGL installable client driver (ICD).

Ian Hanschen 19 Aug 13, 2022
ClickLock which supports old games where the Windows ClickLock fails to work. This is a charity project, designed for people with disabilities.

Mouse ClickLock For Games This small utility works in a similar way as ClickLock available on Windows, but also supports old games where the normal Cl

null 7 Oct 8, 2022
An old-style web browser stub, comes from Internet Explorer was genocided on Windows.

Outernet Explorer An old-style web browser stub, comes from Internet Explorer was genocided on Windows. Download from: https://github.com/kekyo/Outern

Kouji Matsui 11 Oct 14, 2022
Dune Legacy port for PS Vita

Dune Legacy port for PS Vita Install Download and install dunelegacy.vpk. Extract content of dunelegacy_data.zip into ux0:data/. https://github.com/No

Taras 9 Nov 11, 2022
Legacy stepper motor analyzer - A DYI minimalist hardware stepper motor analyzer with graphical touch screen.

Simple Stepper Motor Analyzer NOTE: This is the legacy STM32 based design which was replaced by the single board, Raspberry Pi Pico design at https://

Zapta 160 Dec 26, 2022
legacy Botnets source code Forked from github.com/malwares

Legacy-Botnets-Source-Code-Collection github.com/malwares None of these were made by me and I take no resonsibility for anything done with the code. T

Mohammed amine guesmi 14 Sep 10, 2022
A utility to compile IW engine legacy UI scripts.

MENU Tool A utility to compile IW engine legacy UI scripts. Supported Games IW5 (Call of Duty: Modern Warfare 3) Usage ./menu-tool.exe <path> Disclaim

Xenxo Espasandín 3 Sep 21, 2022
An implementation of a Windows loader that can load dynamic-linked libraries (DLLs) directly from memory

memory-module-loader memory-module-loader is an implementation of a Windows loader that can load dynamic-link libraries (DLLs) directly from memory. T

SCYTHE 118 Nov 21, 2022
Add virtual monitors to your windows 10 device! Works with Oculus software, obs, and any desktop sharing software

License MIT and CC0 or Public Domain, whichever is least restrictive -- Use it AS IS - NO IMPLICIT OR EXPLICIT warranty This may break your computer,

Rashi Abramson 230 Jan 6, 2023