how to monitor exe and dll interactions?

Hello everyone,

Are there any tool or other methods which could be used to monitor which class/method exe is accessing a DLL?

Now I met with an issue that when I provide the DLL I developed to a 3rd parth application, it will crash sometimes and I suspect the 3rd party application is invoking some class/method which I do not implement the DLL. I have the full source codes of the DLL, but has no source codes of the exe so I am wondering whether there are some methods to monitor the interactions -- e.g. I can monitor which class/method the exe is invoking and at the same time my DLL has not implemented.

I am using Visual Studio 2005 to develop native (unmanaged) C++ DLL, and I expose the interface of the DLL to exe through COM interface.

thanks in advance,
George
[811 byte] By [George2] at [2007-11-20 11:41:13]
# 1 Re: how to monitor exe and dll interactions?
Well, if you're providing an exported interface to a client, you should be implementing it in the DLL.

To answer your question, the only way I know of would be to search the source code for the EXE. I don't know of any tool that can provide this information.

Viggy
MrViggy at 2007-11-9 13:32:59 >
# 2 Re: how to monitor exe and dll interactions?
Hi Viggy,

I can understand and agree with your points. My situation is, I have implemented the mandatory interface for the protocol, but I only implemented a part of the optional ones.

Any ideas to check the gaps?

Well, if you're providing an exported interface to a client, you should be implementing it in the DLL.

To answer your question, the only way I know of would be to search the source code for the EXE. I don't know of any tool that can provide this information.

Viggy

regards,
George
George2 at 2007-11-9 13:33:59 >
# 3 Re: how to monitor exe and dll interactions?
I have the full source codes of the DLL, but has no source codes of the exeThen sorry, you can have only faceless return addresses of the caller side. The symbolic names get lost while linking. Well, exe map file could help you a bit, but I suspect you have no one, right? :)
Igor Vartanov at 2007-11-9 13:34:57 >
# 4 Re: how to monitor exe and dll interactions?
Hi Viggy,
I can understand and agree with your points. My situation is, I have implemented the mandatory interface for the protocol, but I only implemented a part of the optional ones.

Any ideas to check the gaps?

regards,
George
Like Igor said, maybe the map file. However, why not just return empty values, and let the client check for that. Crashing is never a good idea. ;)

Viggy
MrViggy at 2007-11-9 13:36:02 >
# 5 Re: how to monitor exe and dll interactions?
Thanks Igor,

Then sorry, you can have only faceless return addresses of the caller side. The symbolic names get lost while linking. Well, exe map file could help you a bit, but I suspect you have no one, right? :)

What is the exe map file?

regards,
George
George2 at 2007-11-9 13:36:59 >
# 6 Re: how to monitor exe and dll interactions?
Thanks Viggy,

Like Igor said, maybe the map file. However, why not just return empty values, and let the client check for that. Crashing is never a good idea. ;)

Viggy

The problem for me is I do not know which method is missing, if I know I can leave the implementation to NULL and just provide an empty implementation. So, I want to find out which method is missing from my DLL and at the same time the clinet side EXE is invoking.

regards,
George
George2 at 2007-11-9 13:37:58 >
# 7 Re: how to monitor exe and dll interactions?
Not sure if this tool can help you to figure out, since this is COM DLL, and not native DLL.
But you can give it a try: Dependency Walker.

I recommend you downloading latest version from www.dependencywalker.com
Ajay Vijay at 2007-11-9 13:38:59 >
# 8 Re: how to monitor exe and dll interactions?
Thanks Ajay,

Not sure if this tool can help you to figure out, since this is COM DLL, and not native DLL.
But you can give it a try: Dependency Walker.

I recommend you downloading latest version from www.dependencywalker.com

I have tried with dependency walker and with the profile menu to run the EXE. I found that the profile log could successfully get the module name (LoadLibrary) of my DLL, but only a small part of function calls are logged, like DllMain, DllGetClassObject. But I can not monitor the function calls to the COM objects. Seems the tool could only log some entry point functions of DLL and can not monitor the function invocations to the methods of COM objects.

Any ideas or comments?

regards,
George
George2 at 2007-11-9 13:40:02 >
# 9 Re: how to monitor exe and dll interactions?
Well, since this is the in-proc COM dll case, you always can debug the dll by setting breakpoints at non-implemented methods' returns. Then after return you may see if it gets crashed.

Another point is to debug objects QueryInterface for interfaces queried - mayby you're not providing some vital interface the app requires for. Though an interface abcense typically never gives an effect of crashing.
Igor Vartanov at 2007-11-9 13:40:59 >
# 10 Re: how to monitor exe and dll interactions?
Thanks Igor,

Yes, in-process DLL.

Well, since this is the in-proc COM dll case, you always can debug the dll by setting breakpoints at non-implemented methods' returns. Then after return you may see if it gets crashed.

I can understand your points. But my situation is, I do not have the non-implemented methods -- even an empty skeleton with a single return statement. So, I do not have a function to set a break point. ;)

Another point is to debug objects QueryInterface for interfaces queried - mayby you're not providing some vital interface the app requires for. Though an interface abcense typically never gives an effect of crashing.

I have set a breakpoint in CreateInstance, and all returns of DllGetClassObject and CreateInstance of class factory returns successful. I think it means all the required interfaces are implemented, right? So, I think the issue is that some required method is missing, not required interface. Any comments?

regards,
George
George2 at 2007-11-9 13:41:59 >
# 11 Re: how to monitor exe and dll interactions?
I can understand your points. But my situation is, I do not have the non-implemented methods -- even an empty skeleton with a single return statement. So, I do not have a function to set a break point. ;) Well, then I badly understand your situation. Or you're missing somewhat in your description that really matters to the issue. Or your trouble is not missed impelmentation but faulty one. ;)

I have set a breakpoint in CreateInstance, and all returns of DllGetClassObject and CreateInstance of class factory returns successful. I think it means all the required interfaces are implemented, right? Well, generally it doesn't, sorry. It's hard to say something certain being knowing nothing about your component.

So, I think the issue is that some required method is missing, not required interface. Any comments?The comment would be only one. You just cannot have a situation of "that some required method is missing". Until you implement your interface completely you never can build your COM module.
Igor Vartanov at 2007-11-9 13:43:07 >
# 12 Re: how to monitor exe and dll interactions?
Thanks Igor,

I appreciate your help all the way. ;)

I want to confirm with you that the only solution you could see is to implement all the required methods, and even leave an empty implementation to the methods -- other than leave nothing (no empty implementation)?

And there is no tool to monitor the interactions (e.g. which method is invoked from EXE to DLL)? Right?

Well, then I badly understand your situation. Or you're missing somewhat in your description that really matters to the issue. Or your trouble is not missed impelmentation but faulty one. ;)

Well, generally it doesn't, sorry. It's hard to say something certain being knowing nothing about your component.

The comment would be only one. You just cannot have a situation of "that some required method is missing". Until you implement your interface completely you never can build your COM module.

regards,
George
George2 at 2007-11-9 13:44:05 >
# 13 Re: how to monitor exe and dll interactions?
I appreciate your help all the way. ;) You're welcome. :)

I want to confirm with you that the only solution you could see is to implement all the required methods, and even leave an empty implementation to the methods -- other than leave nothing (no empty implementation)?Well, you could put my point this way, though this is not what I could see, but the only choice I would have - because of COM nature. :D

And there is no tool to monitor the interactions (e.g. which method is invoked from EXE to DLL)? Right?At least I 'm not aware of the one. Why should anybody intercept the calls to his own component? As I said, you always can run the app in debugger session and set breakpoints or simply trace the calls. :)

Nevertheless, this is the article (http://www.microsoft.com/mSJ/0199/intercept/intercept.aspx) that might help to take a bit more deeper look into the problem... ;)
Igor Vartanov at 2007-11-9 13:45:11 >
# 14 Re: how to monitor exe and dll interactions?
Thanks Igor,

You're welcome. :)

Well, you could put my point this way, though this is not what I could see, but the only choice I would have - because of COM nature. :D

At least I 'm not aware of the one. Why should anybody intercept the calls to his own component? As I said, you always can run the app in debugger session and set breakpoints or simply trace the calls. :)

Nevertheless, this is the article (http://www.microsoft.com/mSJ/0199/intercept/intercept.aspx) that might help to take a bit more deeper look into the problem... ;)

If there are some DLL level hook which will be calling whenever there is a function call to the exported function in DLL, it will be great! ;)

But there is no one.

regards,
George
George2 at 2007-11-9 13:46:05 >