Now that's not to say that we only have to use scripting and command prompts to
be able to see where these DLLs are and their validity.
We actually have some programs that are third party sourced that allow us to be
able to do a more visual inspection of how they're tied in.
And I'm going to demonstrate two of them here.
And I already have them in the library tools folder for you.
The first one that we're going to be taking a look at is Prokmon.
And I would recommend using Prokmon 64.exe.
I will zoom in to show you what I'm talking about.
The one in the middle Prokmon for 64.exe.
All three of these come with the download from the links that I have below.
And you can see that they also are supported by Microsoft and the SIS internals
program.
The 32 bit would be like if you're working on like Windows 3.1.
So I'm going to go into the Prokmon 64.
And right off the bat, you can see that everything is pulled up.
This is a very detailed view of what we actually saw inside of the task manager
for running processes.
I believe that's the plural.
And you can see that there's a breakdown of how all this is tied together along
with all information type to it.
Now, there's a couple of different ways that this works.
And I'm going to zoom in for you.
And we'll go back to this in just a moment.
Not only does this show us DLLs, but this shows us also, as you can see here,
the actual files, the registry,
the network connections, and how it interacts with the operating system overall
.
So this can go as broad as you want or as finite as you want inside of viewing
things.
We're going to uncheck the registry, the networking and the files.
And you can see here that we have threads created based on the exes and the
path that they go to.
For instance, I'm going to highlight one and then zoom in for you here real
quick.
You can see right here that WMI PR VSE.exe with the process ID of 55 84 is
loaded in the actual image,
but used in TM, a RTA dot DLL as a library into loading.
And it's still in the actual image, along with that you have the timestamp, the
time it's been in there.
Full path names and also address spacing and that address space is like way in
the weeds
and something that we may go into later on in this course.
But in terms of like being able to manipulate these DLLs, we don't need to go
into the address
space unless we're trying to do something very, very complex.
So if you double click on the actual file itself or the process or whichever
line that you're on,
you can get more details into what it actually is doing along with the actual
process that it's tied into.
And this is where Prokmon has a great advantage because along with the ability
to see it in the overall,
you can click on the actual EXE and look down at the modules and see all the D
LLs that have been
loaded into that program that are residing in the actual memory itself, along
with all the other
great information that comes with that as well.
So it's kind of like a process mapper, but just specifically for the actual
libraries overall.
Well, what this doesn't do is tell us which ones are shared and we'll be
getting into that momentarily
because that's more of a PowerShell thing.
But I do want to show you one more tool.
And this one is called dependency walker and we're going to be taking a look at
opening a file
because we don't necessarily have to open this up in running memory.
We can take a look at actual individual files.
So let's say you find something inside of Prokmon or the actual task manager
that you want to further
inspect, you can actually go through and inspect multiple types of
exes and other great things.
So we're going to see drive windows folder.
We're going to go into system 32 and then scroll down.
And we're going to find a just a random DLL and that totally didn't take a
minute to load,
even though you just saw a frame jump.
But now that first area that we get, I've noticed that that happens a lot.
And this basically says errors were detected, see the log for details as far as
like
trying to load everything up in there.
So I'm just going to click OK and ignore it.
You can take from that what you will.
But the winner winner chicken dinner here is that inside of dependency walker,
you can actually see a breakdown chart of mapping for that actual DLL because
we see that the one that we selected
ACTXPRXY.PLL is also reliant upon another DLL, which is reliant upon another D
LL.
And so it's not just one that go or two that go into the program.
Some libraries can actually call upon other libraries.
And you can imagine or think of the actual program overall as being the card
catalog
of the library management to know which ones it's actually going to be
utilizing.
So the program goes, pulls the card out and says, I need this book by author
C Clark.
And then the processor will go through the actual file system and return to you
,
that book that you've been asking for to load up into running memory.
And this right here is showing what's checked out at that current time.
Now, there are a lot of question marks in here because again, we had that error
up
and this will generally just tell us the way I'm looking at it.
I basically close all the expansions on this and just look at all the DLLs
that are being ran on this directly.
And as I zoom in, you can see that not only do we have three DLLs under the one
that we were inspecting, but we also have address spacing inside of the actual
memory and hard drive itself, along with assembly code calling.
Now, again, we're not going that far into the weeds, but there are programs out
there
like Ida Pro that if you want on your own, you can actually go through and
break down
and decompile a library like DLLs or executables and go into the actual
assembly
code at the ring closest to the actual CPU to see what's actually happening.