#!/usr/bin/env python
from __future__ import print_function, unicode_literals
from pprint import pprint
import itertools
import json
import os
import re
import sqlite3
import subprocess
import time
"""
Sample listdlls output:
ListDLLs v3.1 - List loaded DLLs
Copyright (C) 1997-2011 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
lsass.exe pid: 1396
Command line: C:\WINDOWS\system32\lsass.exe
Base Size Path
0x00000000158f0000 0x11000 C:\WINDOWS\system32\lsass.exe
0x00000000bc450000 0x1d2000 C:\WINDOWS\SYSTEM32\ntdll.dll
0x00000000ba620000 0xac000 C:\WINDOWS\System32\KERNEL32.DLL
0x00000000b9480000 0x21d000 C:\WINDOWS\System32\KERNELBASE.dll
...
------------------------------------------------------------------------------
svchost.exe pid: 1564
Command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch
Base Size Path
0x00000000e1b80000 0xe000 C:\WINDOWS\system32\svchost.exe
0x00000000bc450000 0x1d2000 C:\WINDOWS\SYSTEM32\ntdll.dll
0x00000000ba620000 0xac000 C:\WINDOWS\System32\KERNEL32.DLL
0x00000000b9480000 0x21d000 C:\WINDOWS\System32\KERNELBASE.dll
0x00000000ba790000 0x59000 C:\WINDOWS\System32\sechost.dll
...
"""
def get_all_dlls():
pattern = re.compile(r'^\w+\s+\w+\s+(.+)$')
output = subprocess.check_output( ['listdlls'])
output = output + "---\n"
lines = output.splitlines()
with open('dlls.txt', 'w') as f:
f.write(output)
# Skip the header
lines = itertools.dropwhile(lambda line: not line.startswith('---'), lines)
next(lines) # Skip the dashes line
for line in lines:
if 'pid:' in line:
# lsass.exe pid: 1396
process = line.split()[0]
elif line.startswith('0x'):
# 0x00000000e1b80000 0xe000 C:\WINDOWS\system32\svchost.exe
# ==> module=svchost.exe, path=C:\WINDOWS\system32\svchost.exe
matched = pattern.match(line)
if matched:
path = matched.group(1)
filename = os.path.basename(path)
yield process, filename, path
if __name__ == '__main__':
target = 'tabdoc.dll'
for module, dll, dll_path in get_all_dlls():
if dll == target:
print('{}, {}'.format(module, dll))
Comments