Results 40 comments of lucasg

Ok that was a fairly complicated bug to track down. What happened is, on Debug build `Dependencies.exe` failed to load the packaged `msvcp140d.dll` so -weirdly enough- the CLR loader folded...

Yeah, totally agree. However to prevent file locking I need to change completely my PE parser (I currently use ProcessHacker's phlib). It's in my TODO list, but unfortunately there are...

I'm implemented a pretty rudimentary version: you can choose it in the "Options>Preferences>Use BinaryCache" but the settings is application wide **and you need to restart Dependencies** since BinaryCache is implemented...

you can add folder to search in "Options/Customize Folders". Example with C:\Windows\System32\ntoskrnl.exe : ![image](https://user-images.githubusercontent.com/2520861/103951638-5c675f00-513f-11eb-9ca8-34a8473daca8.png) Adding C:\Windows\System32\drivers as a valid folder : ![image](https://user-images.githubusercontent.com/2520861/103951700-7a34c400-513f-11eb-8238-e74af52431f6.png) Result : ![image](https://user-images.githubusercontent.com/2520861/103951741-89b40d00-513f-11eb-9600-28aa71941d54.png) All kext resolved to *.sys...

hmm, weird I actually tried to look into PATH env var : ```C# // 7. Find in PATH string PATH = Environment.GetEnvironmentVariable("PATH"); List PATHFolders = new List(PATH.Split(';')); // Filter out...

The actual computation of hints is currently wacky af, thanks for the remainder

Ok I checked the MS spec, and there is no hint information for exports, only for imports : https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#the-edata-section-image-only So ```depends`` is in the wrong here, I don't know how...

That's what the "modules" listview is for, no ? Anyway, you can also find the same list in the "Module Search Order" popup : ![image](https://user-images.githubusercontent.com/2520861/101992160-741f0500-3cb1-11eb-8810-ad819e2a92a4.png) You can also see which...

Exactly. If one day I wanted to implement this feature, it would be a separate tool anyway. In the meantime ProcMon, [wtrace](https://github.com/lowleveldesign/wtrace) and a good breakpoint with Windbg can do...

Huh, all these years that I've used Dependency Walker I never though about what "PE" and "PI" meaning was. Not gonna lie, it would be a PITA to do what...