How to tell if a DLL function is being called from a VB6 exe?

Question

I have an old VB6 app and I'm not sure which code was used to compile it. One revision of the source makes a call to Sleep in kernel32.dll.

Is there a way to find out if the exe calls a specific function in a DLL? I can see that kernel32.dll is linked by using the "Dependency Walker" tool but that doesn't seem to tell me that a specific function is called from the exe.

Answer 1

You can use Process Explorer to see which DLL functions are being called at runtime by the exe.

Answer 2

If you can run the program in a debugger, you can always set a breakpoint at the address of the function of interrest. Of course, then you have to trigger the actual call to the imported function.

You can also try to load the program in a disassembler and see if there are any references to it, but then you won't catch any dynamically loaded functions. One tool to have a look at is PE Explorer. I am not sure if this works with VB6 programs though, since the dll import code probably loads the functions dynamically (using GetProcAddress and the like).

Answer 3

In Dependency Walker you can use the Profile command.
This allows you to trace and see what methods get called.