We have the proper base understanding now of what DLLs are
and how they provide assistance to programs on the actual system itself.
Let's take a look at our lab real quick for a Windows point of view.
And this is the host VM for our lab.
And I wanted to walk through a couple of things real quick.
And first and foremost is identifying the actual processes
that are running on the system overall.
You can do this by going into Task Manager.
And I'm sure we all know this already.
And you can see everything running here.
Well, if I zoom in for you, there's something you can notice right off the bat
is that
this doesn't really give us all the information about that actual process.
In most recent Windows editions, you don't even see the actual full file name
anymore.
In some cases, you do, but not all of them.
So for in this matter, you would just go to the Details tab.
And that's exactly what we're going to be doing.
Now, inside of the Details tab, we have every single program
that's running whether it be in the foreground or background
of the actual Windows system overall.
And all of these different programs that are running,
barring a few exceptions here and there, have DLLs tied to them.
In fact, some of them are being shared between these programs that are running.
And we're going to begin by identifying which DLLs are tied to a running
process.
Now, we'll leave this open for right now because we're going to come back to it
here
momentarily for the process IDs or the pins.
And I have this broken up into a couple of different sections
and methods of being able to do this.
And inside of the Library Tools folder, you will see that I have a scripts.text
in there.
And although I am putting a lot of this in the actual skill below the videos
that we're doing here, for instance, right below, you should see the PowerShell
script.
I'm having a lot.
Most of them should be in here.
This word, no pad as well.
And it's because it's going to be easier for us to, you know,
cut and paste and do all this other stuff and not right to have to type,
especially when we get that long script to the medic.
But do remember that you will need PowerShell updated for some of the stuff
that we're doing here.
And if you haven't done so on your own personal systems,
I'd highly recommend because you get expanded usage out of some of those
PowerShell scripts.
So we're going to open up our PowerShell.
And for this one, we're going to right click on it in front as administrator.
Now, remember, we're not really getting into abusing these files just yet.
We're just doing the examination to get a further understanding of these DLLs.
And the first one that we're going to be running is get the actual process
or DLLs tied to a running process.
I'm going to copy this, paste it inside of my PowerShell prompt.
And you'll notice that inside of that script, I have things like
hid that are in the Pacman brackets, right, if any less than signs.
And that's why I said, while ago, that we're going to be leaving our process,
a task manager open on the details tab.
So we're just going to select, like, for instance, explore.exe, which is
basically
the background running of our Windows operating system for us overall.
And if we were to end that task, it would basically reset the desktop
and everything that's going on because that's the running portion of the
operating
system of Windows.
But that process ID is 8180.
And these process IDs are based on first come, first serve.
And if we just go over and replace PID with 8180 and press enter,
you get a listing right here of all the DLLs that are tied to that actual
process.
Let me scroll back up the size and also the actual file name.
I'm going to zoom in for you real quick.
And you can see that at the very top, we have module name of explore.exe.
Now, it tells us where that is.
If C drive windows, explore.exe and everything below that is going to be every
DLL
that's being used for explore.exe to run and perform all of its functions.
Now, earlier in the skill, we talked about how DLLs can go in and out of the
RAM
and usage of the system based on me.
So all of these DLLs that are called up inside of this get processed power
sales script that we just ran are actually loaded up inside of the RAM as well
and are needed currently, which means that if this explore.exe had all of this
coding inside of its one exe file, instead of having to call all these DLLs up,
we would go from 4,700 K in size for explore.exe to something that adds all
of these DLLs up and be gargaged.
And not only do we have to consider the RAM size when we have programs like
this,
but we also have to consider the actual processing and the ability to be able
to
process the size of a file or it at real time or something more accepted.
Right.
So now we're able to see everything that's going on here.
And I do want to take a side real quick and show you what this looks like in a
project based system because you can do the exact same thing.
Now I'm not going to be doing this all throughout the skill because this is
primarily focused on Windows, but it is a tidbit that you need to know moving
forward
in some of the skills and overall course that we do here in pin 200.
Now we're going to keep it pretty simple when we're calling upon the actual
process IDs.
We're not going to run this as pseudo and we're just simply going to type PS
and
that'll give us some of the pins that are available that are currently running
right now.
And you can see that I have two pulled up.
I'm going to zoom in momentarily.
Just give me a second.
And we have two commands that we can use.
We could use LSOF dash P.
LSOF the dash P is identifying that we're going to be doing this on a
PID and the first bit that we're going to be doing this on is 24 eight.
Num lock L S O F dash P.
24 eight O four seven.
Now I'll scroll up and zoom in for each other.
What's going on here and it looks just like this.
The command tied to the actual pin because the pin is 24 80 47 in the command
Z S H for the shell.
It starts with the command itself and then goes through and calls all of the
libraries that are associated with that running process.
Again, the same kind of output that we get in our PowerShell script when we run
inside of Windows and also shows you that there's not a DLL file extension on
these different libraries as well either like we were talking about with the
magic numbers on six based system.
Now the second command that we're going to be running on the actual same.
A process ID is going to be P map 24 eight zero four seven.
And here it's just basically a watered down version of what's going on and
showing
you the actual file name and size and read access to it.
So without going into too much detail, this is a way for you to be able to see
in that POSIX based system how this actually develops and works and ties those