The ListDlls SysInternals tool is used to list the DLLs that are loaded into processes on the system. It can either return DLLs for all processes, a single process or return processes that contain a particular DLL. It also has the ability to flag DLLs that are rebased and unsigned. Most of this functionality is relatively easy to implement in PowerShell. The Get-Process cmdlet returns System.Diagnostics.ProcessInfo classes that contain a Modules property. The property returns the DLLs that are currently loaded into the process. It also returns module base information. One property it does not contain is signing information. This can be accomplished with the WinVerifyTrust Win32 function. This Stackoverflow post contains a C# implementation for accessing this particular API call.
The following advanced function accepts a process name or IDs from the pipe, a module name and whether to filter by unsigned binaries. The P\Invoke for verifying signed files can be found in the PInvoke.ps1 file in the PoshInternals module.
function Get-Dll { [CmdletBinding()] param( [Parameter(ValueFromPipeline=$true)] [String]$ProcessName = "", [Parameter(ValueFromPipeline=$true)] [Int]$ProcessId = 0, [Parameter()] [String]$ModuleName, [Parameter()] [Switch]$Unsigned ) Begin{ $script:Modules = @() $script:Processes = @() } Process { if (-not [String]::IsNullOrEmpty($ProcessName)) { $Modules += Get-Process -Name $ProcessName | Select-Object -ExpandProperty Modules } elseif ($ProcessId -ne 0) { $Modules += Get-Process -Id $ProcessId | Select-Object -ExpandProperty Modules } elseif(-not [String]::IsNullOrEmpty($ModuleName)) { $Processes = Get-Process | Where-Object { ($_.Modules).ModuleName -Contains $ModuleName } } else { $Modules += Get-Process | Select-Object -ExpandProperty Modules } } End { if ($Processes.Length -gt 0) { $Processes return } if (-not [String]::IsNullOrEmpty($ModuleName)) { $Modules = $Modules | Where-Object { $_.ModuleName -eq $ModuleName } } if ($Unsigned) { $Modules = $Modules | Where { -not [PoshInternals.AuthenticodeTools]::IsTrusted($_.FileName) } } $Modules } } |








[...] PoshInternals – Get-Dll (Adam Driscoll) [...]
Great blog series, Adam!
Really, love the idea of getting sysinternals in PS without processings csv and such… 
One note here though – why not use Get-Process’es -Module switch…? It would get you “there” sooner I guess… ?
Thanks! Because I didn’t even realize that Get-Process had that switch! I will certainly update the PoshIntenals module to reflect that. Much simpler!
[...] [...]
[...] PoshInternals – Get-Dll by Adam Driscoll [...]
[...] PoshInternals – Get-Dll by Adam Driscoll [...]
[...] PoshInternals – Get-Dll by Adam Driscoll [...]
[...] PoshInternals – Get-Dll by Adam Driscoll [...]