A simple tool to find which DLL actually contains an API that is exported
from an import library ("implib"). For example, UWP applications typically
link against WindowsApp.lib but this is an "umbrella library" that contains
most of the exports supported by the Windows Store, regardless of where they
come from.
Unlike traditional implibs like kernel32.lib, there is no matching
DLL named WindowsApp.dll; instead, the APIs are exported by various
other DLLs in Windows. So for example to statically reference the API
CreateFileFromAppW from your app, you just link with WindowsApp.lib. But
if you wanted to load it dynamically via LoadLibrary, which DLL would you
specify?
WhichDll uses the SDK tool dumpbin.exe to find all the exports in an
implib and then parses the output to find the desired information.
The tool also maps API Sets with implementation DLLs but that is only
valid on the machine where the tool is invoked; two different devices
might have different implementation DLLs based on Device Family, OS
Version, etc. so you should always use the API Set name at runtime.
Here's an example output looking for CreateFileFromAppW in the default
OneCoreUAP import library (see below for full syntax):
C:\>WhichDll CreateFileFromAppW -nologo
CreateFileFromAppW is exported by api-ms-win-core-file-fromapp-l1-1-0.dll --> windows.storage.onecore.dll on this machine.
So from this output we can see that CreateFileFromAppW is exported by
api-ms-win-core-file-fromapp-l1-1-0.dll and this is the DLL we would
use for a call to LoadLibrary. If we needed to do further investigation
on this machine then we could look at windows.storage.onecore.dll:
C:\Windows\System32\>dumpbin /exports windows.storage.onecore.dll | findstr CreateFileFromAppW
15 E 00011CE0 CreateFileFromAppW
Here is the full help output from the tool:
WhichDll: Which DLL exports a given function, according to an implib?
Source available at https://github.com/ptorr-msft/WhichDll.
Usage: WhichDll <export> [<implib>] [-nologo]
By default, the <export> is case-insensitive and will report all functions
that match the given prefix. If <implib> is not provided, it defaults to
onecoreuap.lib.
For example, to find out which DLL contains CreateFileFromAppW according to
OneCoreUap.lib, you can use any of the following:
WhichDll CreateFileFromAppW onecoreuap.lib
WhichDll CreateFileFrom onecoreuap
WhichDll createfile
Third command-line above will return results for other exports that begin with
'createfile' such as CreateFileA, CreateFile2, etc.
You can also use a regular expression for the <export>. For example, the
following finds CreateFileFromAppW and a couple of other exports:
WhichDll Create.*AppW
If the DLL referenced in the implib is actually an API Set, WhichDll will
attempt to locate the DLL that hosts the API *on this machine* please note
that it could resolve to a different DLL on a different machine, so you
should *not* depend on this information for anything other than local
debugging.
If you specify '-i' as the <implib>, WhichDll will read from stdin. this can
be useful for piping the output of dumpbin (or something else) into the app:
c:\path\to\dumpbin -all c:\path\to\foo.lib | whichdll someexport -i
The -nologo switch hides the banner and other non-essential output.```