Practical Lab: DLL Exploration

Objective

Find out which DLLs your own running programs use, where they live, who signed them, and how many your PC has. You only look. Nothing in this lab changes any setting or file.

Time: 25–30 minutes
You need: A Windows PC. No extra software is required. (One free optional tool, Process Explorer, is named in Part 5.)

What to Open

Part 1: What Does Notepad Load? (Command Prompt)

With Notepad open, run:

tasklist /m /fi "imagename eq notepad.exe"

The /m option lists the modules (EXE and DLLs) loaded in each matching process. Note: a newer Notepad from the Microsoft Store may run under a different name or show several lines; if nothing shows, try tasklist /m /fi "imagename eq mspaint.exe" after opening Paint.

1. Is ntdll.dll in the list? ________________
2. Is kernel32.dll in the list? ________________
3. Find one DLL with gdi or user in its name: ________________
4. How many modules are listed (roughly)? ________________

Part 2: The Same Thing in PowerShell (With Paths)

Get-Process -Name notepad | Select-Object -ExpandProperty Modules |
  Select-Object ModuleName, FileName | Format-Table -AutoSize

5. In which folder do most DLL files live? ________________
6. Is any DLL from a folder other than C:\Windows\...? Which? ________________
7. Is any module from C:\Windows\WinSxS (Section 7)? ________________

Count them:

(Get-Process -Name notepad | Select-Object -ExpandProperty Modules).Count

8. Module count: ________________

If PowerShell says access is denied for some process, that is normal. Windows protects some processes (Section 8.3). Notepad should work.

Part 3: Shared Code in Action (Task Manager)

1. Open Task Manager → Details tab.

2. Right-click the column header, choose Select columns, and tick Memory (private working set) and Memory (shared working set) if offered (hedge: the exact columns differ by Windows version).

3. Compare a few processes.

4. Which is bigger for Notepad: private or shared? ________________

Parts of a process's memory are code from DLLs that other processes share (Section 1.2). That is why the sum of all working sets can look larger than your real RAM.

Part 4: Which Program Is Which? (Services and Properties)

4A. Services inside processes:

tasklist /svc

10. Find svchost.exe. How many lines are there for it? ________________
11. Pick one svchost.exe line and write down a service name: ________________

(Services are often provided by DLLs that svchost.exe loads. A single host program runs different service DLLs.)

4B. File Explorer's Details tab:

1. Open C:\Windows\System32.

2. Right-click kernel32.dll → Properties → Details tab.

3. File version: ________________

4. Copyright (company): ________________

5. File size: ________________

6. Open the Digital Signatures tab (if shown). Who signed it? ________________

4C. Where is it? (where and Get-Command):

where kernel32.dll

Get-Command kernel32.dll | Select-Object Name, Source

16. Which path was reported? ________________

4D. How many DLLs in System32?

Get-ChildItem C:\Windows\System32\*.dll | Measure-Object

17. Count: ________________ (typically thousands)

4E. The KnownDLLs list (Section 4):

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs"

18. Is kernel32.dll on the list? ________________ (Look for a value pointing to kernel32.dll.)

Part 5 (Optional): Process Explorer from Sysinternals

Process Explorer is a free tool from Microsoft (Sysinternals). Download it only from Microsoft's official site. It is not part of Windows and needs no installation.

1. Start Process Explorer and click notepad.exe in the process list.

2. Press Ctrl + D to open the DLL view at the bottom.

3. Right-click the column header → Select Columns → DLL and add Verified Signer and Path.

4. Press Ctrl + D again to hide the view when finished.

5. How many DLLs are shown, and are they all "(Verified) Microsoft Windows"? ________________

Another optional free tool is sigcheck (also Sysinternals): sigcheck C:\Windows\System32\kernel32.dll shows the version and signature.

Part 6 (Optional): Visual Studio Tools Only

Skip this if you do not have the Visual Studio tools. In a Developer Command Prompt:

dumpbin /dependents C:\Windows\System32\notepad.exe
dumpbin /exports C:\Windows\System32\kernel32.dll | more

20. Name one function that kernel32.dll exports: ________________

What Should Happen

• Part 1 and 2 show the same module list. ntdll.dll and kernel32.dll appear in nearly every process.
• Part 3 shows that much memory used by a process is shared.
• Part 4 shows System32 holds thousands of DLLs, that they are signed by Microsoft, and that core DLLs are in KnownDLLs.
• Part 5 and 6 show the same thing from another angle.

Interpretation Guide

Follow-Up Questions

1. Why do you think ntdll.dll and kernel32.dll are loaded into almost every process?
2. If two programs both load user32.dll, how many copies of its code are in RAM?
3. Why are modules in a Temp folder more suspicious than those in System32?
4. Why does tasklist /svc show many svchost.exe lines rather than one?
5. Name three facts from this lab that you could not have learned just by looking at the Notepad window.