tags:

views:

18

answers:

1

When opening the Module Search Order dialog of Dependency Walker (depends.exe), the list of the system well-known DLLs does NOT fit with the one that is located in the registry under the following key "hklm\system\currentcontrolset\control\session manager\knowndlls".

Is the list hardcoded in Dependency Walker?

A: 
  1. Known DLLs is a caching system for Windows NT
  2. Dependency Walker builds a tree of the dependencies of each DLL

A list is hard-coded in Known DLLs and then it is extended based on the DLLs' static dependencies while the Dependency Walker application scans any DLL for any dependencies (from its homepage: "Dependency Walker handles all types of module dependencies, including implicit, explicit (dynamic / runtime), forwarded, delay-loaded, and injected").

Use Dependency Walker if you want to reliably find a DLLs dependencies instead of the NT registry.

Tom
As a matter of fact, the "Know DLLs" registry enumerates the list of System known Libraries. The point is that depends seems to have its own hard-code list of this enumeration. Using depends does to analyze an image file does not extent this list at all. This list is system dependant.
marc ochsenmeier
Actually, the DLLs dependencies found by dependency walker are not a replacement of some NT Registry! Dependency walker and similar tools scan image dependencies AND the Registry to determine the search order of dependencies.
marc ochsenmeier