Windows2000 tool for the analysis of secret weapons

As we all know: Windows Many applications are not only have executable EXE file, but also need to have auxiliary module, these modules are various, the category quite miscellaneous, among them the most famous on the number of dynamic Connection library (DLL), in addition to: OCX, SYS and so on. Like the application can be divided into 16-bit, 32-bit, 64-bit program, the module is also divided into 16-bit, 32-bit, and 64-bit modules. When you delete an application or executable file, the related dynamic chain library or module often cannot be removed cleanly, a long time, forming a lot of annoying "junk file." So, often many people who use Windows focus on DLL files to look at what is useful, what is useless, with a view to accurately remove unwanted parts, that is, to complete the so-called system weight loss, however, this is not the center of this discussion, our aim is to study module files from another aspect, as mentioned below, is one of those tools.

A. Brief introduction

Windows2000 Professional version of the Support Tools has a special tool to analyze the module file, its English name is: Dependency Walker, literal translation is "dependent Rambler", the name is in any case awkward, does not conform to the characteristics of Chinese expression. By using validation and viewing reference materials, it is more appropriate to extend it to "module parsing tools." Unlike the above purposes for system weight loss, the module parsing tool can detect: The dependencies of the module, the creator, the function interface, the call relationship, and even the programming language used to generate the module file, the version of the linker used in the link of the program, and so on, are resolved by using a similar directory tree icon format. Of course, you can also show that the runtime module needs to use at least which associated files, along with the full path of the file, the basic address, version number, computer type, debug information, and other information, can be described in all aspects, everything.

It is easy to see from the nature of the information that such information is more useful to system administrators, system testers, programmers, and automated scripting people. For ordinary users, less useful. But it is not to be used. Ordinary users can use these analytic results to eliminate the system caused by the failure of the module, the module caused by the main system failures include:

1. Module is missing.

2. Invalid module.

3. The execution of the exit/entry collocation error.

4. Loop error.

5. The combination of the module and the computer type is wrong.

Although the tool is a Win2K support tool, it can also run in the operating system environment of Win9x, winNT3.51, winNT4.0, and even Windows CE. Currently Dependency Walker's latest version is 2.0. This version only supports parsing 32-bit or 64-bit modules, and has not supported 16-bit modules.

B. A brief discussion of usage

Unlike other tools, this tool has only a version of the GUI interface and no command line version. If you have installed Support Tools, you can open it like this: "Start-> Program->support tools->tools->dependency Walker". This is also an English Language interface tool, and has English help document for reference. Here is a brief description of how to use it:

1. First click with the mouse "file| Open ".

2. Open an EXE, DLL, OCX, or SYS file to resolve, and then double-click the filename.

3. Double-click, the original empty window immediately "lively" up, showing the selected module analysis results. The following figure (Figure 1) is the analytic result of the main program SnagIt32.exe of a grasping graph software SnagIt5 on the machine that I am using now. The colored boxes of rectangles or ovals in the figure are added by myself and are intended to be used as logos in the following explanations.