Discrepency between powershell & dumpbin when duping dll arch

TuttiPazzi 21 Reputation points
2020-10-07T06:21:58.173+00:00

Hi,
I'm on win10-2004 (19401-508) with Visual Studio 2019 (16.5.4).

Porting a 32bit app to 64bit. Removed all references to 32bit from ALL build properties, but seeing 32bit dlls?

Using powershell & dumpbin I'm seeing a discrepancy in which arch DLLs were really linked
with the application and which arch dlls load when the app runs.

Using PowerShell:
PS C:\Program Files\WindowsApps\XXXXXTechnologiesInc.DoitDeviceReader_1.0.22.0_x64__bjn14gv5jsgn0\Doit> Start-Process -PassThru Doit.exe | Get-Process -Module

Size(K) ModuleName FileName

7200 Doit.exe C:\Program Files\WindowsApps\XXXXXTechnologiesInc.Ins...
1984 ntdll.dll C:\Windows\SYSTEM32\ntdll.dll
712 KERNEL32.DLL C:\Windows\System32\KERNEL32.DLL
2708 KERNELBASE.dll C:\Windows\System32\KERNELBASE.dll
4544 SETUPAPI.dll C:\Windows\System32\SETUPAPI.dll
632 msvcrt.dll C:\Windows\System32\msvcrt.dll
960 WINHTTP.dll C:\Windows\SYSTEM32\WINHTTP.dll
296 cfgmgr32.dll C:\Windows\System32\cfgmgr32.dll
56 HID.DLL C:\Windows\SYSTEM32\HID.DLL
148 USERENV.dll C:\Windows\SYSTEM32\USERENV.dll
1000 ucrtbase.dll C:\Windows\System32\ucrtbase.dll
604 sechost.dll C:\Windows\System32\sechost.dll
1152 RPCRT4.dll C:\Windows\System32\RPCRT4.dll
152 bcrypt.dll C:\Windows\System32\bcrypt.dll
140 profapi.dll C:\Windows\System32\profapi.dll
1620 USER32.dll C:\Windows\System32\USER32.dll
132 win32u.dll C:\Windows\System32\win32u.dll
152 GDI32.dll C:\Windows\System32\GDI32.dll
1624 gdi32full.dll C:\Windows\System32\gdi32full.dll
632 msvcp_win.dll C:\Windows\System32\msvcp_win.dll
652 ADVAPI32.dll C:\Windows\System32\ADVAPI32.dll
7068 SHELL32.dll C:\Windows\System32\SHELL32.dll
676 shcore.dll C:\Windows\System32\shcore.dll
3284 combase.dll C:\Windows\System32\combase.dll
28 MSIMG32.dll C:\Windows\SYSTEM32\MSIMG32.dll
548 WINSPOOL.DRV C:\Windows\SYSTEM32\WINSPOOL.DRV
512 bcryptPrimitives.dll C:\Windows\System32\bcryptPrimitives.dll
68 kernel.appcore.dll C:\Windows\System32\kernel.appcore.dll
7680 windows.storage.dll C:\Windows\System32\windows.storage.dll
296 powrprof.dll C:\Windows\System32\powrprof.dll
64 UMPDC.dll C:\Windows\System32\UMPDC.dll
232 IPHLPAPI.DLL C:\Windows\SYSTEM32\IPHLPAPI.DLL
960 PROPSYS.dll C:\Windows\SYSTEM32\PROPSYS.dll
328 shlwapi.dll C:\Windows\System32\shlwapi.dll
788 OLEAUT32.dll C:\Windows\System32\OLEAUT32.dll
92 cryptsp.dll C:\Windows\System32\cryptsp.dll
1372 ole32.dll C:\Windows\System32\ole32.dll
444 WS2_32.dll C:\Windows\System32\WS2_32.dll

Using dumpbin:
C:\Program Files\WindowsApps\XXXXXTechnologiesInc.DoitDeviceReader_1.0.22.0_x64__bjn14gv5jsgn0\Doit>"c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.25.28610\bin\Hostx64\x64\dumpbin.exe" /DEPENDENTS Doit.exe
Microsoft (R) COFF/PE Dumper Version 14.25.28614.0
Copyright (C) Microsoft Corporation. All rights reserved.

Dump of file Doit.exe

File Type: EXECUTABLE IMAGE

Image has the following dependencies:

HID.DLL
WINHTTP.dll
USERENV.dll
SETUPAPI.dll
KERNEL32.dll
USER32.dll
GDI32.dll
MSIMG32.dll
WINSPOOL.DRV
ADVAPI32.dll
SHELL32.dll
SHLWAPI.dll
UxTheme.dll
ole32.dll
OLEAUT32.dll
oledlg.dll
WS2_32.dll
gdiplus.dll
OLEACC.dll
IMM32.dll
WINMM.dll

Summary

   37000 .data
   29000 .pdata
   E5000 .rdata
   14000 .reloc
  2C4000 .rsrc
  2E9000 .text
    1000 _RDATA
Visual Studio
Visual Studio
A family of Microsoft suites of integrated development tools for building applications for Windows, the web and mobile devices.
4,830 questions
Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,502 questions
0 comments
Accepted answer
  1. Darran Rowe 561 Reputation points
    2020-10-08T00:15:04.233+00:00

    Remember, on 64 bit Windows, the 64 bit DLLs are in System32 and the 32 bit DLLs are in SysWOW64. All of the DLLs listed are 64 bit.
    The System32 name was kept because of applications hard coding the path.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Viorel 114.2K Reputation points
    2020-10-07T08:41:19.903+00:00

    It seems that dumpbin shows the immediate dependencies only, but some libraries depend on other DLLs. For example, KERNEL32 depends on KERNELBASE. (This can be checked separately using dumpbin).

    In addition, some of modules that are not shown by dumpbin are probably loaded at run-time using functions like LoadLibrary.

    In contrast with dumpbin, Get-Process -Module shows the modules that are currently loaded.

    (By the way, the popular tool “Dependency Walker” can be used to see the dependency tree and the full list).

    0 comments