CreateProcess STATUS_DLL_NOT_FOUND - which dll? CreateProcess STATUS_DLL_NOT_FOUND - which dll? windows windows

CreateProcess STATUS_DLL_NOT_FOUND - which dll?


CreateProcess returns 0 indicating success.

CreateProcess() returns a BOOL, where 0 is FALSE, aka failure not success.

If a process fails to start and would return STATUS_DLL_NOT_FOUND, how do I programmatically retrieve the library name to which the target process was linked which couldn't be found?

Unfortunately, there is no API for that. Your only option would be to manually access and enumerate the executable's IMPORTS table to find out what DLLs it uses, and then recursively access and enumerate their IMPORTS tables, manually checking every DLL reference you find to see whether that DLL file exists on the OS's search path or not.


If the dll is statically linked you can walk the iat and see if the dll exists. If the dll is dynamically loaded then starting the process suspended and hooking LoadLibrary (or instead of hooking emulate a debugger) is the only way I see.


The best way is to use loader snaps. Basically you use gflags.exe (which is included with windbg) to enable loader snaps; then, run the process with the debugger attached. Loader snaps will enable the loader to print out dbg messages of the process and it will print the failures.

gflags.exe -i yourcode.exe +slswindbg yourcode.exe

I know this is not a "programmatic" way to find out the problem, but what the loader does is complicated, and you don't really want to be redoing its logic to find the failure. That is why loader snaps were invented.