SysUtils

Author(s)

• Manuel Alcocer J

Tags

PE DLL OCX COM TypeLib dotnet Inspector Sysadmin Windows PowerShell5

Functions

Get-DllInfo

Dependencies

This module has no dependencies.

Release Notes

1.1.0 - Add -IncludeComRegistration switch.

Cross-references the CoClasses declared in the DLL's embedded TypeLib
against HKCR\CLSID across HKLM/HKCU x64+x86 views to determine whether
a COM in-proc server is correctly registered, plus surfaces every CLSID
whose InprocServer32 points at the inspected DLL. Uses
Microsoft.Win32.RegistryKey directly (full HKCR\CLSID walk drops from
~20s to ~1s vs the PowerShell registry provider). Strictly read-only:
no regsvr32, no LoadLibrary, no admin needed. Per-CLSID statuses:
Registered / DeclaredOnly / PathMismatch / RegisteredOnly. Global
verdict: OK / Partial / Unregistered / NotApplicable.

1.0.0 - Initial release.

Get-DllInfo: read-only Windows PE inspector that parses DLL/OCX/EXE/SYS
files without LoadLibrary (so cross-bitness inspection works and DllMain is
never executed). Layered output controlled by switches:

 - default: PE header (architecture, subsystem, characteristics, sections,
   timestamp), version info, shallow COM detection, shallow .NET detection.
 - -IncludeImports: full IDT/ILT walk including import-by-ordinal.
 - -IncludeExports: full export table with forwarder detection.
 - -IncludeResources: recursive 3-level resource tree walk.
 - -IncludeTypeLib: TypeLib reader via oleaut32!LoadTypeLibEx (CoClasses,
   interfaces, methods, parameters, enums, aliases, IIDs/CLSIDs).
 - -IncludeDotNetTypes: ReflectionOnlyLoadFrom for [ComVisible]/[Guid]/
   [ProgId] per type.
 - -IncludeSignature: Authenticode signature.
 - -IncludeHash: SHA-256.
 - -Detailed: turns on every Include* switch.

For managed assemblies, PEKind disambiguates AnyCPU / AnyCPUPrefer32 /
x86 / x64 / ARM64 / ManagedMixed using Machine + PE32/PE32+ + CorFlags.