LibSnitcher is a PowerShell module designed to retrieve module dependency information. It easily, and quickly returns the module's entire dependency chain, including if a given module loaded successfully. You can also find which modules didn't load, or bring the whole PE headers.
This module was designed to work with Portable Executables. It's also prepared to work with .NET assemblies. It works by loading the module, reading its PE information, and retrieving referenced assemblies, if applicable.
This module is available at the PowerShell Gallery.
Install-Module -Name 'LibSnitcher'
Import-Module -Name 'LibSnitcher'
If you clone the repository, run \Tools\Build.ps1
, and the output should be at \Release\LibSnitcher
Set-Location "$env:SystemDrive\LibSnitcher"
& '.\Tools\Build.ps1'
Import-Module '.\Release\LibSnitcher\LibSnitcher.psd1'
This command lists the module's dependency chain. Due to the nature of module dependencies, if a module
appears more than once, its dependency chain is brought only once. Subsequent appearances show only
module information.
You can also bring unique module information by using the -Unique
parameter. This will only bring
the first occurrence of a module.
Attention! Using the -Unique
parameter might not return all dependencies for a given module.
The -Path
parameter accepts a file path, module name, or .NET fully qualified assembly name.
The -Depth
parameter allows to set the maximum recursion depth. I.E.: depth = 1 will only
return the dependencies for the main module.
Get-PeDependencyChain -Path 'C:\Windows\System32\kernel32.dll'
Get-PeDependencyChain -Path 'System.Private.CoreLib, Version=8.0.0.0, Culture=neutral'
Get-PeDependencyChain -Name 'explorer.exe' -Unique
Get-PeDependencyChain -Name 'ntdll.dll' -Depth 1
This command lists the dependencies of a given module that failed to load. The -Path
parameter works
like the previous command, with file path, module name, or .NET fully qualified name.
The -ClrOnly
parameter returns only .NET assemblies that failed to load.
Get-PeFailedDependency -Path 'C:\repos\MyAwesomeProject\MyAwesomeLibrary.dll'
Get-PeFailedDependency -Path 'MyAwesomeLibrary, Version=0.0.0.0, Culture=neutral' -ClrOnly
This command returns information from the portable executable headers. Although implemented
differently, it mimics the System.Reflection.PortableExecutable.PEHeaders
, from .NET Core.
The object does not include the DOS header
.
The -Path
parameter must contain a file path to a valid portable executable.
Get-PeHeaders -Path 'C:\Windows\System32\ntdll.dll'
This project draws inspiration from the great Dependencies.
The documentation used is available in the Microsoft docs:
PE file format
The 'Assembly' class
The 'PortableExecutable' namespace