DLL Watch

DLL Watch is a Windows command-line tool written in C for inspecting processes, listing loaded modules, and monitoring successful DLL load events in real time through ETW.

Features

• List running processes with PID, parent PID, executable name, and image path.
• Filter the process list by PID or executable name.
• Enumerate currently loaded module paths by PID or process name.
• Monitor DLL load events for a process by PID or process name.
• Display the event PID, process image path when available, DLL base address, image size, and DLL path.
• Classify DLL paths by location and report a separate writable-context hint.
• Match process names with or without the .exe suffix, without regard to letter case.
• Check that a PID exists before starting -monitor-pid monitoring.
• Verify DLL digital signatures using embedded Authenticode signatures and Windows catalog signatures.
• Display signature verification status (valid, unsigned, or failed), signature type (embedded, catalog, or none), and signer identity.
• Extract signer information from both embedded signatures and catalog signatures.

Module enumeration is a snapshot of modules currently loaded. ETW monitoring reports new DLL load events after the monitoring session starts; it does not provide a retroactive list of modules already loaded.

The lifecycle monitor pairs DLL load and unload events by PID, image base, and path. It derives displayed event times from ETW timestamps and computes lifetime from their 100-nanosecond FILETIME intervals, marks unloads whose load event was not observed, and labels a process as tearing down when its PID is no longer present. It provides lifecycle context and does not make a suspiciousness verdict.

DLL path classification reports a semantic location (system32, syswow64, winsxs, program-files, application-directory, appdata, temp, downloads, public, or other) and a separate Writable hint. The hint is based on these standard locations, not a live ACL check; unknown means the tool cannot infer writability from the path alone. Neither field is a suspiciousness verdict.

Requirements

• Windows 8 or later for a custom named system logger session that receives SystemTraceProvider events.
• A C compiler with Windows SDK or MinGW-w64 headers and libraries.
• Sufficient privileges to start a system logger session. Run from an elevated terminal if ETW reports an access error.

Build

From the src directory, with Microsoft Visual C (Developer Command Prompt):

cl /W4 /Fe:dll-watch.exe main.c etw_monitor.c dll_path.c dll_resolution.c dll_lifecycle.c dll_signature.c /link Psapi.lib Advapi32.lib Tdh.lib Wintrust.lib Crypt32.lib

With MinGW-w64:

C:\mingw64\bin\gcc.exe -Wall -Wextra -Wpedantic -o dll-watch.exe main.c etw_monitor.c dll_path.c dll_resolution.c dll_lifecycle.c dll_signature.c -lpsapi -ladvapi32 -ltdh -lwintrust -lcrypt32

Usage

dll-watch.exe -help
dll-watch.exe -processes
dll-watch.exe -pid <PID>
dll-watch.exe -name <PROCESS_NAME>
dll-watch.exe -modules <PID>
dll-watch.exe -modules-name <PROCESS_NAME>
dll-watch.exe -monitor-pid <PID>
dll-watch.exe -monitor-name <PROCESS_NAME>
dll-watch.exe -monitor-unload <PROCESS_NAME|PID>
dll-watch.exe -monitor-lifecycle <PROCESS_NAME|PID>
dll-watch.exe -monitor-name-not-found <PROCESS_NAME|PID>
dll-watch.exe -monitor-resolution <PROCESS_NAME|PID>

Process names may be given with or without .exe. Name-based monitoring tracks every currently running process with that name and any matching process that starts while monitoring. PID-based monitoring targets only the specified process. -monitor-name reports DLL loads. -monitor-name-not-found reports missing .dll search candidates that end with STATUS_OBJECT_NAME_NOT_FOUND. -monitor-resolution keeps those individual lookup and load events, and also correlates matching PID and DLL basenames when a load follows a failed lookup within five seconds. This is a time-based correlation, not proof of loader causality. Monitoring continues until the program is stopped, for example with Ctrl+C.

Use -monitor-unload to show raw DLL unload events, -monitor-lifecycle to correlate loads and unloads, -monitor-name-not-found to show only .dll file open attempts that end with STATUS_OBJECT_NAME_NOT_FOUND, or -monitor-resolution to show lookup-to-load correlations. These commands accept a process name or PID.

Examples

List all running processes:

dll-watch.exe -processes

Show a process by PID:

dll-watch.exe -pid 4520

Find processes by name:

dll-watch.exe -name <PROCESS_NAME>

List modules currently loaded by a process:

dll-watch.exe -modules 4520
dll-watch.exe -modules-name <PROCESS_NAME>

Monitor new DLL loads by PID or process name:

dll-watch.exe -monitor-pid 4520
dll-watch.exe -monitor-name <PROCESS_NAME>
dll-watch.exe -monitor-unload <PROCESS_NAME>
dll-watch.exe -monitor-unload 4520
dll-watch.exe -monitor-lifecycle <PROCESS_NAME>
dll-watch.exe -monitor-lifecycle 4520
dll-watch.exe -monitor-name-not-found <PROCESS_NAME>
dll-watch.exe -monitor-name-not-found 4520
dll-watch.exe -monitor-resolution <PROCESS_NAME>
dll-watch.exe -monitor-resolution 4520

A DLL load event is printed with the process PID and image path (or <unavailable>), DLL base address, image size, and DLL path. Lifecycle records show load and unload times, fractional-millisecond lifetime, process state, and whether the unload was normal or part of process teardown. Unmatched unloads are reported when the load happened before monitoring began. NAME NOT FOUND events include the target PID and attempted path. If a previous DllWatchKernelSession session remains, the tool attempts to stop that named session and start it again. It does not stop the NT Kernel Logger session.

Signature Verification

DLL Watch verifies digital signatures for successfully loaded images using Windows trust and certificate APIs.

The tool first checks for an embedded Authenticode signature. If no embedded signature is found, it attempts Windows catalog signature verification.

For each inspected image, the tool reports:

• Signature: valid, unsigned, or verification failed.
• Signature type: embedded, catalog, or none.
• Signer: certificate subject name when available.

Example:

DLL: C:\Windows\System32\MsSpellCheckingFacility.dll Signature: valid Signature type: catalog Signer: Microsoft Windows

An unsigned DLL may be legitimate, and a valid signature does not guarantee that a file is benign.

Signer information represents certificate identity, not an application-specific trusted publisher allowlist.

Signature verification currently runs synchronously during ETW event processing. Caching and asynchronous enrichment are planned to reduce overhead.

Roadmap

Completed

• Capture file open attempts that end with NAME NOT FOUND.
• Add separate monitoring commands for unloaded DLLs and not-found paths.
• Classify DLL paths by semantic location and writable context.
• Verify embedded Authenticode signatures.
• Verify Windows catalog signatures.
• Extract signer identity from embedded and catalog signatures.
• Report signature verification status and signature type.
• Correlate DLL loads and unloads and report module lifetimes.
• Correlate failed lookups with later loads by PID, DLL basename, and a five-second time window.
• Discover newly started processes during name-based monitoring.

Planned

• Add signature verification caching and asynchronous processing.
• Improve process exit handling and PID reuse protection.
• Implement expected-signer validation and trusted publisher policies.
• Track repeated load/unload patterns and unusual process-to-DLL relationships.
• Correlate loads with later process access and thread-creation activity.
• Add optional CSV output and analysis features for DLL search-order hijacking research.

Notes

Windows may deny access to protected or elevated processes. The process image path may therefore be unavailable even when the ETW event is received. A custom system logger session can only be multiplexed with SystemTraceProvider on Windows 8 and later; Windows 7 and Windows Server 2008 R2 support that provider only through the NT Kernel Logger session.