Previous  Top  Next

C:\Program Files\Thinstall.VS>dll_dump.exe
dll_dump ADDRESS (show DLL & process which has this address loaded)
dll_dump SUBSTRING (shows DLLs loaded by Thinstall processes where name matches SUBSTRING)
dll_dump * (shows DLLs loaded by all Thinstall processes)
dll_dump -fp (show DLL full path, not just filenames)
dll_dump ADDRESS SUBSTRING (only show processes matching SUBSTRING where ADDRESS is loaded)

One of the most useful purposes for dll_dump is to list all running Thinstalled applications on a PC.

If you use a spy program like Process Explorer on a Thinstalled app, you will not see DLLs which are loaded by Thinstall since they have been virtualized and Windows does not really know they exist. Likewise, if you attach a debugger to a running Thinstall process, the debugger will not be aware of virtual DLLs. If you are investigating code running at a specific address, you can use dll_dump to convert this address into a virtual DLL name and base address.

Using log monitor, you can generate a trace and convert this to text format. In the report near the end, you'll find a section labeled:

— Modules loaded —

This section lists all DLLs that were loaded by the application over the course of its execution history.

DLLs that are described as "SYSTEM_LOADED" are loaded by Windows from the host PC; these will include all the basic OS DLLs like kernel32.dll

DLLs that are described as "MEMORY_MAPPED_ANON" are loaded by Thinstall and completely isolated from Windows.

For Adobe Reader, you should see something like this:

PRELOADED_BY_SYSTEM 00400000-00410000, C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
PRELOADED_MAP 00400000-00410000, C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
SYSTEM_LOADED 00400000-00410000, C:\thinstest\1072\Adobe Reader 7.0\bin\Adobe.exe
SYSTEM_LOADED 77dd0000-77e6b000, C:\WINDOWS\system32\ADVAPI32.dll
SYSTEM_LOADED 76fd0000-7704f000, C:\WINDOWS\system32\CLBCATQ.DLL
SYSTEM_LOADED 5d090000-5d127000, C:\WINDOWS\system32\comctl32.dll

MEMORY_MAPPED_ANON 05000000-05085000, C:\Program Files\Adobe\Acrobat 7.0\Reader\ACE.dll
MEMORY_MAPPED_ANON 03000000-038c9000, C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.dll
MEMORY_MAPPED_ANON 06000000-061aa000, C:\Program Files\Adobe\Acrobat 7.0\Reader\AGM.dll
MEMORY_MAPPED_ANON 07000000-0701b000, C:\Program Files\Adobe\Acrobat 7.0\Reader\BIB.dll
MEMORY_MAPPED_ANON 7c3a0000-7c41b000, C:\WINDOWS\system32\MSVCP71.dll