How can I see all the DLLs that were loaded into a process, even though some may be unloaded? I can’t do any real-monitoring approach on the process like hooking the process, because the check is made after everything is loaded and unloaded.
I tried using LoadedDllsView from nirsoft and ProcMon from microsoft but none showed the correct information/information that I was looking for.
0
Detecting the currently loaded DLLs in a process is fairly easy, but Windows does not keep any history about DLLs being unloaded. So, once a DLL has been unloaded, that’s game over, there is no information about it ever having been loaded. So, if you want that info, you have to monitor the loads in real time and save the info for yourself.