WhichDll

A simple tool to find which DLL actually contains an API that is exported from an import library ("implib"). For example, UWP applications typically link against WindowsApp.lib but this is an "umbrella library" that contains most of the exports supported by the Windows Store, regardless of where they come from.

Unlike traditional implibs like kernel32.lib, there is no matching DLL named WindowsApp.dll; instead, the APIs are exported by various other DLLs in Windows. So for example to statically reference the API CreateFileFromAppW from your app, you just link with WindowsApp.lib. But if you wanted to load it dynamically via LoadLibrary, which DLL would you specify?

WhichDll uses the SDK tool dumpbin.exe to find all the exports in an implib and then parses the output to find the desired information. The tool also maps API Sets with implementation DLLs but that is only valid on the machine where the tool is invoked; two different devices might have different implementation DLLs based on Device Family, OS Version, etc. so you should always use the API Set name at runtime.

Here's an example output looking for CreateFileFromAppW in the default OneCoreUAP import library (see below for full syntax):

C:\>WhichDll CreateFileFromAppW -nologo
CreateFileFromAppW is exported by api-ms-win-core-file-fromapp-l1-1-0.dll --> windows.storage.onecore.dll on this machine.

So from this output we can see that CreateFileFromAppW is exported by api-ms-win-core-file-fromapp-l1-1-0.dll and this is the DLL we would use for a call to LoadLibrary. If we needed to do further investigation on this machine then we could look at windows.storage.onecore.dll:

C:\Windows\System32\>dumpbin /exports windows.storage.onecore.dll | findstr CreateFileFromAppW
         15    E 00011CE0 CreateFileFromAppW

Here is the full help output from the tool:

WhichDll: Which DLL exports a given function, according to an implib?
          Source available at https://github.com/ptorr-msft/WhichDll.

Usage: WhichDll <export> [<implib>] [-nologo]

By default, the <export> is case-insensitive and will report all functions
that match the given prefix. If <implib> is not provided, it defaults to
onecoreuap.lib.

For example, to find out which DLL contains CreateFileFromAppW according to
OneCoreUap.lib, you can use any of the following:

       WhichDll CreateFileFromAppW onecoreuap.lib
       WhichDll CreateFileFrom onecoreuap
       WhichDll createfile

Third command-line above will return results for other exports that begin with
'createfile' such as CreateFileA, CreateFile2, etc.

You can also use a regular expression for the <export>. For example, the
following finds CreateFileFromAppW and a couple of other exports:

       WhichDll Create.*AppW

If the DLL referenced in the implib is actually an API Set, WhichDll will
attempt to locate the DLL that hosts the API *on this machine*  please note
that it could resolve to a different DLL on a different machine, so you
should *not* depend on this information for anything other than local
debugging.

If you specify '-i' as the <implib>, WhichDll will read from stdin. this can
be useful for piping the output of dumpbin (or something else) into the app:

       c:\path\to\dumpbin -all c:\path\to\foo.lib | whichdll someexport -i

The -nologo switch hides the banner and other non-essential output.```